Описание
Security update for nodejs16
This update for nodejs16 fixes the following issues:
- CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of undici.request (bsc#1202382).
- CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383).
- CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (bsc#1200517).
- CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710).
Bugfixes:
- Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303)
Список пакетов
Container bci/node:16
SUSE Linux Enterprise Module for Web and Scripting 15 SP4
openSUSE Leap 15.4
Ссылки
- Link for SUSE-SU-2022:3250-1
- E-Mail link for SUSE-SU-2022:3250-1
- SUSE Security Ratings
- SUSE Bug 1200303
- SUSE Bug 1200517
- SUSE Bug 1201710
- SUSE Bug 1202382
- SUSE Bug 1202383
- SUSE CVE CVE-2022-29244 page
- SUSE CVE CVE-2022-31150 page
- SUSE CVE CVE-2022-35948 page
- SUSE CVE CVE-2022-35949 page
Описание
npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm.
Затронутые продукты
Ссылки
- CVE-2022-29244
- SUSE Bug 1200517
Описание
undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate `\r\n` is a workaround for this issue.
Затронутые продукты
Ссылки
- CVE-2022-31150
- SUSE Bug 1201710
Описание
undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content-type` header. Example: ``` import { request } from 'undici' const unsanitizedContentTypeInput = 'application/json\r\n\r\nGET /foo2 HTTP/1.1' await request('http://localhost:3000, { method: 'GET', headers: { 'content-type': unsanitizedContentTypeInput }, }) ``` The above snippet will perform two requests in a single `request` API call: 1) `http://localhost:3000/` 2) `http://localhost:3000/foo2` This issue was patched in Undici v5.8.1. Sanitize input when sending content-type headers using user input as a workaround.
Затронутые продукты
Ссылки
- CVE-2022-35948
- SUSE Bug 1202383
Описание
undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`. If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1` ```js const undici = require("undici") undici.request({origin: "http://example.com", pathname: "//127.0.0.1"}) ``` Instead of processing the request as `http://example.org//127.0.0.1` (or `http://example.org/http://127.0.0.1` when `http://127.0.0.1 is used`), it actually processes the request as `http://127.0.0.1/` and sends it to `http://127.0.0.1`. If a developer passes in user input into `path` parameter of `undici.request`, it can result in an _SSRF_ as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL. This issue was fixed in `undici@5.8.1`. The best workaround is to validate user input before passing it to the `undici.request` call.
Затронутые продукты
Ссылки
- CVE-2022-35949
- SUSE Bug 1202382