SUSE-CU-2022:1550-1: Security update of bci/nodejs
sle-updates at lists.suse.com
sle-updates at lists.suse.com
Tue Jul 19 08:13:49 UTC 2022
SUSE Container Update Advisory: bci/nodejs
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2022:1550-1
Container Tags : bci/node:14 , bci/node:14-13.17 , bci/nodejs:14 , bci/nodejs:14-13.17
Container Release : 13.17
Severity : important
Type : security
References : 1197718 1199140 1199232 1199232 1200334 1200855 1201325 1201326
1201327 1201328 CVE-2022-1586 CVE-2022-1586 CVE-2022-32212 CVE-2022-32213
CVE-2022-32214 CVE-2022-32215
-----------------------------------------------------------------
The container bci/nodejs was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2360-1
Released: Tue Jul 12 12:01:39 2022
Summary: Security update for pcre2
Type: security
Severity: important
References: 1199232,CVE-2022-1586
This update for pcre2 fixes the following issues:
- CVE-2022-1586: Fixed unicode property matching issue. (bsc#1199232)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2361-1
Released: Tue Jul 12 12:05:01 2022
Summary: Security update for pcre
Type: security
Severity: important
References: 1199232,CVE-2022-1586
This update for pcre fixes the following issues:
- CVE-2022-1586: Fixed unicode property matching issue. (bsc#1199232)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2022:2406-1
Released: Fri Jul 15 11:49:01 2022
Summary: Recommended update for glibc
Type: recommended
Severity: moderate
References: 1197718,1199140,1200334,1200855
This update for glibc fixes the following issues:
- powerpc: Fix VSX register number on __strncpy_power9 (bsc#1200334)
- Disable warnings due to deprecated libselinux symbols used by nss and nscd (bsc#1197718)
- i386: Remove broken CAN_USE_REGISTER_ASM_EBP (bsc#1197718)
- rtld: Avoid using up static TLS surplus for optimizations (bsc#1200855, BZ #25051)
This readds the s390 32bit glibc and libcrypt1 libraries (glibc-32bit, glibc-locale-base-32bit, libcrypt1-32bit).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2022:2425-1
Released: Mon Jul 18 09:04:24 2022
Summary: Security update for nodejs14
Type: security
Severity: important
References: 1201325,1201326,1201327,1201328,CVE-2022-32212,CVE-2022-32213,CVE-2022-32214,CVE-2022-32215
This update for nodejs14 fixes the following issues:
- CVE-2022-32212: Fixed DNS rebinding in --inspect via invalid IP addresses (bsc#1201328).
- CVE-2022-32213: Fixed HTTP request smuggling due to flawed parsing of Transfer-Encoding (bsc#1201325).
- CVE-2022-32214: Fixed HTTP request smuggling due to improper delimiting of header fields (bsc#1201326).
- CVE-2022-32215: Fixed HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding (bsc#1201327).
The following package changes have been done:
- glibc-2.31-150300.31.2 updated
- libcrypt1-4.4.15-150300.4.4.3 updated
- libpcre1-8.45-150000.20.13.1 updated
- libpcre2-8-0-10.39-150400.4.3.1 updated
- nodejs14-14.20.0-150200.15.34.1 updated
- npm14-14.20.0-150200.15.34.1 updated
- container:sles15-image-15.0.0-27.8.6 updated
More information about the sle-updates
mailing list