openSUSE: 2023:3455-1: important: nodejs12 Security Advisory Update
Description
This update for nodejs12 fixes the following issues: * CVE-2023-23918: Fixed permissions policies bypass via process.mainModule (bsc#1208481). * CVE-2023-32002: Fixed permissions policies bypass via Module._load (bsc#1214150). * CVE-2023-32006: Fixed permissions policies impersonation using module.constructor.createRequire() (bsc#1214156). * CVE-2023-32559: Fixed permissions policies bypass via process.binding (bsc#1214154). * CVE-2023-30581: Fixed mainModule.proto bypass (bsc#1212574). * CVE-2023-30590: Fixed missing DiffieHellman key generation (bsc#1212583). * CVE-2023-30589: Fixed HTTP Request Smuggling via Empty headers separated by CR (bsc#1212582).
Patch
## Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server for SAP Applications 15 SP3 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-3455=1 * SUSE Manager Server 4.2 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-3455=1 * SUSE Enterprise Storage 7.1 zypper in -t patch SUSE-Storage-7.1-2023-3455=1 * SUSE Enterprise Storage 7 zypper in -t patch SUSE-Storage-7-2023-3455=1 * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3455=1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-3455=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-3455=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-3455=1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-3455=1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-3455=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2023-3455=1
Package List
* SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64) * nodejs12-devel-12.22.12-150200.4.50.1 * nodejs12-debuginfo-12.22.12-150200.4.50.1 * npm12-12.22.12-150200.4.50.1 * nodejs12-debugsource-12.22.12-150200.4.50.1 * nodejs12-12.22.12-150200.4.50.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch) * nodejs12-docs-12.22.12-150200.4.50.1 * SUSE Manager Server 4.2 (ppc64le s390x x86_64) * nodejs12-devel-12.22.12-150200.4.50.1 * nodejs12-debuginfo-12.22.12-150200.4.50.1 * npm12-12.22.12-150200.4.50.1 * nodejs12-debugsource-12.22.12-150200.4.50.1 * nodejs12-12.22.12-150200.4.50.1 * SUSE Manager Server 4.2 (noarch) * nodejs12-docs-12.22.12-150200.4.50.1 * SUSE Enterprise Storage 7.1 (aarch64 x86_64) * nodejs12-devel-12.22.12-150200.4.50.1 * nodejs12-debuginfo-12.22.12-150200.4.50.1 * npm12-12.22.12-150200.4.50.1 * nodejs12-debugsource-12.22.12-150200.4.50.1 * nodejs12-12.22.12-150200.4.50.1 * SUSE Enterprise Storage 7.1 (noarch) * nodejs12-docs-12.22.12-150200.4.50.1 * SUSE Enterprise Storage 7 (aarch64 x86_64) * nodejs12-devel-12.22.12-150200.4.50.1 * nodejs12-debuginfo-12.22.12-150200.4.50.1 * npm12-12.22.12-150200.4.50.1 * nodejs12-debugsource-12.22.12-150200.4.50.1 * nodejs12-12.22.12-150200.4.50.1 * SUSE Enterprise Storage 7 (noarch) * nodejs12-docs-12.22.12-150200.4.50.1 * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * nodejs12-devel-12.22.12-150200.4.50.1 * nodejs12-debuginfo-12.22.12-150200.4.50.1 * npm12-12.22.12-150200.4.50.1 * nodejs12-debugsource-12.22.12-150200.4.50.1 * nodejs12-12.22.12-150200.4.50.1 * openSUSE Leap 15.4 (noarch) * nodejs12-docs-12.22.12-150200.4.50.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 x86_64) * nodejs12-devel-12.22.12-150200.4.50.1 * nodejs12-debuginfo-12.22.12-150200.4.50.1 * npm12-12.22.12-150200.4.50.1 * nodejs12-debugsource-12.22.12-150200.4.50.1 * nodejs12-12.22.12-150200.4.50.1 * SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (noarch) * nodejs12-docs-12.22.12-150200.4.50.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (aarch64 x86_64) * nodejs12-devel-12.22.12-150200.4.50.1 * nodejs12-debuginfo-12.22.12-150200.4.50.1 * npm12-12.22.12-150200.4.50.1 * nodejs12-debugsource-12.22.12-150200.4.50.1 * nodejs12-12.22.12-150200.4.50.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (noarch) * nodejs12-docs-12.22.12-150200.4.50.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64) * nodejs12-devel-12.22.12-150200.4.50.1 * nodejs12-debuginfo-12.22.12-150200.4.50.1 * npm12-12.22.12-150200.4.50.1 * nodejs12-debugsource-12.22.12-150200.4.50.1 * nodejs12-12.22.12-150200.4.50.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch) * nodejs12-docs-12.22.12-150200.4.50.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64) * nodejs12-devel-12.22.12-150200.4.50.1 * nodejs12-debuginfo-12.22.12-150200.4.50.1 * npm12-12.22.12-150200.4.50.1 * nodejs12-debugsource-12.22.12-150200.4.50.1 * nodejs12-12.22.12-150200.4.50.1 * SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch) * nodejs12-docs-12.22.12-150200.4.50.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64) * nodejs12-devel-12.22.12-150200.4.50.1 * nodejs12-debuginfo-12.22.12-150200.4.50.1 * npm12-12.22.12-150200.4.50.1 * nodejs12-debugsource-12.22.12-150200.4.50.1 * nodejs12-12.22.12-150200.4.50.1 * SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch) * nodejs12-docs-12.22.12-150200.4.50.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64) * nodejs12-devel-12.22.12-150200.4.50.1 * nodejs12-debuginfo-12.22.12-150200.4.50.1 * npm12-12.22.12-150200.4.50.1 * nodejs12-debugsource-12.22.12-150200.4.50.1 * nodejs12-12.22.12-150200.4.50.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch) * nodejs12-docs-12.22.12-150200.4.50.1
References
* #1208481 * #1212574 * #1212582 * #1212583 * #1214150 * #1214154 * #1214156 ## References: * https://www.suse.com/security/cve/CVE-2023-23918.html * https://www.suse.com/security/cve/CVE-2023-30581.html * https://www.suse.com/security/cve/CVE-2023-30589.html * https://www.suse.com/security/cve/CVE-2023-30590.html * https://www.suse.com/security/cve/CVE-2023-32002.html * https://www.suse.com/security/cve/CVE-2023-32006.html * https://www.suse.com/security/cve/CVE-2023-32559.html * https://bugzilla.suse.com/show_bug.cgi?id=1208481 * https://bugzilla.suse.com/show_bug.cgi?id=1212574 * https://bugzilla.suse.com/show_bug.cgi?id=1212582 * https://bugzilla.suse.com/show_bug.cgi?id=1212583 * https://bugzilla.suse.com/show_bug.cgi?id=1214150 * https://bugzilla.suse.com/show_bug.cgi?id=1214154 * https://bugzilla.suse.com/show_bug.cgi?id=1214156
![Dist Opensuse](/images/distros/dist-opensuse.jpg)