Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-15-SP5:Update
patchinfo.32630
_patchinfo
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File _patchinfo of Package patchinfo.32630
<patchinfo incident="32630"> <issue tracker="cve" id="2024-22017"/> <issue tracker="cve" id="2024-21896"/> <issue tracker="cve" id="2023-46809"/> <issue tracker="cve" id="2024-21891"/> <issue tracker="cve" id="2024-21890"/> <issue tracker="cve" id="2024-21892"/> <issue tracker="cve" id="2024-24758"/> <issue tracker="cve" id="2024-24806"/> <issue tracker="cve" id="2024-22019"/> <issue tracker="cve" id="2024-22025"/> <issue tracker="bnc" id="1219994">VUL-0: CVE-2024-21896: nodejs20: Path traversal by monkey-patching Buffer internals</issue> <issue tracker="bnc" id="1220017">VUL-0: CVE-2024-24758: nodejs10,nodejs12,nodejs14,nodejs16,nodejs18,nodejs20,nodejs4,nodejs6,nodejs8: ignore proxy-authorization header</issue> <issue tracker="bnc" id="1219993">VUL-0: CVE-2024-22019: nodejs10,nodejs12,nodejs14,nodejs16,nodejs18,nodejs20,nodejs4,nodejs6,nodejs8: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks</issue> <issue tracker="bnc" id="1219999">VUL-0: CVE-2024-21890: nodejs20: Improper handling of wildcards in --allow-fs-read and --allow-fs-write</issue> <issue tracker="bnc" id="1219997">VUL-0: CVE-2023-46809: nodejs10,nodejs12,nodejs14,nodejs16,nodejs18,nodejs20,nodejs4,nodejs6,nodejs8: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding)</issue> <issue tracker="bnc" id="1220014">VUL-0: CVE-2024-22025: nodejs10,nodejs12,nodejs14,nodejs16,nodejs18,nodejs20,nodejs4,nodejs6,nodejs8: Denial of Service by resource exhaustion in fetch() brotli decoding</issue> <issue tracker="bnc" id="1219992">VUL-0: CVE-2024-21892: nodejs10,nodejs12,nodejs14,nodejs16,nodejs18,nodejs20,nodejs4,nodejs6,nodejs8: Code injection and privilege escalation through Linux capabilities</issue> <issue tracker="bnc" id="1219152">nodejs packages fail to build with OpenSSL 3.1</issue> <issue tracker="bnc" id="1219724">VUL-0: CVE-2024-24806: libuv: libuv: Improper Domain Lookup that potentially leads to SSRF attacks</issue> <issue tracker="bnc" id="1219998">VUL-0: CVE-2024-21891: nodejs20: Multiple permission model bypasses due to improper path traversal sequence sanitization</issue> <issue tracker="bnc" id="1219995">VUL-0: CVE-2024-22017: nodejs20: setuid() does not drop all privileges due to io_uring</issue> <packager>adamm</packager> <rating>important</rating> <category>security</category> <summary>Security update for nodejs20</summary> <description>This update for nodejs20 fixes the following issues: Update to 20.11.1: (security updates) * CVE-2024-21892: Code injection and privilege escalation through Linux capabilities (bsc#1219992). * CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993). * CVE-2024-21896: Path traversal by monkey-patching Buffer internals (bsc#1219994).j * CVE-2024-22017: setuid() does not drop all privileges due to io_uring (bsc#1219995). * CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997). * CVE-2024-21891: Multiple permission model bypasses due to improper path traversal sequence sanitization (bsc#1219998). * CVE-2024-21890: Improper handling of wildcards in --allow-fs-read and --allow-fs-write (bsc#1219999). * CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014). * CVE-2024-24758: undici version 5.28.3 (bsc#1220017). * CVE-2024-24806: libuv version 1.48.0 (bsc#1219724). Update to 20.11.0: * esm: add import.meta.dirname and import.meta.filename * fs: add c++ fast path for writeFileSync utf8 * module: remove useCustomLoadersIfPresent flag * module: bootstrap module loaders in shadow realm * src: add --disable-warning option * src: create per isolate proxy env template * src: make process binding data weak * stream: use Array for Readable buffer * stream: optimize creation * test_runner: adds built in lcov reporter * test_runner: add Date to the supported mock APIs * test_runner, cli: add --test-timeout flag Update to 20.10.0: * --experimental-default-type flag to flip module defaults * The new flag --experimental-detect-module can be used to automatically run ES modules when their syntax can be detected. * Added flush option in file system functions for fs.writeFile functions * Added experimental WebSocket client * vm: fix V8 compilation cache support for vm.Script. This fixes performance regression since v16.x when support for importModuleDynamically was added to vm.Script </description> </patchinfo>
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor