Alerts This Week
Warning Icon 1 631
Alerts This Week
Warning Icon 1 631

openSUSE: 2021:1552-1 Important Update For Nodejs14 HTTP Issues

opensuse
Calendar Grey December 10, 2021
Dist Opensuse Esm H88
Important openSUSE patch resolves a variety of problems in nodejs14, enhancing both security and reliability for its users.
An update that fixes 7 vulnerabilities is now available

Description

This update for nodejs14 fixes the following issues:

nodejs14 was updated to 14.18.1:

* deps: update llhttp to 2.1.4

- HTTP Request Smuggling due to spaced in headers (bsc#1191601,

CVE-2021-22959)

- HTTP Request Smuggling when parsing the body (bsc#1191602,

CVE-2021-22960)

Changes in 14.18.0:

* buffer:

+ introduce Blob

+ add base64url encoding option

* child_process:

+ allow options.cwd receive a URL

+ add timeout to spawn and fork

+ allow promisified exec to be cancel

+ add 'overlapped' stdio flag

* dns: add "tries" option to Resolve options

* fs:

+ allow empty string for temp directory prefix

+ allow no-params fsPromises fileHandle read

+ add support for async iterators to fsPromises.writeFile

* http2: add support for sensitive headers * process: add 'worker' event

* tls: allow reading data into a static buffer

* worker: add...

Read the Full Advisory

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.2:

zypper in -t patch openSUSE-2021-1552=1

Package List

- openSUSE Leap 15.2 (noarch):

nodejs14-docs-14.18.1-lp152.17.1

- openSUSE Leap 15.2 (x86_64):

nodejs14-14.18.1-lp152.17.1

nodejs14-debuginfo-14.18.1-lp152.17.1

nodejs14-debugsource-14.18.1-lp152.17.1

nodejs14-devel-14.18.1-lp152.17.1

npm14-14.18.1-lp152.17.1

References

https://www.suse.com/security/cve/CVE-2021-22959.html

https://www.suse.com/security/cve/CVE-2021-22960.html

https://www.suse.com/security/cve/CVE-2021-37701.html

https://www.suse.com/security/cve/CVE-2021-37712.html

https://www.suse.com/security/cve/CVE-2021-37713.html

https://www.suse.com/security/cve/CVE-2021-39134.html

https://www.suse.com/security/cve/CVE-2021-39135.html

https://bugzilla.suse.com/1190053

https://bugzilla.suse.com/1190054

https://bugzilla.suse.com/1190055

https://bugzilla.suse.com/1190056

https://bugzilla.suse.com/1190057

https://bugzilla.suse.com/1191601

https://bugzilla.suse.com/1191602

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2021:1552-1
Rating: important
Affected Products: openSUSE Leap 15.2 .

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here