Security update for nodejs16 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:3400-1 Final 1 1 2023-08-23T17:01:05Z current 2023-08-23T17:01:05Z 2023-08-23T17:01:05Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for nodejs16 This update for nodejs16 fixes the following issues: Update to LTS version 16.20.2. - CVE-2023-32002: Fixed permissions policies bypass via Module._load (bsc#1214150). - CVE-2023-32006: Fixed permissions policies impersonation using module.constructor.createRequire() (bsc#1214156). - CVE-2023-32559: Fixed permissions policies bypass via process.binding (bsc#1214154). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-3400,SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-3400,SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-3400,SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-3400,SUSE-SLE-Product-SLES_SAP-15-SP3-2023-3400,SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-3400,SUSE-Storage-7.1-2023-3400 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20233400-1/ Link for SUSE-SU-2023:3400-1 https://lists.suse.com/pipermail/sle-updates/2023-August/031147.html E-Mail link for SUSE-SU-2023:3400-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1214150 SUSE Bug 1214150 https://bugzilla.suse.com/1214154 SUSE Bug 1214154 https://bugzilla.suse.com/1214156 SUSE Bug 1214156 https://www.suse.com/security/cve/CVE-2023-32002/ SUSE CVE CVE-2023-32002 page https://www.suse.com/security/cve/CVE-2023-32006/ SUSE CVE CVE-2023-32006 page https://www.suse.com/security/cve/CVE-2023-32559/ SUSE CVE CVE-2023-32559 page SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Manager Server 4.2 corepack16-16.20.2-150300.7.27.2 nodejs16-16.20.2-150300.7.27.2 nodejs16-devel-16.20.2-150300.7.27.2 nodejs16-docs-16.20.2-150300.7.27.2 npm16-16.20.2-150300.7.27.2 nodejs16-16.20.2-150300.7.27.2 as a component of SUSE Enterprise Storage 7.1 nodejs16-devel-16.20.2-150300.7.27.2 as a component of SUSE Enterprise Storage 7.1 nodejs16-docs-16.20.2-150300.7.27.2 as a component of SUSE Enterprise Storage 7.1 npm16-16.20.2-150300.7.27.2 as a component of SUSE Enterprise Storage 7.1 nodejs16-16.20.2-150300.7.27.2 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS nodejs16-devel-16.20.2-150300.7.27.2 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS nodejs16-docs-16.20.2-150300.7.27.2 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS npm16-16.20.2-150300.7.27.2 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS nodejs16-16.20.2-150300.7.27.2 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS nodejs16-devel-16.20.2-150300.7.27.2 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS nodejs16-docs-16.20.2-150300.7.27.2 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS npm16-16.20.2-150300.7.27.2 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS nodejs16-16.20.2-150300.7.27.2 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS nodejs16-devel-16.20.2-150300.7.27.2 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS nodejs16-docs-16.20.2-150300.7.27.2 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS npm16-16.20.2-150300.7.27.2 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS nodejs16-16.20.2-150300.7.27.2 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 nodejs16-devel-16.20.2-150300.7.27.2 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 nodejs16-docs-16.20.2-150300.7.27.2 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 npm16-16.20.2-150300.7.27.2 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 nodejs16-16.20.2-150300.7.27.2 as a component of SUSE Manager Server 4.2 nodejs16-devel-16.20.2-150300.7.27.2 as a component of SUSE Manager Server 4.2 nodejs16-docs-16.20.2-150300.7.27.2 as a component of SUSE Manager Server 4.2 npm16-16.20.2-150300.7.27.2 as a component of SUSE Manager Server 4.2 The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js. CVE-2023-32002 SUSE Enterprise Storage 7.1:nodejs16-16.20.2-150300.7.27.2 SUSE Enterprise Storage 7.1:nodejs16-devel-16.20.2-150300.7.27.2 SUSE Enterprise Storage 7.1:nodejs16-docs-16.20.2-150300.7.27.2 SUSE Enterprise Storage 7.1:npm16-16.20.2-150300.7.27.2 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:nodejs16-16.20.2-150300.7.27.2 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:nodejs16-devel-16.20.2-150300.7.27.2 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:nodejs16-docs-16.20.2-150300.7.27.2 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:npm16-16.20.2-150300.7.27.2 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:nodejs16-16.20.2-150300.7.27.2 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:nodejs16-devel-16.20.2-150300.7.27.2 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:nodejs16-docs-16.20.2-150300.7.27.2 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:npm16-16.20.2-150300.7.27.2 SUSE Linux Enterprise Server 15 SP3-LTSS:nodejs16-16.20.2-150300.7.27.2 SUSE Linux Enterprise Server 15 SP3-LTSS:nodejs16-devel-16.20.2-150300.7.27.2 SUSE Linux Enterprise Server 15 SP3-LTSS:nodejs16-docs-16.20.2-150300.7.27.2 SUSE Linux Enterprise Server 15 SP3-LTSS:npm16-16.20.2-150300.7.27.2 SUSE Linux Enterprise Server for SAP Applications 15 SP3:nodejs16-16.20.2-150300.7.27.2 SUSE Linux Enterprise Server for SAP Applications 15 SP3:nodejs16-devel-16.20.2-150300.7.27.2 SUSE Linux Enterprise Server for SAP Applications 15 SP3:nodejs16-docs-16.20.2-150300.7.27.2 SUSE Linux Enterprise Server for SAP Applications 15 SP3:npm16-16.20.2-150300.7.27.2 SUSE Manager Server 4.2:nodejs16-16.20.2-150300.7.27.2 SUSE Manager Server 4.2:nodejs16-devel-16.20.2-150300.7.27.2 SUSE Manager Server 4.2:nodejs16-docs-16.20.2-150300.7.27.2 SUSE Manager Server 4.2:npm16-16.20.2-150300.7.27.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233400-1/ https://www.suse.com/security/cve/CVE-2023-32002.html CVE-2023-32002 https://bugzilla.suse.com/1214150 SUSE Bug 1214150 The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js. CVE-2023-32006 SUSE Enterprise Storage 7.1:nodejs16-16.20.2-150300.7.27.2 SUSE Enterprise Storage 7.1:nodejs16-devel-16.20.2-150300.7.27.2 SUSE Enterprise Storage 7.1:nodejs16-docs-16.20.2-150300.7.27.2 SUSE Enterprise Storage 7.1:npm16-16.20.2-150300.7.27.2 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:nodejs16-16.20.2-150300.7.27.2 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:nodejs16-devel-16.20.2-150300.7.27.2 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:nodejs16-docs-16.20.2-150300.7.27.2 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:npm16-16.20.2-150300.7.27.2 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:nodejs16-16.20.2-150300.7.27.2 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:nodejs16-devel-16.20.2-150300.7.27.2 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:nodejs16-docs-16.20.2-150300.7.27.2 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:npm16-16.20.2-150300.7.27.2 SUSE Linux Enterprise Server 15 SP3-LTSS:nodejs16-16.20.2-150300.7.27.2 SUSE Linux Enterprise Server 15 SP3-LTSS:nodejs16-devel-16.20.2-150300.7.27.2 SUSE Linux Enterprise Server 15 SP3-LTSS:nodejs16-docs-16.20.2-150300.7.27.2 SUSE Linux Enterprise Server 15 SP3-LTSS:npm16-16.20.2-150300.7.27.2 SUSE Linux Enterprise Server for SAP Applications 15 SP3:nodejs16-16.20.2-150300.7.27.2 SUSE Linux Enterprise Server for SAP Applications 15 SP3:nodejs16-devel-16.20.2-150300.7.27.2 SUSE Linux Enterprise Server for SAP Applications 15 SP3:nodejs16-docs-16.20.2-150300.7.27.2 SUSE Linux Enterprise Server for SAP Applications 15 SP3:npm16-16.20.2-150300.7.27.2 SUSE Manager Server 4.2:nodejs16-16.20.2-150300.7.27.2 SUSE Manager Server 4.2:nodejs16-devel-16.20.2-150300.7.27.2 SUSE Manager Server 4.2:nodejs16-docs-16.20.2-150300.7.27.2 SUSE Manager Server 4.2:npm16-16.20.2-150300.7.27.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233400-1/ https://www.suse.com/security/cve/CVE-2023-32006.html CVE-2023-32006 https://bugzilla.suse.com/1214156 SUSE Bug 1214156 A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js. CVE-2023-32559 SUSE Enterprise Storage 7.1:nodejs16-16.20.2-150300.7.27.2 SUSE Enterprise Storage 7.1:nodejs16-devel-16.20.2-150300.7.27.2 SUSE Enterprise Storage 7.1:nodejs16-docs-16.20.2-150300.7.27.2 SUSE Enterprise Storage 7.1:npm16-16.20.2-150300.7.27.2 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:nodejs16-16.20.2-150300.7.27.2 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:nodejs16-devel-16.20.2-150300.7.27.2 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:nodejs16-docs-16.20.2-150300.7.27.2 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:npm16-16.20.2-150300.7.27.2 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:nodejs16-16.20.2-150300.7.27.2 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:nodejs16-devel-16.20.2-150300.7.27.2 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:nodejs16-docs-16.20.2-150300.7.27.2 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:npm16-16.20.2-150300.7.27.2 SUSE Linux Enterprise Server 15 SP3-LTSS:nodejs16-16.20.2-150300.7.27.2 SUSE Linux Enterprise Server 15 SP3-LTSS:nodejs16-devel-16.20.2-150300.7.27.2 SUSE Linux Enterprise Server 15 SP3-LTSS:nodejs16-docs-16.20.2-150300.7.27.2 SUSE Linux Enterprise Server 15 SP3-LTSS:npm16-16.20.2-150300.7.27.2 SUSE Linux Enterprise Server for SAP Applications 15 SP3:nodejs16-16.20.2-150300.7.27.2 SUSE Linux Enterprise Server for SAP Applications 15 SP3:nodejs16-devel-16.20.2-150300.7.27.2 SUSE Linux Enterprise Server for SAP Applications 15 SP3:nodejs16-docs-16.20.2-150300.7.27.2 SUSE Linux Enterprise Server for SAP Applications 15 SP3:npm16-16.20.2-150300.7.27.2 SUSE Manager Server 4.2:nodejs16-16.20.2-150300.7.27.2 SUSE Manager Server 4.2:nodejs16-devel-16.20.2-150300.7.27.2 SUSE Manager Server 4.2:nodejs16-docs-16.20.2-150300.7.27.2 SUSE Manager Server 4.2:npm16-16.20.2-150300.7.27.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233400-1/ https://www.suse.com/security/cve/CVE-2023-32559.html CVE-2023-32559 https://bugzilla.suse.com/1214154 SUSE Bug 1214154