Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

openSUSE: 2021:3964-1 Important: Nodejs14 HTTP Request Fixes

opensuse
Calendar Grey December 7, 2021
Scroller Opensuse
A significant patch for Fedora resolves severe vulnerabilities in Python, enhancing both security and performance.
An update that fixes 7 vulnerabilities is now available

Description

This update for nodejs14 fixes the following issues:

nodejs14 was updated to 14.18.1:

* deps: update llhttp to 2.1.4

- HTTP Request Smuggling due to spaced in headers (bsc#1191601,

CVE-2021-22959)

- HTTP Request Smuggling when parsing the body (bsc#1191602,

CVE-2021-22960)

Changes in 14.18.0:

* buffer:

+ introduce Blob

+ add base64url encoding option

* child_process:

+ allow options.cwd receive a URL

+ add timeout to spawn and fork

+ allow promisified exec to be cancel

+ add 'overlapped' stdio flag

* dns: add "tries" option to Resolve options

* fs:

+ allow empty string for temp directory prefix

+ allow no-params fsPromises fileHandle read

+ add support for async iterators to fsPromises.writeFile

* http2: add support for sensitive headers * process: add 'worker' event

* tls: allow reading data into a static buffer

* worker: add...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory update security fix important openSUSE nodejs HTTP request smuggling

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.3:

zypper in -t patch openSUSE-SLE-15.3-2021-3964=1

Package List

- openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64):

nodejs14-14.18.1-15.21.2

nodejs14-debuginfo-14.18.1-15.21.2

nodejs14-debugsource-14.18.1-15.21.2

nodejs14-devel-14.18.1-15.21.2

npm14-14.18.1-15.21.2

- openSUSE Leap 15.3 (noarch):

nodejs14-docs-14.18.1-15.21.2

References

https://www.suse.com/security/cve/CVE-2021-22959.html

https://www.suse.com/security/cve/CVE-2021-22960.html

https://www.suse.com/security/cve/CVE-2021-37701.html

https://www.suse.com/security/cve/CVE-2021-37712.html

https://www.suse.com/security/cve/CVE-2021-37713.html

https://www.suse.com/security/cve/CVE-2021-39134.html

https://www.suse.com/security/cve/CVE-2021-39135.html

https://bugzilla.suse.com/1190053

https://bugzilla.suse.com/1190054

https://bugzilla.suse.com/1190055

https://bugzilla.suse.com/1190056

https://bugzilla.suse.com/1190057

https://bugzilla.suse.com/1191601

https://bugzilla.suse.com/1191602

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2021:3964-1
Rating: important
Affected Products: openSUSE Leap 15.3 .

Topics%20covered

Topics Covered

security advisory update security fix important openSUSE nodejs HTTP request smuggling

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.