Security update for nodejs14 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:3408-1 Final 1 1 2023-08-23T18:11:57Z current 2023-08-23T18:11:57Z 2023-08-23T18:11:57Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for nodejs14 This update for nodejs14 fixes the following issues: - CVE-2023-32002: Fixed permissions policies bypass via Module._load (bsc#1214150). - CVE-2023-32006: Fixed permissions policies impersonation using module.constructor.createRequire() (bsc#1214156). - CVE-2023-32559: Fixed permissions policies bypass via process.binding (bsc#1214154). - CVE-2023-30581: Fixed mainModule.proto bypass (bsc#1212574). - CVE-2023-30590: Fixed missing DiffieHellman key generation (bsc#1212583). - CVE-2023-30589: Fixed HTTP Request Smuggling via Empty headers separated by CR (bsc#1212582). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-3408,SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-3408,SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-3408,SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-3408,SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-3408,SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-3408,SUSE-SLE-Product-SLES_SAP-15-SP2-2023-3408,SUSE-SLE-Product-SLES_SAP-15-SP3-2023-3408,SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-3408,SUSE-Storage-7.1-2023-3408,openSUSE-SLE-15.4-2023-3408 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20233408-1/ Link for SUSE-SU-2023:3408-1 https://lists.suse.com/pipermail/sle-security-updates/2023-August/016002.html E-Mail link for SUSE-SU-2023:3408-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1212574 SUSE Bug 1212574 https://bugzilla.suse.com/1212582 SUSE Bug 1212582 https://bugzilla.suse.com/1212583 SUSE Bug 1212583 https://bugzilla.suse.com/1214150 SUSE Bug 1214150 https://bugzilla.suse.com/1214154 SUSE Bug 1214154 https://bugzilla.suse.com/1214156 SUSE Bug 1214156 https://www.suse.com/security/cve/CVE-2023-30581/ SUSE CVE CVE-2023-30581 page https://www.suse.com/security/cve/CVE-2023-30589/ SUSE CVE CVE-2023-30589 page https://www.suse.com/security/cve/CVE-2023-30590/ SUSE CVE CVE-2023-30590 page https://www.suse.com/security/cve/CVE-2023-32002/ SUSE CVE CVE-2023-32002 page https://www.suse.com/security/cve/CVE-2023-32006/ SUSE CVE CVE-2023-32006 page https://www.suse.com/security/cve/CVE-2023-32559/ SUSE CVE CVE-2023-32559 page SUSE Enterprise Storage 7.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Manager Server 4.2 openSUSE Leap 15.4 corepack14-14.21.3-150200.15.49.1 nodejs14-14.21.3-150200.15.49.1 nodejs14-devel-14.21.3-150200.15.49.1 nodejs14-docs-14.21.3-150200.15.49.1 npm14-14.21.3-150200.15.49.1 nodejs14-14.21.3-150200.15.49.1 as a component of SUSE Enterprise Storage 7.1 nodejs14-devel-14.21.3-150200.15.49.1 as a component of SUSE Enterprise Storage 7.1 nodejs14-docs-14.21.3-150200.15.49.1 as a component of SUSE Enterprise Storage 7.1 npm14-14.21.3-150200.15.49.1 as a component of SUSE Enterprise Storage 7.1 nodejs14-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS nodejs14-devel-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS nodejs14-docs-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS npm14-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS nodejs14-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS nodejs14-devel-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS nodejs14-docs-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS npm14-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS nodejs14-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS nodejs14-devel-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS nodejs14-docs-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS npm14-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS nodejs14-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS nodejs14-devel-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS nodejs14-docs-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS npm14-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS nodejs14-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS nodejs14-devel-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS nodejs14-docs-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS npm14-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS nodejs14-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 nodejs14-devel-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 nodejs14-docs-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 npm14-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 nodejs14-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 nodejs14-devel-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 nodejs14-docs-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 npm14-14.21.3-150200.15.49.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 nodejs14-14.21.3-150200.15.49.1 as a component of SUSE Manager Server 4.2 nodejs14-devel-14.21.3-150200.15.49.1 as a component of SUSE Manager Server 4.2 nodejs14-docs-14.21.3-150200.15.49.1 as a component of SUSE Manager Server 4.2 npm14-14.21.3-150200.15.49.1 as a component of SUSE Manager Server 4.2 corepack14-14.21.3-150200.15.49.1 as a component of openSUSE Leap 15.4 nodejs14-14.21.3-150200.15.49.1 as a component of openSUSE Leap 15.4 nodejs14-devel-14.21.3-150200.15.49.1 as a component of openSUSE Leap 15.4 nodejs14-docs-14.21.3-150200.15.49.1 as a component of openSUSE Leap 15.4 npm14-14.21.3-150200.15.49.1 as a component of openSUSE Leap 15.4 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVE-2023-30581 SUSE Enterprise Storage 7.1:nodejs14-14.21.3-150200.15.49.1 SUSE Enterprise Storage 7.1:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Enterprise Storage 7.1:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Enterprise Storage 7.1:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP2-LTSS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP2-LTSS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP2-LTSS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP2-LTSS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP3-LTSS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP3-LTSS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP3-LTSS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP3-LTSS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:npm14-14.21.3-150200.15.49.1 SUSE Manager Server 4.2:nodejs14-14.21.3-150200.15.49.1 SUSE Manager Server 4.2:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Manager Server 4.2:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Manager Server 4.2:npm14-14.21.3-150200.15.49.1 openSUSE Leap 15.4:corepack14-14.21.3-150200.15.49.1 openSUSE Leap 15.4:nodejs14-14.21.3-150200.15.49.1 openSUSE Leap 15.4:nodejs14-devel-14.21.3-150200.15.49.1 openSUSE Leap 15.4:nodejs14-docs-14.21.3-150200.15.49.1 openSUSE Leap 15.4:npm14-14.21.3-150200.15.49.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233408-1/ https://www.suse.com/security/cve/CVE-2023-30581.html CVE-2023-30581 https://bugzilla.suse.com/1212574 SUSE Bug 1212574 The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20 CVE-2023-30589 SUSE Enterprise Storage 7.1:nodejs14-14.21.3-150200.15.49.1 SUSE Enterprise Storage 7.1:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Enterprise Storage 7.1:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Enterprise Storage 7.1:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP2-LTSS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP2-LTSS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP2-LTSS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP2-LTSS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP3-LTSS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP3-LTSS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP3-LTSS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP3-LTSS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:npm14-14.21.3-150200.15.49.1 SUSE Manager Server 4.2:nodejs14-14.21.3-150200.15.49.1 SUSE Manager Server 4.2:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Manager Server 4.2:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Manager Server 4.2:npm14-14.21.3-150200.15.49.1 openSUSE Leap 15.4:corepack14-14.21.3-150200.15.49.1 openSUSE Leap 15.4:nodejs14-14.21.3-150200.15.49.1 openSUSE Leap 15.4:nodejs14-devel-14.21.3-150200.15.49.1 openSUSE Leap 15.4:nodejs14-docs-14.21.3-150200.15.49.1 openSUSE Leap 15.4:npm14-14.21.3-150200.15.49.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233408-1/ https://www.suse.com/security/cve/CVE-2023-30589.html CVE-2023-30589 https://bugzilla.suse.com/1212582 SUSE Bug 1212582 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVE-2023-30590 SUSE Enterprise Storage 7.1:nodejs14-14.21.3-150200.15.49.1 SUSE Enterprise Storage 7.1:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Enterprise Storage 7.1:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Enterprise Storage 7.1:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP2-LTSS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP2-LTSS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP2-LTSS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP2-LTSS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP3-LTSS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP3-LTSS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP3-LTSS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP3-LTSS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:npm14-14.21.3-150200.15.49.1 SUSE Manager Server 4.2:nodejs14-14.21.3-150200.15.49.1 SUSE Manager Server 4.2:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Manager Server 4.2:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Manager Server 4.2:npm14-14.21.3-150200.15.49.1 openSUSE Leap 15.4:corepack14-14.21.3-150200.15.49.1 openSUSE Leap 15.4:nodejs14-14.21.3-150200.15.49.1 openSUSE Leap 15.4:nodejs14-devel-14.21.3-150200.15.49.1 openSUSE Leap 15.4:nodejs14-docs-14.21.3-150200.15.49.1 openSUSE Leap 15.4:npm14-14.21.3-150200.15.49.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233408-1/ https://www.suse.com/security/cve/CVE-2023-30590.html CVE-2023-30590 https://bugzilla.suse.com/1212583 SUSE Bug 1212583 The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js. CVE-2023-32002 SUSE Enterprise Storage 7.1:nodejs14-14.21.3-150200.15.49.1 SUSE Enterprise Storage 7.1:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Enterprise Storage 7.1:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Enterprise Storage 7.1:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP2-LTSS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP2-LTSS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP2-LTSS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP2-LTSS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP3-LTSS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP3-LTSS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP3-LTSS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP3-LTSS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:npm14-14.21.3-150200.15.49.1 SUSE Manager Server 4.2:nodejs14-14.21.3-150200.15.49.1 SUSE Manager Server 4.2:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Manager Server 4.2:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Manager Server 4.2:npm14-14.21.3-150200.15.49.1 openSUSE Leap 15.4:corepack14-14.21.3-150200.15.49.1 openSUSE Leap 15.4:nodejs14-14.21.3-150200.15.49.1 openSUSE Leap 15.4:nodejs14-devel-14.21.3-150200.15.49.1 openSUSE Leap 15.4:nodejs14-docs-14.21.3-150200.15.49.1 openSUSE Leap 15.4:npm14-14.21.3-150200.15.49.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233408-1/ https://www.suse.com/security/cve/CVE-2023-32002.html CVE-2023-32002 https://bugzilla.suse.com/1214150 SUSE Bug 1214150 The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js. CVE-2023-32006 SUSE Enterprise Storage 7.1:nodejs14-14.21.3-150200.15.49.1 SUSE Enterprise Storage 7.1:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Enterprise Storage 7.1:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Enterprise Storage 7.1:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP2-LTSS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP2-LTSS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP2-LTSS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP2-LTSS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP3-LTSS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP3-LTSS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP3-LTSS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP3-LTSS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:npm14-14.21.3-150200.15.49.1 SUSE Manager Server 4.2:nodejs14-14.21.3-150200.15.49.1 SUSE Manager Server 4.2:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Manager Server 4.2:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Manager Server 4.2:npm14-14.21.3-150200.15.49.1 openSUSE Leap 15.4:corepack14-14.21.3-150200.15.49.1 openSUSE Leap 15.4:nodejs14-14.21.3-150200.15.49.1 openSUSE Leap 15.4:nodejs14-devel-14.21.3-150200.15.49.1 openSUSE Leap 15.4:nodejs14-docs-14.21.3-150200.15.49.1 openSUSE Leap 15.4:npm14-14.21.3-150200.15.49.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233408-1/ https://www.suse.com/security/cve/CVE-2023-32006.html CVE-2023-32006 https://bugzilla.suse.com/1214156 SUSE Bug 1214156 A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js. CVE-2023-32559 SUSE Enterprise Storage 7.1:nodejs14-14.21.3-150200.15.49.1 SUSE Enterprise Storage 7.1:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Enterprise Storage 7.1:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Enterprise Storage 7.1:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP2-LTSS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP2-LTSS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP2-LTSS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP2-LTSS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP3-LTSS:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP3-LTSS:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP3-LTSS:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server 15 SP3-LTSS:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:npm14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:nodejs14-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:npm14-14.21.3-150200.15.49.1 SUSE Manager Server 4.2:nodejs14-14.21.3-150200.15.49.1 SUSE Manager Server 4.2:nodejs14-devel-14.21.3-150200.15.49.1 SUSE Manager Server 4.2:nodejs14-docs-14.21.3-150200.15.49.1 SUSE Manager Server 4.2:npm14-14.21.3-150200.15.49.1 openSUSE Leap 15.4:corepack14-14.21.3-150200.15.49.1 openSUSE Leap 15.4:nodejs14-14.21.3-150200.15.49.1 openSUSE Leap 15.4:nodejs14-devel-14.21.3-150200.15.49.1 openSUSE Leap 15.4:nodejs14-docs-14.21.3-150200.15.49.1 openSUSE Leap 15.4:npm14-14.21.3-150200.15.49.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20233408-1/ https://www.suse.com/security/cve/CVE-2023-32559.html CVE-2023-32559 https://bugzilla.suse.com/1214154 SUSE Bug 1214154