Security update for nodejs14 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:3306-1 Final 1 1 2023-08-14T08:19:17Z current 2023-08-14T08:19:17Z 2023-08-14T08:19:17Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for nodejs14 This update for nodejs14 fixes the following issues: - CVE-2023-32002: Fixed permissions policies bypass via Module._load (bsc#1214150). - CVE-2023-32006: Fixed permissions policies impersonation using module.constructor.createRequire() (bsc#1214156). - CVE-2023-32559: Fixed permissions policies bypass via process.binding (bsc#1214154). - CVE-2023-30581: Fixed mainModule.proto bypass (bsc#1212574). - CVE-2023-30590: Fixed missing DiffieHellman key generation (bsc#1212583). - CVE-2023-30589: Fixed HTTP Request Smuggling via Empty headers separated by CR (bsc#1212582). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-3306,SUSE-SLE-Module-Web-Scripting-12-2023-3306 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20233306-1/ Link for SUSE-SU-2023:3306-1 https://lists.suse.com/pipermail/sle-updates/2023-August/031001.html E-Mail link for SUSE-SU-2023:3306-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1212574 SUSE Bug 1212574 https://bugzilla.suse.com/1212582 SUSE Bug 1212582 https://bugzilla.suse.com/1212583 SUSE Bug 1212583 https://bugzilla.suse.com/1214150 SUSE Bug 1214150 https://bugzilla.suse.com/1214154 SUSE Bug 1214154 https://bugzilla.suse.com/1214156 SUSE Bug 1214156 https://www.suse.com/security/cve/CVE-2023-30581/ SUSE CVE CVE-2023-30581 page https://www.suse.com/security/cve/CVE-2023-30589/ SUSE CVE CVE-2023-30589 page https://www.suse.com/security/cve/CVE-2023-30590/ SUSE CVE CVE-2023-30590 page https://www.suse.com/security/cve/CVE-2023-32002/ SUSE CVE CVE-2023-32002 page https://www.suse.com/security/cve/CVE-2023-32006/ SUSE CVE CVE-2023-32006 page https://www.suse.com/security/cve/CVE-2023-32559/ SUSE CVE CVE-2023-32559 page SUSE Linux Enterprise Module for Web and Scripting 12 corepack14-14.21.3-6.46.1 nodejs14-14.21.3-6.46.1 nodejs14-devel-14.21.3-6.46.1 nodejs14-docs-14.21.3-6.46.1 npm14-14.21.3-6.46.1 nodejs14-14.21.3-6.46.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs14-devel-14.21.3-6.46.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 nodejs14-docs-14.21.3-6.46.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 npm14-14.21.3-6.46.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 12 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVE-2023-30581 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs14-14.21.3-6.46.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs14-devel-14.21.3-6.46.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs14-docs-14.21.3-6.46.1 SUSE Linux Enterprise Module for Web and Scripting 12:npm14-14.21.3-6.46.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233306-1/ https://www.suse.com/security/cve/CVE-2023-30581.html CVE-2023-30581 https://bugzilla.suse.com/1212574 SUSE Bug 1212574 The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20 CVE-2023-30589 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs14-14.21.3-6.46.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs14-devel-14.21.3-6.46.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs14-docs-14.21.3-6.46.1 SUSE Linux Enterprise Module for Web and Scripting 12:npm14-14.21.3-6.46.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233306-1/ https://www.suse.com/security/cve/CVE-2023-30589.html CVE-2023-30589 https://bugzilla.suse.com/1212582 SUSE Bug 1212582 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVE-2023-30590 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs14-14.21.3-6.46.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs14-devel-14.21.3-6.46.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs14-docs-14.21.3-6.46.1 SUSE Linux Enterprise Module for Web and Scripting 12:npm14-14.21.3-6.46.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233306-1/ https://www.suse.com/security/cve/CVE-2023-30590.html CVE-2023-30590 https://bugzilla.suse.com/1212583 SUSE Bug 1212583 The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js. CVE-2023-32002 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs14-14.21.3-6.46.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs14-devel-14.21.3-6.46.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs14-docs-14.21.3-6.46.1 SUSE Linux Enterprise Module for Web and Scripting 12:npm14-14.21.3-6.46.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233306-1/ https://www.suse.com/security/cve/CVE-2023-32002.html CVE-2023-32002 https://bugzilla.suse.com/1214150 SUSE Bug 1214150 The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js. CVE-2023-32006 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs14-14.21.3-6.46.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs14-devel-14.21.3-6.46.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs14-docs-14.21.3-6.46.1 SUSE Linux Enterprise Module for Web and Scripting 12:npm14-14.21.3-6.46.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233306-1/ https://www.suse.com/security/cve/CVE-2023-32006.html CVE-2023-32006 https://bugzilla.suse.com/1214156 SUSE Bug 1214156 A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js. CVE-2023-32559 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs14-14.21.3-6.46.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs14-devel-14.21.3-6.46.1 SUSE Linux Enterprise Module for Web and Scripting 12:nodejs14-docs-14.21.3-6.46.1 SUSE Linux Enterprise Module for Web and Scripting 12:npm14-14.21.3-6.46.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233306-1/ https://www.suse.com/security/cve/CVE-2023-32559.html CVE-2023-32559 https://bugzilla.suse.com/1214154 SUSE Bug 1214154