corepack20-20.8.1-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:13337-1 Final 1 1 2024-06-15T00:00:00Z current 2024-06-15T00:00:00Z 2024-06-15T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z corepack20-20.8.1-1.1 on GA media These are all security issues fixed in the corepack20-20.8.1-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-13337 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2023-38552/ SUSE CVE CVE-2023-38552 page https://www.suse.com/security/cve/CVE-2023-39331/ SUSE CVE CVE-2023-39331 page https://www.suse.com/security/cve/CVE-2023-39332/ SUSE CVE CVE-2023-39332 page https://www.suse.com/security/cve/CVE-2023-39333/ SUSE CVE CVE-2023-39333 page https://www.suse.com/security/cve/CVE-2023-44487/ SUSE CVE CVE-2023-44487 page https://www.suse.com/security/cve/CVE-2023-45143/ SUSE CVE CVE-2023-45143 page openSUSE Tumbleweed corepack20-20.8.1-1.1 nodejs20-20.8.1-1.1 nodejs20-devel-20.8.1-1.1 nodejs20-docs-20.8.1-1.1 npm20-20.8.1-1.1 corepack20-20.8.1-1.1 as a component of openSUSE Tumbleweed nodejs20-20.8.1-1.1 as a component of openSUSE Tumbleweed nodejs20-devel-20.8.1-1.1 as a component of openSUSE Tumbleweed nodejs20-docs-20.8.1-1.1 as a component of openSUSE Tumbleweed npm20-20.8.1-1.1 as a component of openSUSE Tumbleweed When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x. Please note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js. CVE-2023-38552 openSUSE Tumbleweed:corepack20-20.8.1-1.1 openSUSE Tumbleweed:nodejs20-20.8.1-1.1 openSUSE Tumbleweed:nodejs20-devel-20.8.1-1.1 openSUSE Tumbleweed:nodejs20-docs-20.8.1-1.1 openSUSE Tumbleweed:npm20-20.8.1-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-38552.html CVE-2023-38552 https://bugzilla.suse.com/1216272 SUSE Bug 1216272 A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. CVE-2023-39331 openSUSE Tumbleweed:corepack20-20.8.1-1.1 openSUSE Tumbleweed:nodejs20-20.8.1-1.1 openSUSE Tumbleweed:nodejs20-devel-20.8.1-1.1 openSUSE Tumbleweed:nodejs20-docs-20.8.1-1.1 openSUSE Tumbleweed:npm20-20.8.1-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-39331.html CVE-2023-39331 https://bugzilla.suse.com/1216270 SUSE Bug 1216270 Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer` `Uint8Array` objects. This is distinct from CVE-2023-32004 which only referred to `Buffer` objects. However, the vulnerability follows the same pattern using `Uint8Array` instead of `Buffer`. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. CVE-2023-39332 openSUSE Tumbleweed:corepack20-20.8.1-1.1 openSUSE Tumbleweed:nodejs20-20.8.1-1.1 openSUSE Tumbleweed:nodejs20-devel-20.8.1-1.1 openSUSE Tumbleweed:nodejs20-docs-20.8.1-1.1 openSUSE Tumbleweed:npm20-20.8.1-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-39332.html CVE-2023-39332 https://bugzilla.suse.com/1216271 SUSE Bug 1216271 Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module. This vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the `--experimental-wasm-modules` command line option. CVE-2023-39333 openSUSE Tumbleweed:corepack20-20.8.1-1.1 openSUSE Tumbleweed:nodejs20-20.8.1-1.1 openSUSE Tumbleweed:nodejs20-devel-20.8.1-1.1 openSUSE Tumbleweed:nodejs20-docs-20.8.1-1.1 openSUSE Tumbleweed:npm20-20.8.1-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-39333.html CVE-2023-39333 https://bugzilla.suse.com/1216273 SUSE Bug 1216273 The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-44487 openSUSE Tumbleweed:corepack20-20.8.1-1.1 openSUSE Tumbleweed:nodejs20-20.8.1-1.1 openSUSE Tumbleweed:nodejs20-devel-20.8.1-1.1 openSUSE Tumbleweed:nodejs20-docs-20.8.1-1.1 openSUSE Tumbleweed:npm20-20.8.1-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-44487.html CVE-2023-44487 https://bugzilla.suse.com/1216109 SUSE Bug 1216109 https://bugzilla.suse.com/1216123 SUSE Bug 1216123 https://bugzilla.suse.com/1216169 SUSE Bug 1216169 https://bugzilla.suse.com/1216171 SUSE Bug 1216171 https://bugzilla.suse.com/1216174 SUSE Bug 1216174 https://bugzilla.suse.com/1216176 SUSE Bug 1216176 https://bugzilla.suse.com/1216181 SUSE Bug 1216181 https://bugzilla.suse.com/1216182 SUSE Bug 1216182 https://bugzilla.suse.com/1216190 SUSE Bug 1216190 Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds. CVE-2023-45143 openSUSE Tumbleweed:corepack20-20.8.1-1.1 openSUSE Tumbleweed:nodejs20-20.8.1-1.1 openSUSE Tumbleweed:nodejs20-devel-20.8.1-1.1 openSUSE Tumbleweed:nodejs20-docs-20.8.1-1.1 openSUSE Tumbleweed:npm20-20.8.1-1.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-45143.html CVE-2023-45143 https://bugzilla.suse.com/1216205 SUSE Bug 1216205