SB20240717120 - SUSE update for nodejs20
Published: July 17, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2024-22018)
The vulnerability allows a remote user to bypass permissions model.
The vulnerability exists due to application does not properly impose security restrictions when experimental permission model when the --allow-fs-read flag is used. A remote user can retrieve stats from files that they do not have explicit read access to.
2) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2024-22020)
The disclosed vulnerability allows a remote user to perform SSRF attacks.
The vulnerability exists due to insufficient validation of user-supplied input when handling non-network imports in data URLs. A remote user can bypass network import restrictions and execute arbitrary code.
3) Command Injection (CVE-ID: CVE-2024-27980)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to improper handling of batch files in child_process.spawn / child_process.spawnSync. An attacker can inject a malicious command line argument and achieve code execution even if the shell option is not enabled.
4) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2024-36137)
The vulnerability allows a remote user to escalate privileges within the application.
The vulnerability exists due to application does not properly impose security restrictions in the experimental permission model when the --allow-fs-write flag is used. A remote user can change file ownership and permissions via fs.fchown and fs.fchmod.
5) Command Injection (CVE-ID: CVE-2024-36138)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to improper handling of batch files in child_process.spawn / child_process.spawnSync on Windows. An attacker can inject a malicious command line argument and achieve code execution even if the shell option is not enabled.
Note, the vulnerability exists due to incomplete fix for #VU88462 (CVE-2024-27980).
6) Input validation error (CVE-ID: CVE-2024-37372)
The vulnerability allows a remote user to bypass permissions model.
The vulnerability exists due to insufficient validation of UNC paths with backslashes. A remote user can bypass certain security restrictions.
Remediation
Install update from vendor's website.