Security update for nodejs18

Announcement ID: SUSE-SU-2023:0419-1
Rating: moderate
References:
Cross-References:
CVSS scores:
  • CVE-2022-32212 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
  • CVE-2022-32212 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CVE-2022-32213 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H
  • CVE-2022-32213 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
  • CVE-2022-32214 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
  • CVE-2022-32214 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
  • CVE-2022-32215 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
  • CVE-2022-32215 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
  • CVE-2022-35255 ( SUSE ): 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
  • CVE-2022-35255 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
  • CVE-2022-35256 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
  • CVE-2022-35256 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
  • CVE-2022-43548 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
  • CVE-2022-43548 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products:
  • openSUSE Leap 15.4
  • openSUSE Leap 15.5
  • SUSE Linux Enterprise High Performance Computing 15 SP4
  • SUSE Linux Enterprise Server 15 SP4
  • SUSE Linux Enterprise Server for SAP Applications 15 SP4
  • SUSE Manager Proxy 4.3
  • SUSE Manager Retail Branch Server 4.3
  • SUSE Manager Server 4.3
  • Web and Scripting Module 15-SP4

An update that solves seven vulnerabilities, contains two features and has three security fixes can now be installed.

Description:

This update for nodejs18 fixes the following issues:

This update ships nodejs18 (jsc#PED-2097)

Update to NodejJS 18.13.0 LTS:

  • build: disable v8 snapshot compression by default
  • crypto: update root certificates
  • deps: update ICU to 72.1

  • doc:

  • add doc-only deprecation for headers/trailers setters

  • add Rafael to the tsc
  • deprecate use of invalid ports in url.parse

  • deprecate url.parse()

  • lib: drop fetch experimental warning

  • net: add autoSelectFamily and autoSelectFamilyAttemptTimeout options

  • src:

  • add uvwasi version

  • add initial shadow realm support

  • test_runner:

  • add t.after() hook

  • don't use a symbol for runHook()

  • tls:

  • add "ca" property to certificate object

  • util:

  • add fast path for utf8 encoding

  • improve textdecoder decode performance

  • add MIME utilities

  • Fixes compatibility with ICU 72.1 (bsc#1205236)

  • Fix migration to openssl-3 (bsc#1205042)

Update to NodeJS 18.12.1 LTS:

  • inspector: DNS rebinding in --inspect via invalid octal IP (bsc#1205119, CVE-2022-43548)

Update to NodeJS 18.12.0 LTS:

  • Running in 'watch' mode using node --watch restarts the process when an imported file is changed.
  • fs: add FileHandle.prototype.readLines
  • http: add writeEarlyHints function to ServerResponse
  • http2: make early hints generic
  • util: add default value option to parsearg

Update to NodeJS 18.11.0:

  • added experimental watch mode -- running in 'watch' mode using node --watch restarts the process when an imported file is changed
  • fs: add FileHandle.prototype.readLines
  • http: add writeEarlyHints function to ServerResponse
  • http2: make early hints generic
  • lib: refactor transferable AbortSignal
  • src: add detailed embedder process initialization API
  • util: add default value option to parsearg

Update to NodeJS 18.10.0:

  • deps: upgrade npm to 8.19.2
  • http: throw error on content-length mismatch
  • stream: add ReadableByteStream.tee()

Update to Nodejs 18.9.1:

  • deps: llhttp updated to 6.0.10

  • CVE-2022-32213 bypass via obs-fold mechanic (bsc#1201325)

  • Incorrect Parsing of Multi-line Transfer-Encoding (CVE-2022-32215, bsc#1201327)

  • Incorrect Parsing of Header Fields (CVE-2022-35256, bsc#1203832)

  • crypto: fix weak randomness in WebCrypto keygen (CVE-2022-35255, bsc#1203831)

Update to Nodejs 18.9.0:

  • lib - add diagnostics channel for process and worker
  • os - add machine method
  • report - expose report public native apis
  • src - expose environment RequestInterrupt api
  • vm - include vm context in the embedded snapshot

Changes in 18.8.0:

  • bootstrap: implement run-time user-land snapshots via --build-snapshot and --snapshot-blob. See
  • crypto:
  • allow zero-length IKM in HKDF and in webcrypto PBKDF2
  • allow zero-length secret KeyObject
  • deps: upgrade npm to 8.18.0
  • http: make idle http parser count configurable
  • net: add local family
  • src: print source map error source on demand
  • tls: pass a valid socket on tlsClientError

Update to Nodejs 18.7.0:

  • events: add CustomEvent
  • http: add drop request event for http server
  • lib: improved diagnostics_channel subscribe/unsubscribe

  • util: add tokens to parseArgs

  • enable crypto policy ciphers for TW and SLE15 SP4+ (bsc#1200303)

Update to Nodejs 18.6.0:

  • Experimental ESM Loader Hooks API. For details see, https://nodejs.org/api/esm.html
  • dns: export error code constants from dns/promises
  • esm: add chaining to loaders
  • http: add diagnostics channel for http client
  • http: add perf_hooks detail for http request and client
  • module: add isBuiltIn method
  • net: add drop event for net server
  • test_runner: expose describe and it
  • v8: add v8.startupSnapshot utils

For details, see https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.6.0

Update to Nodejs 18.5.0:

  • http: stricter Transfer-Encoding and header separator parsing (bsc#1201325, bsc#1201326, bsc#1201327, CVE-2022-32213, CVE-2022-32214, CVE-2022-32215)
  • src: fix IPv4 validation in inspector_socket (bsc#1201328, CVE-2022-32212)

For details, see https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.5.0

Update to Nodejs 18.4.0. For detailed changes see,

https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.4.0

Initial packaging of Nodejs 18.2.0. For detailed changes since previous versions, see https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V18.md#18.2.0

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • openSUSE Leap 15.4
    zypper in -t patch openSUSE-SLE-15.4-2023-419=1
  • openSUSE Leap 15.5
    zypper in -t patch openSUSE-SLE-15.5-2023-419=1
  • Web and Scripting Module 15-SP4
    zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP4-2023-419=1

Package List:

  • openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64)
    • nodejs18-debuginfo-18.13.0-150400.9.3.1
    • npm18-18.13.0-150400.9.3.1
    • corepack18-18.13.0-150400.9.3.1
    • nodejs18-18.13.0-150400.9.3.1
    • nodejs18-devel-18.13.0-150400.9.3.1
    • nodejs18-debugsource-18.13.0-150400.9.3.1
  • openSUSE Leap 15.4 (noarch)
    • nodejs18-docs-18.13.0-150400.9.3.1
  • openSUSE Leap 15.5 (aarch64 s390x x86_64)
    • nodejs18-debuginfo-18.13.0-150400.9.3.1
    • npm18-18.13.0-150400.9.3.1
    • corepack18-18.13.0-150400.9.3.1
    • nodejs18-18.13.0-150400.9.3.1
    • nodejs18-devel-18.13.0-150400.9.3.1
    • nodejs18-debugsource-18.13.0-150400.9.3.1
  • openSUSE Leap 15.5 (noarch)
    • nodejs18-docs-18.13.0-150400.9.3.1
  • Web and Scripting Module 15-SP4 (aarch64 ppc64le s390x x86_64)
    • npm18-18.13.0-150400.9.3.1
    • nodejs18-debuginfo-18.13.0-150400.9.3.1
    • nodejs18-18.13.0-150400.9.3.1
    • nodejs18-devel-18.13.0-150400.9.3.1
    • nodejs18-debugsource-18.13.0-150400.9.3.1
  • Web and Scripting Module 15-SP4 (noarch)
    • nodejs18-docs-18.13.0-150400.9.3.1

References: