Security update for nodejs4, nodejs6 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:2168-1 Final 1 1 2017-08-15T12:27:34Z current 2017-08-15T12:27:34Z 2017-08-15T12:27:34Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for nodejs4, nodejs6 This update for nodejs4 and nodejs6 fixes the following issues: Security issues fixed: - CVE-2017-1000381: The c-ares function ares_parse_naptr_reply() could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way. (bsc#1044946) - CVE-2017-11499: Disable V8 snapshots. The hashseed embedded in the snapshot is currently the same for all runs of the binary. This opens node up to collision attacks which could result in a Denial of Service. We have temporarily disabled snapshots until a more robust solution is found. (bsc#1048299) Non-security fixes: - GCC 7 compilation fixes for v8 backported and add missing ICU59 headers (bsc#1041282) - New upstream LTS release 6.11.1 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.11.1 - New upstream LTS release 6.11.0 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.11.0 - New upstream LTS release 6.10.3 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.3 - New upstream LTS release 6.10.2 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.2 - New upstream LTS release 6.10.1 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.1 - New upstream LTS release 6.10.0 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V6.md#6.10.0 - New upstream LTS release 4.8.4 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.4 - New upstream LTS release 4.8.3 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.3 - New upstream LTS release 4.8.2 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.2 - New upstream LTS release 4.8.1 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.1 - New upstream LTS release 4.8.0 * https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V4.md#4.8.0 The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-7-2017-1331,SUSE-SLE-Module-Web-Scripting-12-2017-1331,SUSE-Storage-4-2017-1331 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20172168-1/ Link for SUSE-SU-2017:2168-1 https://lists.suse.com/pipermail/sle-security-updates/2017-August/003136.html E-Mail link for SUSE-SU-2017:2168-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1041282 SUSE Bug 1041282 https://bugzilla.suse.com/1041283 SUSE Bug 1041283 https://bugzilla.suse.com/1044946 SUSE Bug 1044946 https://bugzilla.suse.com/1048299 SUSE Bug 1048299 https://www.suse.com/security/cve/CVE-2017-1000381/ SUSE CVE CVE-2017-1000381 page https://www.suse.com/security/cve/CVE-2017-11499/ SUSE CVE CVE-2017-11499 page SUSE Enterprise Storage 4 SUSE Linux Enterprise Module for Web and Scripting 12 SUSE OpenStack Cloud 7 nodejs-common-1.0-2.1 nodejs6-6.11.1-11.5.1 nodejs4-4.8.4-15.5.1 nodejs4-devel-4.8.4-15.5.1 nodejs4-docs-4.8.4-15.5.1 nodejs6-devel-6.11.1-11.5.1 nodejs6-docs-6.11.1-11.5.1 npm4-4.8.4-15.5.1 npm6-6.11.1-11.5.1 nodejs-common-1.0-2.1 as a component of SUSE Enterprise Storage 4 nodejs4-4.8.4-15.5.1 as a component of SUSE Enterprise Storage 4 nodejs6-6.11.1-11.5.1 as a component of SUSE Enterprise Storage 4 nodejs-common-1.0-2.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs4-4.8.4-15.5.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs4-devel-4.8.4-15.5.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs4-docs-4.8.4-15.5.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs6-6.11.1-11.5.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs6-devel-6.11.1-11.5.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs6-docs-6.11.1-11.5.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 npm4-4.8.4-15.5.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 npm6-6.11.1-11.5.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs-common-1.0-2.1 as a component of SUSE OpenStack Cloud 7 nodejs6-6.11.1-11.5.1 as a component of SUSE OpenStack Cloud 7 The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way. CVE-2017-1000381 SUSE Enterprise Storage 4:nodejs-common-1.0-2.1 SUSE Enterprise Storage 4:nodejs4-4.8.4-15.5.1 SUSE Enterprise Storage 4:nodejs6-6.11.1-11.5.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs-common-1.0-2.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.8.4-15.5.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.8.4-15.5.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-docs-4.8.4-15.5.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs6-6.11.1-11.5.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs6-devel-6.11.1-11.5.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs6-docs-6.11.1-11.5.1 SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.8.4-15.5.1 SUSE Linux Enterprise Module for Web and Scripting 12:npm6-6.11.1-11.5.1 SUSE OpenStack Cloud 7:nodejs-common-1.0-2.1 SUSE OpenStack Cloud 7:nodejs6-6.11.1-11.5.1 important 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172168-1/ https://www.suse.com/security/cve/CVE-2017-1000381.html CVE-2017-1000381 https://bugzilla.suse.com/1044946 SUSE Bug 1044946 Node.js v4.0 through v4.8.3, all versions of v5.x, v6.0 through v6.11.0, v7.0 through v7.10.0, and v8.0 through v8.1.3 was susceptible to hash flooding remote DoS attacks as the HashTable seed was constant across a given released version of Node.js. This was a result of building with V8 snapshots enabled by default which caused the initially randomized seed to be overwritten on startup. CVE-2017-11499 SUSE Enterprise Storage 4:nodejs-common-1.0-2.1 SUSE Enterprise Storage 4:nodejs4-4.8.4-15.5.1 SUSE Enterprise Storage 4:nodejs6-6.11.1-11.5.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs-common-1.0-2.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-4.8.4-15.5.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-devel-4.8.4-15.5.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs4-docs-4.8.4-15.5.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs6-6.11.1-11.5.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs6-devel-6.11.1-11.5.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs6-docs-6.11.1-11.5.1 SUSE Linux Enterprise Module for Web and Scripting 12:npm4-4.8.4-15.5.1 SUSE Linux Enterprise Module for Web and Scripting 12:npm6-6.11.1-11.5.1 SUSE OpenStack Cloud 7:nodejs-common-1.0-2.1 SUSE OpenStack Cloud 7:nodejs6-6.11.1-11.5.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172168-1/ https://www.suse.com/security/cve/CVE-2017-11499.html CVE-2017-11499 https://bugzilla.suse.com/1044849 SUSE Bug 1044849 https://bugzilla.suse.com/1048299 SUSE Bug 1048299 https://bugzilla.suse.com/1051117 SUSE Bug 1051117