Security update for nodejs8 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:0454-1 Final 1 1 2020-02-25T09:55:38Z current 2020-02-25T09:55:38Z 2020-02-25T09:55:38Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for nodejs8 This update for nodejs8 fixes the following issues: Security issues fixed: - CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104). - CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102). - CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-454,SUSE-SLE-Module-Web-Scripting-15-2020-454,SUSE-SLE-Module-Web-Scripting-15-SP1-2020-454,SUSE-SLE-Product-HPC-15-2020-454,SUSE-SLE-Product-SLES-15-2020-454,SUSE-SLE-Product-SLES_SAP-15-2020-454 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20200454-1/ Link for SUSE-SU-2020:0454-1 https://lists.suse.com/pipermail/sle-security-updates/2020-February/006527.html E-Mail link for SUSE-SU-2020:0454-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1163102 SUSE Bug 1163102 https://bugzilla.suse.com/1163103 SUSE Bug 1163103 https://bugzilla.suse.com/1163104 SUSE Bug 1163104 https://www.suse.com/security/cve/CVE-2019-15604/ SUSE CVE CVE-2019-15604 page https://www.suse.com/security/cve/CVE-2019-15605/ SUSE CVE CVE-2019-15605 page https://www.suse.com/security/cve/CVE-2019-15606/ SUSE CVE CVE-2019-15606 page SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise Module for Web and Scripting 15 SUSE Linux Enterprise Module for Web and Scripting 15 SP1 SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server for SAP Applications 15 nodejs8-8.17.0-3.28.1 nodejs8-devel-8.17.0-3.28.1 nodejs8-docs-8.17.0-3.28.1 npm8-8.17.0-3.28.1 nodejs8-8.17.0-3.28.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS nodejs8-devel-8.17.0-3.28.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS nodejs8-docs-8.17.0-3.28.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS npm8-8.17.0-3.28.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS nodejs8-8.17.0-3.28.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS nodejs8-devel-8.17.0-3.28.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS nodejs8-docs-8.17.0-3.28.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS npm8-8.17.0-3.28.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS nodejs8-8.17.0-3.28.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 nodejs8-devel-8.17.0-3.28.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 nodejs8-docs-8.17.0-3.28.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 npm8-8.17.0-3.28.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 nodejs8-8.17.0-3.28.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP1 nodejs8-devel-8.17.0-3.28.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP1 nodejs8-docs-8.17.0-3.28.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP1 npm8-8.17.0-3.28.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP1 nodejs8-8.17.0-3.28.1 as a component of SUSE Linux Enterprise Server 15-LTSS nodejs8-devel-8.17.0-3.28.1 as a component of SUSE Linux Enterprise Server 15-LTSS nodejs8-docs-8.17.0-3.28.1 as a component of SUSE Linux Enterprise Server 15-LTSS npm8-8.17.0-3.28.1 as a component of SUSE Linux Enterprise Server 15-LTSS nodejs8-8.17.0-3.28.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 nodejs8-devel-8.17.0-3.28.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 nodejs8-docs-8.17.0-3.28.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 npm8-8.17.0-3.28.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate CVE-2019-15604 SUSE Linux Enterprise High Performance Computing 15-ESPOS:nodejs8-8.17.0-3.28.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:nodejs8-devel-8.17.0-3.28.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:nodejs8-docs-8.17.0-3.28.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:npm8-8.17.0-3.28.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:nodejs8-8.17.0-3.28.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:nodejs8-devel-8.17.0-3.28.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:nodejs8-docs-8.17.0-3.28.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:npm8-8.17.0-3.28.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP1:nodejs8-8.17.0-3.28.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP1:nodejs8-devel-8.17.0-3.28.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP1:nodejs8-docs-8.17.0-3.28.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP1:npm8-8.17.0-3.28.1 SUSE Linux Enterprise Module for Web and Scripting 15:nodejs8-8.17.0-3.28.1 SUSE Linux Enterprise Module for Web and Scripting 15:nodejs8-devel-8.17.0-3.28.1 SUSE Linux Enterprise Module for Web and Scripting 15:nodejs8-docs-8.17.0-3.28.1 SUSE Linux Enterprise Module for Web and Scripting 15:npm8-8.17.0-3.28.1 SUSE Linux Enterprise Server 15-LTSS:nodejs8-8.17.0-3.28.1 SUSE Linux Enterprise Server 15-LTSS:nodejs8-devel-8.17.0-3.28.1 SUSE Linux Enterprise Server 15-LTSS:nodejs8-docs-8.17.0-3.28.1 SUSE Linux Enterprise Server 15-LTSS:npm8-8.17.0-3.28.1 SUSE Linux Enterprise Server for SAP Applications 15:nodejs8-8.17.0-3.28.1 SUSE Linux Enterprise Server for SAP Applications 15:nodejs8-devel-8.17.0-3.28.1 SUSE Linux Enterprise Server for SAP Applications 15:nodejs8-docs-8.17.0-3.28.1 SUSE Linux Enterprise Server for SAP Applications 15:npm8-8.17.0-3.28.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200454-1/ https://www.suse.com/security/cve/CVE-2019-15604.html CVE-2019-15604 https://bugzilla.suse.com/1163104 SUSE Bug 1163104 HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed CVE-2019-15605 SUSE Linux Enterprise High Performance Computing 15-ESPOS:nodejs8-8.17.0-3.28.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:nodejs8-devel-8.17.0-3.28.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:nodejs8-docs-8.17.0-3.28.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:npm8-8.17.0-3.28.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:nodejs8-8.17.0-3.28.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:nodejs8-devel-8.17.0-3.28.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:nodejs8-docs-8.17.0-3.28.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:npm8-8.17.0-3.28.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP1:nodejs8-8.17.0-3.28.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP1:nodejs8-devel-8.17.0-3.28.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP1:nodejs8-docs-8.17.0-3.28.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP1:npm8-8.17.0-3.28.1 SUSE Linux Enterprise Module for Web and Scripting 15:nodejs8-8.17.0-3.28.1 SUSE Linux Enterprise Module for Web and Scripting 15:nodejs8-devel-8.17.0-3.28.1 SUSE Linux Enterprise Module for Web and Scripting 15:nodejs8-docs-8.17.0-3.28.1 SUSE Linux Enterprise Module for Web and Scripting 15:npm8-8.17.0-3.28.1 SUSE Linux Enterprise Server 15-LTSS:nodejs8-8.17.0-3.28.1 SUSE Linux Enterprise Server 15-LTSS:nodejs8-devel-8.17.0-3.28.1 SUSE Linux Enterprise Server 15-LTSS:nodejs8-docs-8.17.0-3.28.1 SUSE Linux Enterprise Server 15-LTSS:npm8-8.17.0-3.28.1 SUSE Linux Enterprise Server for SAP Applications 15:nodejs8-8.17.0-3.28.1 SUSE Linux Enterprise Server for SAP Applications 15:nodejs8-devel-8.17.0-3.28.1 SUSE Linux Enterprise Server for SAP Applications 15:nodejs8-docs-8.17.0-3.28.1 SUSE Linux Enterprise Server for SAP Applications 15:npm8-8.17.0-3.28.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200454-1/ https://www.suse.com/security/cve/CVE-2019-15605.html CVE-2019-15605 https://bugzilla.suse.com/1163102 SUSE Bug 1163102 Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons CVE-2019-15606 SUSE Linux Enterprise High Performance Computing 15-ESPOS:nodejs8-8.17.0-3.28.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:nodejs8-devel-8.17.0-3.28.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:nodejs8-docs-8.17.0-3.28.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:npm8-8.17.0-3.28.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:nodejs8-8.17.0-3.28.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:nodejs8-devel-8.17.0-3.28.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:nodejs8-docs-8.17.0-3.28.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:npm8-8.17.0-3.28.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP1:nodejs8-8.17.0-3.28.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP1:nodejs8-devel-8.17.0-3.28.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP1:nodejs8-docs-8.17.0-3.28.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP1:npm8-8.17.0-3.28.1 SUSE Linux Enterprise Module for Web and Scripting 15:nodejs8-8.17.0-3.28.1 SUSE Linux Enterprise Module for Web and Scripting 15:nodejs8-devel-8.17.0-3.28.1 SUSE Linux Enterprise Module for Web and Scripting 15:nodejs8-docs-8.17.0-3.28.1 SUSE Linux Enterprise Module for Web and Scripting 15:npm8-8.17.0-3.28.1 SUSE Linux Enterprise Server 15-LTSS:nodejs8-8.17.0-3.28.1 SUSE Linux Enterprise Server 15-LTSS:nodejs8-devel-8.17.0-3.28.1 SUSE Linux Enterprise Server 15-LTSS:nodejs8-docs-8.17.0-3.28.1 SUSE Linux Enterprise Server 15-LTSS:npm8-8.17.0-3.28.1 SUSE Linux Enterprise Server for SAP Applications 15:nodejs8-8.17.0-3.28.1 SUSE Linux Enterprise Server for SAP Applications 15:nodejs8-devel-8.17.0-3.28.1 SUSE Linux Enterprise Server for SAP Applications 15:nodejs8-docs-8.17.0-3.28.1 SUSE Linux Enterprise Server for SAP Applications 15:npm8-8.17.0-3.28.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200454-1/ https://www.suse.com/security/cve/CVE-2019-15606.html CVE-2019-15606 https://bugzilla.suse.com/1163103 SUSE Bug 1163103