Описание
Security update for nodejs18
This update for nodejs18 fixes the following issues:
Update to LTS version 18.17.1.
- CVE-2023-32002: Fixed permissions policies bypass via Module._load (bsc#1214150).
- CVE-2023-32006: Fixed permissions policies impersonation using module.constructor.createRequire() (bsc#1214156).
- CVE-2023-32559: Fixed permissions policies bypass via process.binding (bsc#1214154).
Список пакетов
Container bci/node:18
SUSE Linux Enterprise Module for Web and Scripting 15 SP4
SUSE Linux Enterprise Module for Web and Scripting 15 SP5
openSUSE Leap 15.4
openSUSE Leap 15.5
Ссылки
- Link for SUSE-SU-2023:3378-1
- E-Mail link for SUSE-SU-2023:3378-1
- SUSE Security Ratings
- SUSE Bug 1214150
- SUSE Bug 1214154
- SUSE Bug 1214156
- SUSE CVE CVE-2023-32002 page
- SUSE CVE CVE-2023-32006 page
- SUSE CVE CVE-2023-32559 page
Описание
The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
Затронутые продукты
Ссылки
- CVE-2023-32002
- SUSE Bug 1214150
Описание
The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
Затронутые продукты
Ссылки
- CVE-2023-32006
- SUSE Bug 1214156
Описание
A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js.
Затронутые продукты
Ссылки
- CVE-2023-32559
- SUSE Bug 1214154