SUSE update for nodejs8

Published: 2021-08-05 | Updated: 2022-09-05

Risk	Medium
Patch available	YES
Number of vulnerabilities	4
CVE-ID	CVE-2020-7774 CVE-2021-22884 CVE-2021-23362 CVE-2021-27290
CWE-ID	CWE-94 CWE-350 CWE-185
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #1 is available. Public exploit code for vulnerability #3 is available.
Vulnerable software	SUSE Linux Enterprise Module for Web Scripting Operating systems & Components / Operating system SUSE Manager Proxy Operating systems & Components / Operating system SUSE Manager Retail Branch Server Operating systems & Components / Operating system SUSE Manager Server Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing Operating systems & Components / Operating system SUSE Enterprise Storage Operating systems & Components / Operating system SUSE CaaS Platform Operating systems & Components / Operating system SUSE Linux Enterprise Server Operating systems & Components / Operating system nodejs8-docs Operating systems & Components / Operating system package or component nodejs-common Operating systems & Components / Operating system package or component npm8 Operating systems & Components / Operating system package or component nodejs8-devel Operating systems & Components / Operating system package or component nodejs8-debugsource Operating systems & Components / Operating system package or component nodejs8-debuginfo Operating systems & Components / Operating system package or component nodejs8 Operating systems & Components / Operating system package or component
Vendor	SUSE

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Prototype pollution

EUVDB-ID: #VU52909

Risk: Medium

CVSSv4.0: 2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2020-7774

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation. A remote attacker can send a specially crafted request and execute arbitrary JavaScript code.

Mitigation

Update the affected package nodejs8 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Module for Web Scripting: 15-SP2

SUSE Manager Proxy: 4.0

SUSE Manager Retail Branch Server: 4.0

SUSE Manager Server: 4.0

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15

SUSE Linux Enterprise High Performance Computing: 15-LTSS - 15-SP1-ESPOS

SUSE Enterprise Storage: 6

SUSE CaaS Platform: 4.0

SUSE Linux Enterprise Server: 15-LTSS - 15-SP1-LTSS

nodejs8-docs: before 8.17.0-3.47.2

nodejs-common: before 2.0-3.2.1

npm8: before 8.17.0-3.47.2

nodejs8-devel: before 8.17.0-3.47.2

nodejs8-debugsource: before 8.17.0-3.47.2

nodejs8-debuginfo: before 8.17.0-3.47.2

nodejs8: before 8.17.0-3.47.2

CPE2.3

External links

https://www.suse.com/support/update/announcement/2021/suse-su-20212620-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) DNS rebinding

EUVDB-ID: #VU50955

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-22884

CWE-ID: CWE-350 - Reliance on Reverse DNS Resolution for a Security-Critical Action

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform DNS rebinding attack.

The vulnerability exists due to the application whitelist includes the “localhost6” name. When “localhost6” is not present in /etc/hosts, it is treated an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain.

Mitigation

Update the affected package nodejs8 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Module for Web Scripting: 15-SP2

SUSE Manager Proxy: 4.0

SUSE Manager Retail Branch Server: 4.0

SUSE Manager Server: 4.0

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15

SUSE Linux Enterprise High Performance Computing: 15-LTSS - 15-SP1-ESPOS

SUSE Enterprise Storage: 6

SUSE CaaS Platform: 4.0

SUSE Linux Enterprise Server: 15-LTSS - 15-SP1-LTSS

nodejs8-docs: before 8.17.0-3.47.2

nodejs-common: before 2.0-3.2.1

npm8: before 8.17.0-3.47.2

nodejs8-devel: before 8.17.0-3.47.2

nodejs8-debugsource: before 8.17.0-3.47.2

nodejs8-debuginfo: before 8.17.0-3.47.2

nodejs8: before 8.17.0-3.47.2

CPE2.3

External links

https://www.suse.com/support/update/announcement/2021/suse-su-20212620-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Incorrect Regular Expression

EUVDB-ID: #VU61255

Risk: Medium

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2021-23362

CWE-ID: CWE-185 - Incorrect Regular Expression

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing regular expression "shortcutMatch" in the "fromUrl" function. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

Mitigation

Update the affected package nodejs8 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Module for Web Scripting: 15-SP2

SUSE Manager Proxy: 4.0

SUSE Manager Retail Branch Server: 4.0

SUSE Manager Server: 4.0

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15

SUSE Linux Enterprise High Performance Computing: 15-LTSS - 15-SP1-ESPOS

SUSE Enterprise Storage: 6

SUSE CaaS Platform: 4.0

SUSE Linux Enterprise Server: 15-LTSS - 15-SP1-LTSS

nodejs8-docs: before 8.17.0-3.47.2

nodejs-common: before 2.0-3.2.1

npm8: before 8.17.0-3.47.2

nodejs8-devel: before 8.17.0-3.47.2

nodejs8-debugsource: before 8.17.0-3.47.2

nodejs8-debuginfo: before 8.17.0-3.47.2

nodejs8: before 8.17.0-3.47.2

CPE2.3

External links

https://www.suse.com/support/update/announcement/2021/suse-su-20212620-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) Incorrect Regular Expression

EUVDB-ID: #VU52194

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-27290

CWE-ID: CWE-185 - Incorrect Regular Expression

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect processing of SRIs. A remote attacker can pass specially crafted input to the application and perform regular expression denial of service (ReDoS) attack.

Mitigation

Update the affected package nodejs8 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Module for Web Scripting: 15-SP2

SUSE Manager Proxy: 4.0

SUSE Manager Retail Branch Server: 4.0

SUSE Manager Server: 4.0

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15

SUSE Linux Enterprise High Performance Computing: 15-LTSS - 15-SP1-ESPOS

SUSE Enterprise Storage: 6

SUSE CaaS Platform: 4.0

SUSE Linux Enterprise Server: 15-LTSS - 15-SP1-LTSS

nodejs8-docs: before 8.17.0-3.47.2

nodejs-common: before 2.0-3.2.1

npm8: before 8.17.0-3.47.2

nodejs8-devel: before 8.17.0-3.47.2

nodejs8-debugsource: before 8.17.0-3.47.2

nodejs8-debuginfo: before 8.17.0-3.47.2

nodejs8: before 8.17.0-3.47.2

CPE2.3

External links

https://www.suse.com/support/update/announcement/2021/suse-su-20212620-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.