Security update for pgadmin4 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2024:3771-1 Final 1 1 2024-10-29T12:55:34Z current 2024-10-29T12:55:34Z 2024-10-29T12:55:34Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for pgadmin4 This update for pgadmin4 fixes the following issues: - CVE-2024-38355: Fixed socket.io: unhandled 'error' event (bsc#1226967) - CVE-2024-38998: Fixed requirejs: prototype pollution via function config (bsc#1227248) - CVE-2024-38999: Fixed requirejs: prototype pollution via function s.contexts._.configure (bsc#1227252) - CVE-2024-39338: Fixed axios: server-side request forgery due to requests for path relative URLs being processed as protocol relative URLs in axios (bsc#1229423) - CVE-2024-4067: Fixed micromatch: vulnerable to Regular Expression Denial of Service (ReDoS) (bsc#1224366) - CVE-2024-4068: Fixed braces: fails to limit the number of characters it can handle, which could lead to Memory Exhaustion (bsc#1224295) - CVE-2024-43788: Fixed webpack: DOM clobbering gadget in AutoPublicPathRuntimeModule could lead to XSS (bsc#1229861) - CVE-2024-48948: Fixed elliptic: ECDSA signature verification error due to leading zero may reject legitimate transactions in elliptic (bsc#1231684) - CVE-2024-48949: Fixed elliptic: Missing Validation in Elliptic's EDDSA Signature Verification (bsc#1231564) - CVE-2024-9014: Fixed OAuth2 issue that could lead to information leak (bsc#1230928) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2024-3771,SUSE-SLE-Module-Python3-15-SP6-2024-3771,openSUSE-SLE-15.6-2024-3771 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2024/suse-su-20243771-1/ Link for SUSE-SU-2024:3771-1 https://lists.suse.com/pipermail/sle-security-updates/2024-October/019689.html E-Mail link for SUSE-SU-2024:3771-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1224295 SUSE Bug 1224295 https://bugzilla.suse.com/1224366 SUSE Bug 1224366 https://bugzilla.suse.com/1226967 SUSE Bug 1226967 https://bugzilla.suse.com/1227248 SUSE Bug 1227248 https://bugzilla.suse.com/1227252 SUSE Bug 1227252 https://bugzilla.suse.com/1229423 SUSE Bug 1229423 https://bugzilla.suse.com/1229861 SUSE Bug 1229861 https://bugzilla.suse.com/1230928 SUSE Bug 1230928 https://bugzilla.suse.com/1231564 SUSE Bug 1231564 https://bugzilla.suse.com/1231684 SUSE Bug 1231684 https://www.suse.com/security/cve/CVE-2024-38355/ SUSE CVE CVE-2024-38355 page https://www.suse.com/security/cve/CVE-2024-38998/ SUSE CVE CVE-2024-38998 page https://www.suse.com/security/cve/CVE-2024-38999/ SUSE CVE CVE-2024-38999 page https://www.suse.com/security/cve/CVE-2024-39338/ SUSE CVE CVE-2024-39338 page https://www.suse.com/security/cve/CVE-2024-4067/ SUSE CVE CVE-2024-4067 page https://www.suse.com/security/cve/CVE-2024-4068/ SUSE CVE CVE-2024-4068 page https://www.suse.com/security/cve/CVE-2024-43788/ SUSE CVE CVE-2024-43788 page https://www.suse.com/security/cve/CVE-2024-48948/ SUSE CVE CVE-2024-48948 page https://www.suse.com/security/cve/CVE-2024-48949/ SUSE CVE CVE-2024-48949 page https://www.suse.com/security/cve/CVE-2024-9014/ SUSE CVE CVE-2024-9014 page SUSE Linux Enterprise Module for Python 3 15 SP6 openSUSE Leap 15.6 pgadmin4-8.5-150600.3.6.1 pgadmin4-cloud-8.5-150600.3.6.1 pgadmin4-desktop-8.5-150600.3.6.1 pgadmin4-doc-8.5-150600.3.6.1 pgadmin4-web-uwsgi-8.5-150600.3.6.1 system-user-pgadmin-8.5-150600.3.6.1 pgadmin4-8.5-150600.3.6.1 as a component of SUSE Linux Enterprise Module for Python 3 15 SP6 pgadmin4-doc-8.5-150600.3.6.1 as a component of SUSE Linux Enterprise Module for Python 3 15 SP6 system-user-pgadmin-8.5-150600.3.6.1 as a component of SUSE Linux Enterprise Module for Python 3 15 SP6 pgadmin4-8.5-150600.3.6.1 as a component of openSUSE Leap 15.6 pgadmin4-cloud-8.5-150600.3.6.1 as a component of openSUSE Leap 15.6 pgadmin4-desktop-8.5-150600.3.6.1 as a component of openSUSE Leap 15.6 pgadmin4-doc-8.5-150600.3.6.1 as a component of openSUSE Leap 15.6 pgadmin4-web-uwsgi-8.5-150600.3.6.1 as a component of openSUSE Leap 15.6 system-user-pgadmin-8.5-150600.3.6.1 as a component of openSUSE Leap 15.6 Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors. CVE-2024-38355 SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1 openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243771-1/ https://www.suse.com/security/cve/CVE-2024-38355.html CVE-2024-38355 https://bugzilla.suse.com/1226965 SUSE Bug 1226965 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. CVE-2024-38998 SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1 openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243771-1/ https://www.suse.com/security/cve/CVE-2024-38998.html CVE-2024-38998 https://bugzilla.suse.com/1227247 SUSE Bug 1227247 jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. CVE-2024-38999 SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1 openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243771-1/ https://www.suse.com/security/cve/CVE-2024-38999.html CVE-2024-38999 https://bugzilla.suse.com/1227251 SUSE Bug 1227251 axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs. CVE-2024-39338 SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1 openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243771-1/ https://www.suse.com/security/cve/CVE-2024-39338.html CVE-2024-39338 https://bugzilla.suse.com/1229421 SUSE Bug 1229421 The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8. CVE-2024-4067 SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1 openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243771-1/ https://www.suse.com/security/cve/CVE-2024-4067.html CVE-2024-4067 https://bugzilla.suse.com/1224255 SUSE Bug 1224255 The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash. CVE-2024-4068 SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1 openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243771-1/ https://www.suse.com/security/cve/CVE-2024-4068.html CVE-2024-4068 https://bugzilla.suse.com/1224256 SUSE Bug 1224256 Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulnerability in Webpack's `AutoPublicPathRuntimeModule`. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Real-world exploitation of this gadget has been observed in the Canvas LMS which allows a XSS attack to happen through a javascript code compiled by Webpack (the vulnerable part is from Webpack). DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. This vulnerability can lead to cross-site scripting (XSS) on websites that include Webpack-generated files and allow users to inject certain scriptless HTML tags with improperly sanitized name or id attributes. This issue has been addressed in release version 5.94.0. All users are advised to upgrade. There are no known workarounds for this issue. CVE-2024-43788 SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1 openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243771-1/ https://www.suse.com/security/cve/CVE-2024-43788.html CVE-2024-43788 https://bugzilla.suse.com/1229860 SUSE Bug 1229860 The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an _truncateToN anomaly. This leads to valid signatures being rejected. Legitimate transactions or communications may be incorrectly flagged as invalid. CVE-2024-48948 SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1 openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243771-1/ https://www.suse.com/security/cve/CVE-2024-48948.html CVE-2024-48948 https://bugzilla.suse.com/1231681 SUSE Bug 1231681 The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation. CVE-2024-48949 SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1 openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243771-1/ https://www.suse.com/security/cve/CVE-2024-48949.html CVE-2024-48949 https://bugzilla.suse.com/1231557 SUSE Bug 1231557 pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data. CVE-2024-9014 SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Python 3 15 SP6:pgadmin4-doc-8.5-150600.3.6.1 SUSE Linux Enterprise Module for Python 3 15 SP6:system-user-pgadmin-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-cloud-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-desktop-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-doc-8.5-150600.3.6.1 openSUSE Leap 15.6:pgadmin4-web-uwsgi-8.5-150600.3.6.1 openSUSE Leap 15.6:system-user-pgadmin-8.5-150600.3.6.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243771-1/ https://www.suse.com/security/cve/CVE-2024-9014.html CVE-2024-9014 https://bugzilla.suse.com/1230928 SUSE Bug 1230928