Security update for nodejs6 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:0247-1 Final 1 1 2020-01-28T10:56:07Z current 2020-01-28T10:56:07Z 2020-01-28T10:56:07Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for nodejs6 This update for nodejs6 to version 6.17.1 fixes the following issues: Security issues fixed: - CVE-2019-16777, CVE-2019-16776, CVE-2019-16775: Updated npm to 6.13.4, fixing an arbitrary path overwrite and access via 'bin' field (bsc#1159352). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-247,SUSE-OpenStack-Cloud-7-2020-247,SUSE-OpenStack-Cloud-Crowbar-8-2020-247,SUSE-OpenStack-Cloud-Crowbar-9-2020-247,SUSE-SLE-Module-Web-Scripting-12-2020-247 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20200247-1/ Link for SUSE-SU-2020:0247-1 https://lists.suse.com/pipermail/sle-security-updates/2020-January/006408.html E-Mail link for SUSE-SU-2020:0247-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1159352 SUSE Bug 1159352 https://www.suse.com/security/cve/CVE-2019-16775/ SUSE CVE CVE-2019-16775 page https://www.suse.com/security/cve/CVE-2019-16776/ SUSE CVE CVE-2019-16776 page https://www.suse.com/security/cve/CVE-2019-16777/ SUSE CVE CVE-2019-16777 page SUSE Linux Enterprise Module for Web and Scripting 12 SUSE OpenStack Cloud 7 SUSE OpenStack Cloud Crowbar 8 SUSE OpenStack Cloud Crowbar 9 nodejs6-6.17.1-11.30.1 nodejs6-devel-6.17.1-11.30.1 nodejs6-docs-6.17.1-11.30.1 npm6-6.17.1-11.30.1 nodejs6-6.17.1-11.30.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs6-devel-6.17.1-11.30.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs6-docs-6.17.1-11.30.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 npm6-6.17.1-11.30.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs6-6.17.1-11.30.1 as a component of SUSE OpenStack Cloud 7 nodejs6-6.17.1-11.30.1 as a component of SUSE OpenStack Cloud Crowbar 8 nodejs6-6.17.1-11.30.1 as a component of SUSE OpenStack Cloud Crowbar 9 Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option. CVE-2019-16775 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs6-6.17.1-11.30.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs6-devel-6.17.1-11.30.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs6-docs-6.17.1-11.30.1 SUSE Linux Enterprise Module for Web and Scripting 12:npm6-6.17.1-11.30.1 SUSE OpenStack Cloud 7:nodejs6-6.17.1-11.30.1 SUSE OpenStack Cloud Crowbar 8:nodejs6-6.17.1-11.30.1 SUSE OpenStack Cloud Crowbar 9:nodejs6-6.17.1-11.30.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200247-1/ https://www.suse.com/security/cve/CVE-2019-16775.html CVE-2019-16775 https://bugzilla.suse.com/1159352 SUSE Bug 1159352 Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option. CVE-2019-16776 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs6-6.17.1-11.30.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs6-devel-6.17.1-11.30.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs6-docs-6.17.1-11.30.1 SUSE Linux Enterprise Module for Web and Scripting 12:npm6-6.17.1-11.30.1 SUSE OpenStack Cloud 7:nodejs6-6.17.1-11.30.1 SUSE OpenStack Cloud Crowbar 8:nodejs6-6.17.1-11.30.1 SUSE OpenStack Cloud Crowbar 9:nodejs6-6.17.1-11.30.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200247-1/ https://www.suse.com/security/cve/CVE-2019-16776.html CVE-2019-16776 https://bugzilla.suse.com/1159352 SUSE Bug 1159352 Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option. CVE-2019-16777 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs6-6.17.1-11.30.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs6-devel-6.17.1-11.30.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs6-docs-6.17.1-11.30.1 SUSE Linux Enterprise Module for Web and Scripting 12:npm6-6.17.1-11.30.1 SUSE OpenStack Cloud 7:nodejs6-6.17.1-11.30.1 SUSE OpenStack Cloud Crowbar 8:nodejs6-6.17.1-11.30.1 SUSE OpenStack Cloud Crowbar 9:nodejs6-6.17.1-11.30.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200247-1/ https://www.suse.com/security/cve/CVE-2019-16777.html CVE-2019-16777 https://bugzilla.suse.com/1159352 SUSE Bug 1159352