Security update for nodejs4

Announcement ID:	SUSE-SU-2019:0117-1
Rating:	important
References:	bsc#1113534 bsc#1113652 bsc#1117625 bsc#1117626 bsc#1117627 bsc#1117629 bsc#1117630
Cross-References:	CVE-2018-0734 CVE-2018-12116 CVE-2018-12120 CVE-2018-12121 CVE-2018-12122 CVE-2018-12123 CVE-2018-5407
CVSS scores:	CVE-2018-0734 ( SUSE ): 5.9 CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N CVE-2018-0734 ( NVD ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2018-0734 ( NVD ): 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2018-12116 ( SUSE ): 4.2 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N CVE-2018-12116 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2018-12116 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2018-12120 ( SUSE ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2018-12120 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2018-12120 ( NVD ): 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2018-12121 ( SUSE ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2018-12121 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2018-12121 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2018-12122 ( SUSE ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2018-12122 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2018-12122 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2018-12123 ( SUSE ): 5.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2018-12123 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2018-12123 ( NVD ): 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVE-2018-5407 ( SUSE ): 4.8 CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2018-5407 ( NVD ): 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2018-5407 ( NVD ): 4.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products:	SUSE Enterprise Storage 4 SUSE Linux Enterprise High Performance Computing 12 SP2 SUSE Linux Enterprise High Performance Computing 12 SP3 SUSE Linux Enterprise High Performance Computing 12 SP4 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 Web and Scripting Module 12

An update that solves seven vulnerabilities can now be installed.

Description:

This update for nodejs4 fixes the following issues:

Security issues fixed:

• CVE-2018-0734: Fixed a timing vulnerability in the DSA signature generation (bsc#1113652)
• CVE-2018-5407: Fixed a hyperthread port content side channel attack (aka "PortSmash") (bsc#1113534)
• CVE-2018-12120: Fixed that the debugger listens on any interface by default (bsc#1117625)
• CVE-2018-12121: Fixed a denial of Service with large HTTP headers (bsc#1117626)
• CVE-2018-12122: Fixed the "Slowloris" HTTP Denial of Service (bsc#1117627)
• CVE-2018-12116: Fixed HTTP request splitting (bsc#1117630)
• CVE-2018-12123: Fixed hostname spoofing in URL parser for javascript protocol (bsc#1117629)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• Web and Scripting Module 12
  zypper in -t patch SUSE-SLE-Module-Web-Scripting-12-2019-117=1
• SUSE Enterprise Storage 4
  zypper in -t patch SUSE-Storage-4-2019-117=1

Package List:

• Web and Scripting Module 12 (aarch64 ppc64le x86_64)
  • nodejs4-debugsource-4.9.1-15.17.1
  • nodejs4-4.9.1-15.17.1
  • nodejs4-debuginfo-4.9.1-15.17.1
  • npm4-4.9.1-15.17.1
  • nodejs4-devel-4.9.1-15.17.1
• Web and Scripting Module 12 (noarch)
  • nodejs4-docs-4.9.1-15.17.1
• SUSE Enterprise Storage 4 (aarch64 x86_64)
  • nodejs4-4.9.1-15.17.1
  • nodejs4-debuginfo-4.9.1-15.17.1
  • nodejs4-debugsource-4.9.1-15.17.1

References:

• https://www.suse.com/security/cve/CVE-2018-0734.html
• https://www.suse.com/security/cve/CVE-2018-12116.html
• https://www.suse.com/security/cve/CVE-2018-12120.html
• https://www.suse.com/security/cve/CVE-2018-12121.html
• https://www.suse.com/security/cve/CVE-2018-12122.html
• https://www.suse.com/security/cve/CVE-2018-12123.html
• https://www.suse.com/security/cve/CVE-2018-5407.html
• https://bugzilla.suse.com/show_bug.cgi?id=1113534
• https://bugzilla.suse.com/show_bug.cgi?id=1113652
• https://bugzilla.suse.com/show_bug.cgi?id=1117625
• https://bugzilla.suse.com/show_bug.cgi?id=1117626
• https://bugzilla.suse.com/show_bug.cgi?id=1117627
• https://bugzilla.suse.com/show_bug.cgi?id=1117629
• https://bugzilla.suse.com/show_bug.cgi?id=1117630