SUSE update for nodejs10



Risk High
Patch available YES
Number of vulnerabilities 4
CVE-ID CVE-2021-22930
CVE-2021-22931
CVE-2021-22939
CVE-2021-3672
CWE-ID CWE-416
CWE-20
CWE-295
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		SUSE Linux Enterprise Module for Web Scripting
Operating systems & Components / Operating system

nodejs10-docs
Operating systems & Components / Operating system package or component

npm10
Operating systems & Components / Operating system package or component

nodejs10-devel
Operating systems & Components / Operating system package or component

nodejs10-debuginfo
Operating systems & Components / Operating system package or component

nodejs10
Operating systems & Components / Operating system package or component

Vendor SUSE

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Use-after-free

EUVDB-ID: #VU55560

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-22930

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing HTTP/2 stream canceling requests. A remote attacker can send a specially crafted HTTP/2 request, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected package nodejs10 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Module for Web Scripting: 12

nodejs10-docs: before 10.24.1-1.42.2

npm10: before 10.24.1-1.42.2

nodejs10-devel: before 10.24.1-1.42.2

nodejs10-debuginfo: before 10.24.1-1.42.2

nodejs10: before 10.24.1-1.42.2

CPE2.3 External links

http://www.suse.com/support/update/announcement/2021/suse-su-20212823-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper input validation

EUVDB-ID: #VU57498

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-22931

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Cluster: General (Node.js) component in MySQL Cluster. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.

Mitigation

Update the affected package nodejs10 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Module for Web Scripting: 12

nodejs10-docs: before 10.24.1-1.42.2

npm10: before 10.24.1-1.42.2

nodejs10-devel: before 10.24.1-1.42.2

nodejs10-debuginfo: before 10.24.1-1.42.2

nodejs10: before 10.24.1-1.42.2

CPE2.3 External links

http://www.suse.com/support/update/announcement/2021/suse-su-20212823-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper Certificate Validation

EUVDB-ID: #VU61253

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-22939

CWE-ID: CWE-295 - Improper Certificate Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to incomplete validation of rejectUnauthorized parameter. A remote attacker can cause the connections to servers with an expired certificate would have been accepted.

Mitigation

Update the affected package nodejs10 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Module for Web Scripting: 12

nodejs10-docs: before 10.24.1-1.42.2

npm10: before 10.24.1-1.42.2

nodejs10-devel: before 10.24.1-1.42.2

nodejs10-debuginfo: before 10.24.1-1.42.2

nodejs10: before 10.24.1-1.42.2

CPE2.3 External links

http://www.suse.com/support/update/announcement/2021/suse-su-20212823-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU56967

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-3672

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to hijack domains.

The vulnerability exists due to insufficient validation of host names, returned by the DNS server. A remote attacker can pass specially crafted input to the application and perform domain hijacking.

Mitigation

Update the affected package nodejs10 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Module for Web Scripting: 12

nodejs10-docs: before 10.24.1-1.42.2

npm10: before 10.24.1-1.42.2

nodejs10-devel: before 10.24.1-1.42.2

nodejs10-debuginfo: before 10.24.1-1.42.2

nodejs10: before 10.24.1-1.42.2

CPE2.3 External links

http://www.suse.com/support/update/announcement/2021/suse-su-20212823-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###