Security update for nodejs14 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:0607-1 Final 1 1 2023-03-03T11:02:56Z current 2023-03-03T11:02:56Z 2023-03-03T11:02:56Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for nodejs14 This update for nodejs14 fixes the following issues: Update to 14.21.3: - CVE-2023-23918: Fixed permissions policies that could have been bypassed via process.mainModule (bsc#1208481). - CVE-2023-23920: Fixed insecure loading of ICU data through ICU_DATA environment (bsc#1208487). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-607,SUSE-SLE-Module-Web-Scripting-12-2023-607 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20230607-1/ Link for SUSE-SU-2023:0607-1 https://lists.suse.com/pipermail/sle-security-updates/2023-March/013972.html E-Mail link for SUSE-SU-2023:0607-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1208481 SUSE Bug 1208481 https://bugzilla.suse.com/1208487 SUSE Bug 1208487 https://www.suse.com/security/cve/CVE-2023-23918/ SUSE CVE CVE-2023-23918 page https://www.suse.com/security/cve/CVE-2023-23920/ SUSE CVE CVE-2023-23920 page SUSE Linux Enterprise Module for Web and Scripting 12 corepack14-14.21.3-6.40.1 nodejs14-14.21.3-6.40.1 nodejs14-devel-14.21.3-6.40.1 nodejs14-docs-14.21.3-6.40.1 npm14-14.21.3-6.40.1 nodejs14-14.21.3-6.40.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs14-devel-14.21.3-6.40.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs14-docs-14.21.3-6.40.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 npm14-14.21.3-6.40.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 A privilege escalation vulnerability exists in Node.js <19.6.1, <18.14.1, <16.19.1 and <14.21.3 that made it possible to bypass the experimental Permissions (https://nodejs.org/api/permissions.html) feature in Node.js and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy. CVE-2023-23918 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs14-14.21.3-6.40.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs14-devel-14.21.3-6.40.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs14-docs-14.21.3-6.40.1 SUSE Linux Enterprise Module for Web and Scripting 12:npm14-14.21.3-6.40.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230607-1/ https://www.suse.com/security/cve/CVE-2023-23918.html CVE-2023-23918 https://bugzilla.suse.com/1208481 SUSE Bug 1208481 An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges. CVE-2023-23920 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs14-14.21.3-6.40.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs14-devel-14.21.3-6.40.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs14-docs-14.21.3-6.40.1 SUSE Linux Enterprise Module for Web and Scripting 12:npm14-14.21.3-6.40.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230607-1/ https://www.suse.com/security/cve/CVE-2023-23920.html CVE-2023-23920 https://bugzilla.suse.com/1208487 SUSE Bug 1208487