[SUSE-SU-2021:0061-1] Security update for nodejs14
Severity
Moderate
CVEs
3
Security update for nodejs14
This update for nodejs14 fixes the following issues:
New upstream LTS version 14.15.4:
- CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits (bsc#1180553)
- CVE-2020-8287: HTTP Request Smuggling allow two copies of a header field in a http request. For example, two Transfer-Encoding header fields. In this case Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling (https://cwe.mitre.org/data/definitions/444.html). (bsc#1180554)
New upstream LTS version 14.15.3:
- deps:
- upgrade npm to 6.14.9
- update acorn to v8.0.4
- http2: check write not scheduled in scope destructor
- stream: fix regression on duplex end
New upstream LTS version 14.15.1:
- deps: Denial of Service through DNS request (High). A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service by getting the application to resolve a DNS record with a larger number of responses (bsc#1178882, CVE-2020-8277)
- ID
- SUSE-SU-2021:0061-1
- Severity
- moderate
- URL
- https://www.suse.com/support/update/announcement/2021/suse-su-20210061-1/
- Published
-
2021-01-11T14:01:32
(3 years ago) - Modified
-
2021-01-11T14:01:32
(3 years ago) - Rights
- Copyright 2024 SUSE LLC. All rights reserved.
- Other Advisories
-
- ALPINE:CVE-2020-8265
- ALPINE:CVE-2020-8277
- ALPINE:CVE-2020-8287
- ALSA-2020:5499
- ALSA-2021:0548
- ALSA-2021:0549
- ALSA-2021:0551
- ASA-202011-18
- ASA-202101-16
- DSA-4826-1
- ELSA-2020-5499
- ELSA-2021-0548
- ELSA-2021-0549
- ELSA-2021-0551
- FEDORA-2020-307e873389
- FEDORA-2020-7473744de1
- FEDORA-2021-afed2b904e
- FEDORA-2021-d5b2c18fe6
- FEDORA-2021-ee913722db
- FEDORA-2021-fb1a136393
- FREEBSD:08B553ED-537A-11EB-BE6E-0022489AD614
- FREEBSD:56BA4513-A1BE-11EB-9072-D4C9EF517024
- FREEBSD:AD792169-2AA4-11EB-AB71-0022489AD614
- GLSA-202012-11
- GLSA-202101-07
- MS:CVE-2020-8277
- openSUSE-SU-2020:2045-1
- openSUSE-SU-2020:2092-1
- openSUSE-SU-2021:0064-1
- openSUSE-SU-2021:0065-1
- openSUSE-SU-2021:0066-1
- openSUSE-SU-2021:0082-1
- openSUSE-SU-2021:0195-1
- RHSA-2020:5499
- RHSA-2021:0548
- RHSA-2021:0549
- RHSA-2021:0551
- RLSA-2020:5499
- RLSA-2021:0548
- RLSA-2021:0549
- RLSA-2021:0551
- SUSE-SU-2020:3478-1
- SUSE-SU-2020:3549-1
- SUSE-SU-2021:0060-1
- SUSE-SU-2021:0062-1
- SUSE-SU-2021:0068-1
- SUSE-SU-2021:0082-1
- SUSE-SU-2021:0107-1
- SUSE-SU-2021:0121-1
- SUSE-SU-2021:0224-1
- USN-4638-1
- USN-5563-1
- USN-6380-1
Source | # ID | Name | URL |
---|---|---|---|
Suse | SUSE ratings | https://www.suse.com/support/security/rating/ | |
Suse | URL of this CSAF notice | https://ftp.suse.com/pub/projects/security/csaf/suse-su-2021_0061-1.json | |
Suse | URL for SUSE-SU-2021:0061-1 | https://www.suse.com/support/update/announcement/2021/suse-su-20210061-1/ | |
Suse | E-Mail link for SUSE-SU-2021:0061-1 | https://lists.suse.com/pipermail/sle-security-updates/2021-January/008166.html | |
Bugzilla | SUSE Bug 1178882 | https://bugzilla.suse.com/1178882 | |
Bugzilla | SUSE Bug 1180553 | https://bugzilla.suse.com/1180553 | |
Bugzilla | SUSE Bug 1180554 | https://bugzilla.suse.com/1180554 | |
CVE | SUSE CVE CVE-2020-8265 page | https://www.suse.com/security/cve/CVE-2020-8265/ | |
CVE | SUSE CVE CVE-2020-8277 page | https://www.suse.com/security/cve/CVE-2020-8277/ | |
CVE | SUSE CVE CVE-2020-8287 page | https://www.suse.com/security/cve/CVE-2020-8287/ |
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |