{"affected":[{"ecosystem_specific":{"binaries":[{"nodejs20":"20.11.1-150500.11.6.1","nodejs20-devel":"20.11.1-150500.11.6.1","nodejs20-docs":"20.11.1-150500.11.6.1","npm20":"20.11.1-150500.11.6.1"}]},"package":{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP5","name":"nodejs20","purl":"purl:rpm/suse/nodejs20&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP5"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"20.11.1-150500.11.6.1"}],"type":"ECOSYSTEM"}]},{"ecosystem_specific":{"binaries":[{"corepack20":"20.11.1-150500.11.6.1","nodejs20":"20.11.1-150500.11.6.1","nodejs20-devel":"20.11.1-150500.11.6.1","nodejs20-docs":"20.11.1-150500.11.6.1","npm20":"20.11.1-150500.11.6.1"}]},"package":{"ecosystem":"openSUSE:Leap 15.5","name":"nodejs20","purl":"purl:rpm/suse/nodejs20&distro=openSUSE%20Leap%2015.5"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"20.11.1-150500.11.6.1"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"This update for nodejs20 fixes the following issues:\n\nUpdate to 20.11.1: (security updates)\n\n* CVE-2024-21892: Code injection and privilege escalation through Linux capabilities (bsc#1219992).\n* CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993).\n* CVE-2024-21896: Path traversal by monkey-patching Buffer internals (bsc#1219994).j\n* CVE-2024-22017: setuid() does not drop all privileges due to io_uring (bsc#1219995).\n* CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997).\n* CVE-2024-21891: Multiple permission model bypasses due to improper path traversal sequence sanitization (bsc#1219998).\n* CVE-2024-21890: Improper handling of wildcards in --allow-fs-read and --allow-fs-write (bsc#1219999).\n* CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014).\n* CVE-2024-24758: undici version 5.28.3 (bsc#1220017).\n* CVE-2024-24806: libuv version 1.48.0 (bsc#1219724).\n\nUpdate to 20.11.0:\n\n* esm: add import.meta.dirname and import.meta.filename\n* fs: add c++ fast path for writeFileSync utf8\n* module: remove useCustomLoadersIfPresent flag\n* module: bootstrap module loaders in shadow realm\n* src: add --disable-warning option\n* src: create per isolate proxy env template\n* src: make process binding data weak\n* stream: use Array for Readable buffer\n* stream: optimize creation\n* test_runner: adds built in lcov reporter\n* test_runner: add Date to the supported mock APIs\n* test_runner, cli: add --test-timeout flag\n\nUpdate to 20.10.0:\n\n* --experimental-default-type flag to flip module defaults\n* The new flag --experimental-detect-module can be used to automatically run ES modules when their syntax can be detected.\n* Added flush option in file system functions for fs.writeFile functions\n* Added experimental WebSocket client\n* vm: fix V8 compilation cache support for vm.Script. This fixes performance regression since v16.x when support for importModuleDynamically was added to vm.Script\n","id":"SUSE-SU-2024:0643-1","modified":"2024-02-28T08:43:43Z","published":"2024-02-28T08:43:43Z","references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240643-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1219152"},{"type":"REPORT","url":"https://bugzilla.suse.com/1219724"},{"type":"REPORT","url":"https://bugzilla.suse.com/1219992"},{"type":"REPORT","url":"https://bugzilla.suse.com/1219993"},{"type":"REPORT","url":"https://bugzilla.suse.com/1219994"},{"type":"REPORT","url":"https://bugzilla.suse.com/1219995"},{"type":"REPORT","url":"https://bugzilla.suse.com/1219997"},{"type":"REPORT","url":"https://bugzilla.suse.com/1219998"},{"type":"REPORT","url":"https://bugzilla.suse.com/1219999"},{"type":"REPORT","url":"https://bugzilla.suse.com/1220014"},{"type":"REPORT","url":"https://bugzilla.suse.com/1220017"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-46809"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-21890"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-21891"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-21892"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-21896"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-22017"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-22019"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-22025"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-24758"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-24806"}],"related":["CVE-2023-46809","CVE-2024-21890","CVE-2024-21891","CVE-2024-21892","CVE-2024-21896","CVE-2024-22017","CVE-2024-22019","CVE-2024-22025","CVE-2024-24758","CVE-2024-24806"],"summary":"Security update for nodejs20"}