Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2021:0389-1

Опубликовано: 06 мар. 2021
Источник: suse-cvrf

Описание

Security update for nodejs8

This update for nodejs8 fixes the following issues:

  • CVE-2021-22884: DNS rebinding in --inspect (bsc#1182620)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Список пакетов

openSUSE Leap 15.2
nodejs8-8.17.0-lp152.3.11.1
nodejs8-devel-8.17.0-lp152.3.11.1
nodejs8-docs-8.17.0-lp152.3.11.1
npm8-8.17.0-lp152.3.11.1

Ссылки

Описание

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes "localhost6". When "localhost6" is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the "localhost6" domain. As long as the attacker uses the "localhost6" domain, they can still apply the attack described in CVE-2018-7160.

Затронутые продукты
openSUSE Leap 15.2:nodejs8-8.17.0-lp152.3.11.1
openSUSE Leap 15.2:nodejs8-devel-8.17.0-lp152.3.11.1
openSUSE Leap 15.2:nodejs8-docs-8.17.0-lp152.3.11.1
openSUSE Leap 15.2:npm8-8.17.0-lp152.3.11.1
Ссылки