Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2024:4272-1

Опубликовано: 10 дек. 2024
Источник: suse-cvrf

Описание

Security update for nodejs18

This update for nodejs18 fixes the following issues:

  • CVE-2024-21538: Fixed regular expression denial of service in cross-spawn dependency (bsc#1233856)

  • Update to 18.20.5

    • esm: mark import attributes and JSON module as stable
    • deps:
      • upgrade npm to 10.8.2
      • update simdutf to 5.6.0
      • update brotli to 1.1.0
      • update ada to 2.8.0
      • update acorn to 8.13.0
      • update acorn-walk to 8.3.4
      • update c-ares to 1.29.0

Список пакетов

SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
nodejs18-18.20.5-8.30.1
nodejs18-devel-18.20.5-8.30.1
nodejs18-docs-18.20.5-8.30.1
npm18-18.20.5-8.30.1

Ссылки

Описание

Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Затронутые продукты
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:nodejs18-18.20.5-8.30.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:nodejs18-devel-18.20.5-8.30.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:nodejs18-docs-18.20.5-8.30.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:npm18-18.20.5-8.30.1
Ссылки
Уязвимость SUSE-SU-2024:4272-1