SUSE-SU-2024:2574-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2024/suse-su-20242574-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2024:2574-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/SUSE-SU-2024:2574-1
Related
Published
2024-07-22T10:35:15Z
Modified
2024-07-22T10:35:15Z
Summary
Security update for nodejs20
Details

This update for nodejs20 fixes the following issues:

Update to 20.15.1:

  • CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)
  • CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)
  • CVE-2024-22018: Fixed fs.lstat bypasses permission model (bsc#1227562)
  • CVE-2024-36137: Fixed fs.fchown/fchmod bypasses permission model (bsc#1227561)
  • CVE-2024-37372: Fixed Permission model improperly processes UNC paths (bsc#1227563)

Changes in 20.15.0:

  • test_runner: support test plans
  • inspector: introduce the --inspect-wait flag
  • zlib: expose zlib.crc32()
  • cli: allow running wasm in limited vmem with --disable-wasm-trap-handler

Changes in 20.14.0

  • src,permission: throw async errors on async APIs
  • test_runner: support forced exit

Changes in 20.13.1:

  • buffer: improve base64 and base64url performance
  • crypto: deprecate implicitly shortened GCM tags
  • events,doc: mark CustomEvent as stable
  • fs: add stacktrace to fs/promises
  • report: add --report-exclude-network option
  • src: add uvgetavailable_memory to report and process
  • stream: support typed arrays
  • util: support array of formats in util.styleText
  • v8: implement v8.queryObjects() for memory leak regression testing
  • watch: mark as stable
References

Affected packages

SUSE:Linux Enterprise Module for Web and Scripting 15 SP6 / nodejs20

Package

Name
nodejs20
Purl
pkg:rpm/suse/nodejs20&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
20.15.1-150600.3.3.2

Ecosystem specific 

{
    "binaries": [
        {
            "nodejs20": "20.15.1-150600.3.3.2",
            "nodejs20-docs": "20.15.1-150600.3.3.2",
            "npm20": "20.15.1-150600.3.3.2",
            "nodejs20-devel": "20.15.1-150600.3.3.2"
        }
    ]
}

openSUSE:Leap 15.6 / nodejs20

Package

Name
nodejs20
Purl
pkg:rpm/opensuse/nodejs20&distro=openSUSE%20Leap%2015.6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
20.15.1-150600.3.3.2

Ecosystem specific 

{
    "binaries": [
        {
            "corepack20": "20.15.1-150600.3.3.2",
            "nodejs20": "20.15.1-150600.3.3.2",
            "nodejs20-docs": "20.15.1-150600.3.3.2",
            "npm20": "20.15.1-150600.3.3.2",
            "nodejs20-devel": "20.15.1-150600.3.3.2"
        }
    ]
}