This update for nodejs14 fixes the following issues:
nodejs14 was updated to 14.18.1:
* deps: update llhttp to 2.1.4
- HTTP Request Smuggling due to spaced in headers (bsc#1191601,
CVE-2021-22959)
- HTTP Request Smuggling when parsing the body (bsc#1191602,
CVE-2021-22960)
Changes in 14.18.0:
* buffer:
+ introduce Blob
+ add base64url encoding option
* child_process:
+ allow options.cwd receive a URL
+ add timeout to spawn and fork
+ allow promisified exec to be cancel
+ add 'overlapped' stdio flag
* dns: add "tries" option to Resolve options
* fs:
+ allow empty string for temp directory prefix
+ allow no-params fsPromises fileHandle read
+ add support for async iterators to fsPromises.writeFile
* http2: add support for sensitive headers * process: add 'worker' event
* tls: allow reading data into a static buffer
* worker: add...
Read the Full AdvisoryPatch Instructions:
To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 15.2:
zypper in -t patch openSUSE-2021-1552=1
- openSUSE Leap 15.2 (noarch):
nodejs14-docs-14.18.1-lp152.17.1
- openSUSE Leap 15.2 (x86_64):
nodejs14-14.18.1-lp152.17.1
nodejs14-debuginfo-14.18.1-lp152.17.1
nodejs14-debugsource-14.18.1-lp152.17.1
nodejs14-devel-14.18.1-lp152.17.1
npm14-14.18.1-lp152.17.1
https://www.suse.com/security/cve/CVE-2021-22959.html
https://www.suse.com/security/cve/CVE-2021-22960.html
https://www.suse.com/security/cve/CVE-2021-37701.html
https://www.suse.com/security/cve/CVE-2021-37712.html
https://www.suse.com/security/cve/CVE-2021-37713.html
https://www.suse.com/security/cve/CVE-2021-39134.html
https://www.suse.com/security/cve/CVE-2021-39135.html
https://bugzilla.suse.com/1190053
https://bugzilla.suse.com/1190054
https://bugzilla.suse.com/1190055
https://bugzilla.suse.com/1190056
https://bugzilla.suse.com/1190057
https://bugzilla.suse.com/1191601
https://bugzilla.suse.com/1191602
Get the latest Linux and open source security news straight to your inbox.