Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2024:4272-1

Опубликовано: 10 дек. 2024
Источник: suse-cvrf

Описание

Security update for nodejs18

This update for nodejs18 fixes the following issues:

  • CVE-2024-21538: Fixed regular expression denial of service in cross-spawn dependency (bsc#1233856)

  • Update to 18.20.5

    • esm: mark import attributes and JSON module as stable
    • deps:
      • upgrade npm to 10.8.2
      • update simdutf to 5.6.0
      • update brotli to 1.1.0
      • update ada to 2.8.0
      • update acorn to 8.13.0
      • update acorn-walk to 8.3.4
      • update c-ares to 1.29.0

Список пакетов

SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
nodejs18-18.20.5-8.30.1
nodejs18-devel-18.20.5-8.30.1
nodejs18-docs-18.20.5-8.30.1
npm18-18.20.5-8.30.1

Ссылки

Описание

Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Затронутые продукты
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:nodejs18-18.20.5-8.30.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:nodejs18-devel-18.20.5-8.30.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:nodejs18-docs-18.20.5-8.30.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:npm18-18.20.5-8.30.1
Ссылки