Security update for nodejs14

Announcement ID:	SUSE-SU-2021:3211-1
Rating:	important
References:	bsc#1188881 bsc#1188917 bsc#1189368 bsc#1189369 bsc#1189370
Cross-References:	CVE-2021-22930 CVE-2021-22931 CVE-2021-22939 CVE-2021-22940 CVE-2021-3672
CVSS scores:	CVE-2021-22930 ( SUSE ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2021-22930 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-22931 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2021-22931 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-22939 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVE-2021-22939 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2021-22940 ( SUSE ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2021-22940 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-3672 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVE-2021-3672 ( NVD ): 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected Products:	SUSE Linux Enterprise High Performance Computing 15 SP2 SUSE Linux Enterprise High Performance Computing 15 SP3 SUSE Linux Enterprise Server 15 SP2 SUSE Linux Enterprise Server 15 SP2 Business Critical Linux 15-SP2 SUSE Linux Enterprise Server 15 SP3 SUSE Linux Enterprise Server 15 SP3 Business Critical Linux 15-SP3 SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Server 4.1 SUSE Manager Server 4.2 Web and Scripting Module 15-SP2 Web and Scripting Module 15-SP3

An update that solves five vulnerabilities can now be installed.

Description:

This update for nodejs14 fixes the following issues:

• CVE-2021-3672: Fixed missing input validation on hostnames (bsc#1188881).
• CVE-2021-22931: Fixed improper handling of untypical characters in domain names (bsc#1189370).
• CVE-2021-22940: Use after free on close http2 on stream canceling (bsc#1189368)
• CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (bsc#1189369)
• CVE-2021-22930: Fixed use after free on close http2 on stream canceling (bsc#1188917).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• Web and Scripting Module 15-SP2
  zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP2-2021-3211=1
• Web and Scripting Module 15-SP3
  zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP3-2021-3211=1

Package List:

• Web and Scripting Module 15-SP2 (aarch64 ppc64le s390x x86_64)
  • nodejs14-devel-14.17.5-5.15.5
  • nodejs14-debugsource-14.17.5-5.15.5
  • nodejs14-debuginfo-14.17.5-5.15.5
  • nodejs14-14.17.5-5.15.5
  • npm14-14.17.5-5.15.5
• Web and Scripting Module 15-SP2 (noarch)
  • nodejs14-docs-14.17.5-5.15.5
• Web and Scripting Module 15-SP3 (aarch64 ppc64le s390x x86_64)
  • nodejs14-devel-14.17.5-5.15.5
  • nodejs14-debugsource-14.17.5-5.15.5
  • nodejs14-debuginfo-14.17.5-5.15.5
  • nodejs14-14.17.5-5.15.5
  • npm14-14.17.5-5.15.5
• Web and Scripting Module 15-SP3 (noarch)
  • nodejs14-docs-14.17.5-5.15.5

References:

• https://www.suse.com/security/cve/CVE-2021-22930.html
• https://www.suse.com/security/cve/CVE-2021-22931.html
• https://www.suse.com/security/cve/CVE-2021-22939.html
• https://www.suse.com/security/cve/CVE-2021-22940.html
• https://www.suse.com/security/cve/CVE-2021-3672.html
• https://bugzilla.suse.com/show_bug.cgi?id=1188881
• https://bugzilla.suse.com/show_bug.cgi?id=1188917
• https://bugzilla.suse.com/show_bug.cgi?id=1189368
• https://bugzilla.suse.com/show_bug.cgi?id=1189369
• https://bugzilla.suse.com/show_bug.cgi?id=1189370