[SUSE-SU-2021:0082-1] Security update for nodejs10
Severity
Moderate
CVEs
3
Security update for nodejs10
This update for nodejs10 fixes the following issues:
New upstream LTS version 10.23.1:
- CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits (bsc#1180553)
- CVE-2020-8287: HTTP Request Smuggling allow two copies of a header field in a http request. For example, two Transfer-Encoding header fields. In this case Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling (https://cwe.mitre.org/data/definitions/444.html). (bsc#1180554)
- CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference (High) This is a vulnerability in OpenSSL which may be exploited through Node.js. (bsc#1179491)
New upstream LTS version 10.23.0:
- deps: upgrade npm to 6.14.8
- n-api:
- create N-API version 7
- expose napi_build_version variable
- ID
- SUSE-SU-2021:0082-1
- Severity
- moderate
- URL
- https://www.suse.com/support/update/announcement/2021/suse-su-20210082-1/
- Published
-
2021-01-12T13:09:37
(3 years ago) - Modified
-
2021-01-12T13:09:37
(3 years ago) - Rights
- Copyright 2024 SUSE LLC. All rights reserved.
- Other Advisories
-
- ALAS-2020-1456
- ALAS2-2020-1573
- ALAS2-2024-2502
- ALPINE:CVE-2020-1971
- ALPINE:CVE-2020-8265
- ALPINE:CVE-2020-8287
- ALSA-2020:5476
- ALSA-2021:0548
- ALSA-2021:0549
- ALSA-2021:0551
- ASA-202012-24
- ASA-202101-16
- DSA-4807-1
- DSA-4826-1
- ELSA-2020-5476
- ELSA-2020-5566
- ELSA-2021-0548
- ELSA-2021-0549
- ELSA-2021-0551
- ELSA-2021-9121
- ELSA-2021-9137
- ELSA-2021-9150
- FEDORA-2020-a31b01e945
- FEDORA-2020-ef1870065a
- FEDORA-2021-d5b2c18fe6
- FEDORA-2021-fb1a136393
- FREEBSD:08B553ED-537A-11EB-BE6E-0022489AD614
- FREEBSD:1D56CFC5-3970-11EB-929D-D4C9EF517024
- FREEBSD:56BA4513-A1BE-11EB-9072-D4C9EF517024
- GLSA-202012-13
- GLSA-202101-07
- MS:CVE-2020-1971
- openSUSE-SU-2020:2223-1
- openSUSE-SU-2020:2236-1
- openSUSE-SU-2020:2245-1
- openSUSE-SU-2020:2269-1
- openSUSE-SU-2021:0064-1
- openSUSE-SU-2021:0065-1
- openSUSE-SU-2021:0066-1
- openSUSE-SU-2021:0082-1
- openSUSE-SU-2021:0195-1
- RHSA-2020:5476
- RHSA-2020:5566
- RHSA-2021:0548
- RHSA-2021:0549
- RHSA-2021:0551
- RLSA-2021:0548
- RLSA-2021:0549
- RLSA-2021:0551
- SECADV-20201208-1
- SUSE-SU-2020:3720-1
- SUSE-SU-2020:3721-1
- SUSE-SU-2020:3722-1
- SUSE-SU-2020:3732-1
- SUSE-SU-2020:3740-1
- SUSE-SU-2020:3762-1
- SUSE-SU-2020:3763-1
- SUSE-SU-2021:0060-1
- SUSE-SU-2021:0061-1
- SUSE-SU-2021:0062-1
- SUSE-SU-2021:0068-1
- SUSE-SU-2021:0107-1
- SUSE-SU-2021:0121-1
- SUSE-SU-2021:0224-1
- USN-4662-1
- USN-4745-1
- USN-5563-1
- USN-6380-1
Source | # ID | Name | URL |
---|---|---|---|
Suse | SUSE ratings | https://www.suse.com/support/security/rating/ | |
Suse | URL of this CSAF notice | https://ftp.suse.com/pub/projects/security/csaf/suse-su-2021_0082-1.json | |
Suse | URL for SUSE-SU-2021:0082-1 | https://www.suse.com/support/update/announcement/2021/suse-su-20210082-1/ | |
Suse | E-Mail link for SUSE-SU-2021:0082-1 | https://lists.suse.com/pipermail/sle-security-updates/2021-January/008175.html | |
Bugzilla | SUSE Bug 1179491 | https://bugzilla.suse.com/1179491 | |
Bugzilla | SUSE Bug 1180553 | https://bugzilla.suse.com/1180553 | |
Bugzilla | SUSE Bug 1180554 | https://bugzilla.suse.com/1180554 | |
CVE | SUSE CVE CVE-2020-1971 page | https://www.suse.com/security/cve/CVE-2020-1971/ | |
CVE | SUSE CVE CVE-2020-8265 page | https://www.suse.com/security/cve/CVE-2020-8265/ | |
CVE | SUSE CVE CVE-2020-8287 page | https://www.suse.com/security/cve/CVE-2020-8287/ |
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |