Security update for nodejs8

Announcement ID:	SUSE-SU-2019:2260-1
Rating:	important
References:	bsc#1144919 bsc#1146090 bsc#1146091 bsc#1146093 bsc#1146094 bsc#1146095 bsc#1146097 bsc#1146099 bsc#1146100
Cross-References:	CVE-2019-9511 CVE-2019-9512 CVE-2019-9513 CVE-2019-9514 CVE-2019-9515 CVE-2019-9516 CVE-2019-9517 CVE-2019-9518
CVSS scores:	CVE-2019-9511 ( SUSE ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-9511 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-9511 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-9512 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-9512 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-9512 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-9513 ( SUSE ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-9513 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-9513 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-9514 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-9514 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-9514 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-9515 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-9515 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-9515 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-9516 ( SUSE ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-9516 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2019-9516 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-9517 ( SUSE ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-9517 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-9517 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-9518 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-9518 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2019-9518 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:	SUSE Linux Enterprise High Performance Computing 15 SUSE Linux Enterprise High Performance Computing 15 SP1 SUSE Linux Enterprise Server 15 SUSE Linux Enterprise Server 15 SP1 SUSE Linux Enterprise Server 15 SP1 Business Critical Linux 15-SP1 SUSE Linux Enterprise Server for SAP Applications 15 SUSE Linux Enterprise Server for SAP Applications 15 SP1 SUSE Manager Proxy 4.0 SUSE Manager Retail Branch Server 4.0 SUSE Manager Server 4.0 Web and Scripting Module 15-SP1 Web and Scripting Module 15

An update that solves eight vulnerabilities and has one security fix can now be installed.

Description:

This update for nodejs8 to version 8.16.1 fixes the following issues:

Security issues fixed:

• CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091).
• CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099).
• CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094).
• CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).
• CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100).
• CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).
• CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097).
• CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).

Bug fixes:

• Fixed that npm resolves its default config file like in all other versions, as /etc/nodejs/npmrc (bsc#1144919).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• Web and Scripting Module 15
  zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-2019-2260=1
• Web and Scripting Module 15-SP1
  zypper in -t patch SUSE-SLE-Module-Web-Scripting-15-SP1-2019-2260=1

Package List:

• Web and Scripting Module 15 (aarch64 ppc64le s390x x86_64)
  • nodejs8-8.16.1-3.20.1
  • nodejs8-devel-8.16.1-3.20.1
  • nodejs8-debuginfo-8.16.1-3.20.1
  • nodejs8-debugsource-8.16.1-3.20.1
  • npm8-8.16.1-3.20.1
• Web and Scripting Module 15 (noarch)
  • nodejs8-docs-8.16.1-3.20.1
• Web and Scripting Module 15-SP1 (aarch64 ppc64le s390x x86_64)
  • nodejs8-8.16.1-3.20.1
  • nodejs8-devel-8.16.1-3.20.1
  • nodejs8-debuginfo-8.16.1-3.20.1
  • nodejs8-debugsource-8.16.1-3.20.1
  • npm8-8.16.1-3.20.1
• Web and Scripting Module 15-SP1 (noarch)
  • nodejs8-docs-8.16.1-3.20.1

References:

• https://www.suse.com/security/cve/CVE-2019-9511.html
• https://www.suse.com/security/cve/CVE-2019-9512.html
• https://www.suse.com/security/cve/CVE-2019-9513.html
• https://www.suse.com/security/cve/CVE-2019-9514.html
• https://www.suse.com/security/cve/CVE-2019-9515.html
• https://www.suse.com/security/cve/CVE-2019-9516.html
• https://www.suse.com/security/cve/CVE-2019-9517.html
• https://www.suse.com/security/cve/CVE-2019-9518.html
• https://bugzilla.suse.com/show_bug.cgi?id=1144919
• https://bugzilla.suse.com/show_bug.cgi?id=1146090
• https://bugzilla.suse.com/show_bug.cgi?id=1146091
• https://bugzilla.suse.com/show_bug.cgi?id=1146093
• https://bugzilla.suse.com/show_bug.cgi?id=1146094
• https://bugzilla.suse.com/show_bug.cgi?id=1146095
• https://bugzilla.suse.com/show_bug.cgi?id=1146097
• https://bugzilla.suse.com/show_bug.cgi?id=1146099
• https://bugzilla.suse.com/show_bug.cgi?id=1146100