Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2021:0686-1

Опубликовано: 02 мар. 2021
Источник: suse-cvrf

Описание

Security update for nodejs8

This update for nodejs8 fixes the following issues:

  • CVE-2021-22884: DNS rebinding in --inspect (bsc#1182620)

Список пакетов

SUSE Linux Enterprise Module for Web and Scripting 15 SP2
nodejs8-8.17.0-10.9.2
nodejs8-devel-8.17.0-10.9.2
nodejs8-docs-8.17.0-10.9.2
npm8-8.17.0-10.9.2

Ссылки

Описание

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes "localhost6". When "localhost6" is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the "localhost6" domain. As long as the attacker uses the "localhost6" domain, they can still apply the attack described in CVE-2018-7160.

Затронутые продукты
SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-8.17.0-10.9.2
SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-devel-8.17.0-10.9.2
SUSE Linux Enterprise Module for Web and Scripting 15 SP2:nodejs8-docs-8.17.0-10.9.2
SUSE Linux Enterprise Module for Web and Scripting 15 SP2:npm8-8.17.0-10.9.2
Ссылки