SUSE-SU-2024:0732-1: Security update for nodejs14

Q: Which systems are covered by this update?

The update applies to nodejs14 packages, including npm14 and development, documentation, debug, and debuginfo packages, on SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS for aarch64 and x86_64, as well as the noarch package set.

Q: What attack scenarios are addressed?

The fixes address timing attacks against PKCS#1 v1.5 padding, denial of service through unbounded HTTP chunk extensions and fetch() Brotli decoding resource exhaustion, and a domain-lookup issue that could potentially enable server-side request forgery.

Q: How can I determine whether this update is relevant to an installation?

Check whether nodejs14 or related packages such as npm14 are installed on SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS. The advisory identifies those packages and platforms as affected by the security update.

Published Feb 29, 2024

Updated

This update for nodejs14 fixes the following issues: Security issues fixed: CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997). CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993). CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014). CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).

Affected Software

56 affected componentsFixes available

All of the following

SUSE SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 x86_64)

Any of the following

suse/nodejs14-debuginfo<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/nodejs14<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/npm14<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/nodejs14-devel<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/nodejs14-debugsource<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

All of the following

SUSE SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (noarch)

suse/nodejs14-docs<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

All of the following

SUSE SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64)

Any of the following

suse/nodejs14-debuginfo<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/nodejs14<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/npm14<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/nodejs14-devel<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/nodejs14-debugsource<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

All of the following

SUSE SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch)

suse/nodejs14-docs<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

All of the following

SUSE SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/nodejs14-debuginfo<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/nodejs14<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/npm14<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/nodejs14-devel<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/nodejs14-debugsource<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

All of the following

SUSE SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch)

suse/nodejs14-docs<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

All of the following

SUSE SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/nodejs14-debuginfo<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/nodejs14<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/npm14<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/nodejs14-devel<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/nodejs14-debugsource<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

All of the following

SUSE SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch)

suse/nodejs14-docs<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

All of the following

SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64)

Any of the following

suse/nodejs14-debuginfo<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/nodejs14<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/npm14<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/nodejs14-devel<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/nodejs14-debugsource<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

All of the following

SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP2 (noarch)

suse/nodejs14-docs<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

All of the following

SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64)

Any of the following

suse/nodejs14-debuginfo<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/nodejs14<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/npm14<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/nodejs14-devel<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/nodejs14-debugsource<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

All of the following

SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP3 (noarch)

suse/nodejs14-docs<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

All of the following

SUSE SUSE Enterprise Storage 7.1 (aarch64 x86_64)

Any of the following

suse/nodejs14-debuginfo<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/nodejs14<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/npm14<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/nodejs14-devel<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

suse/nodejs14-debugsource<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

All of the following

SUSE SUSE Enterprise Storage 7.1 (noarch)

suse/nodejs14-docs<14.21.3-150200.15.55.1

14.21.3-150200.15.55.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/nodejs14-debuginfo to a version that resolves this vulnerability.
Fixed in 14.21.3-150200.15.55.1
Upgrade
Upgrade suse/nodejs14 to a version that resolves this vulnerability.
Fixed in 14.21.3-150200.15.55.1
Upgrade
Upgrade suse/npm14 to a version that resolves this vulnerability.
Fixed in 14.21.3-150200.15.55.1
Upgrade
Upgrade suse/nodejs14-devel to a version that resolves this vulnerability.
Fixed in 14.21.3-150200.15.55.1
Upgrade
Upgrade suse/nodejs14-debugsource to a version that resolves this vulnerability.
Fixed in 14.21.3-150200.15.55.1
Upgrade
Upgrade suse/nodejs14-docs to a version that resolves this vulnerability.
Fixed in 14.21.3-150200.15.55.1
Upgrade
Upgrade nodejs14 to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-732=1
Upgrade
Upgrade nodejs14 to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-732=1
Upgrade
Upgrade nodejs14 to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-732=1
Upgrade
Upgrade nodejs14 to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-732=1
Upgrade
Upgrade nodejs14 to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-732=1
Upgrade
Upgrade nodejs14 to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-732=1
Upgrade
Upgrade nodejs14 to a version that resolves this vulnerability.
Patch SUSE-Storage-7.1-2024-732=1

Event History

Feb 29, 2024

Advisory Published

via SUSE·04:30 PM

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which systems are covered by this update?

The update applies to nodejs14 packages, including npm14 and development, documentation, debug, and debuginfo packages, on SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS for aarch64 and x86_64, as well as the noarch package set.

What attack scenarios are addressed?

The fixes address timing attacks against PKCS#1 v1.5 padding, denial of service through unbounded HTTP chunk extensions and fetch() Brotli decoding resource exhaustion, and a domain-lookup issue that could potentially enable server-side request forgery.

How can I determine whether this update is relevant to an installation?

Check whether nodejs14 or related packages such as npm14 are installed on SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS. The advisory identifies those packages and platforms as affected by the security update.

SUSE-SU-2024:0732-1: Security update for nodejs14

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems are covered by this update?

What attack scenarios are addressed?

How can I determine whether this update is relevant to an installation?

Company

Resources

Contact

Frequently Asked Questions

Which systems are covered by this update?

What attack scenarios are addressed?

How can I determine whether this update is relevant to an installation?