Security update for nodejs18

Announcement ID: SUSE-SU-2024:2496-1
Rating: moderate
References:
Cross-References:
CVSS scores:
  • CVE-2024-22020 ( SUSE ): 6.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H
Affected Products:
  • SUSE Linux Enterprise High Performance Computing 12 SP2
  • SUSE Linux Enterprise High Performance Computing 12 SP3
  • SUSE Linux Enterprise High Performance Computing 12 SP4
  • SUSE Linux Enterprise High Performance Computing 12 SP5
  • SUSE Linux Enterprise Server 12
  • SUSE Linux Enterprise Server 12 SP1
  • SUSE Linux Enterprise Server 12 SP2
  • SUSE Linux Enterprise Server 12 SP3
  • SUSE Linux Enterprise Server 12 SP4
  • SUSE Linux Enterprise Server 12 SP5
  • SUSE Linux Enterprise Server for SAP Applications 12
  • SUSE Linux Enterprise Server for SAP Applications 12 SP1
  • SUSE Linux Enterprise Server for SAP Applications 12 SP2
  • SUSE Linux Enterprise Server for SAP Applications 12 SP3
  • SUSE Linux Enterprise Server for SAP Applications 12 SP4
  • SUSE Linux Enterprise Server for SAP Applications 12 SP5
  • Web and Scripting Module 12

An update that solves three vulnerabilities can now be installed.

Description:

This update for nodejs18 fixes the following issues:

Update to 18.20.4:

  • CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)
  • CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)

Changes in 18.20.3:

  • This release fixes a regression introduced in Node.js 18.19.0 where http.server.close() was incorrectly closing idle connections. deps:
  • acorn updated to 8.11.3.
  • acorn-walk updated to 8.3.2.
  • ada updated to 2.7.8.
  • c-ares updated to 1.28.1.
  • corepack updated to 0.28.0.
  • nghttp2 updated to 1.61.0.
  • ngtcp2 updated to 1.3.0.
  • npm updated to 10.7.0. Includes a fix from npm@10.5.1 to limit the number of open connections npm/cli#7324.
  • simdutf updated to 5.2.4.

Changes in 18.20.2:

  • CVE-2024-27980: Fixed command injection via args parameter of child_process.spawn without shell option enabled on Windows (bsc#1222665)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • Web and Scripting Module 12
    zypper in -t patch SUSE-SLE-Module-Web-Scripting-12-2024-2496=1

Package List:

  • Web and Scripting Module 12 (aarch64 ppc64le s390x x86_64)
    • nodejs18-devel-18.20.4-8.24.1
    • nodejs18-debugsource-18.20.4-8.24.1
    • npm18-18.20.4-8.24.1
    • nodejs18-18.20.4-8.24.1
    • nodejs18-debuginfo-18.20.4-8.24.1
  • Web and Scripting Module 12 (noarch)
    • nodejs18-docs-18.20.4-8.24.1

References: