Security update for nodejs8 SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2022:0704-1 Final 1 1 2022-03-03T17:26:35Z current 2022-03-03T17:26:35Z 2022-03-03T17:26:35Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for nodejs8 This update for nodejs8 fixes the following issues: - CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153). - CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963). - CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962). - CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696). - CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-SLE-15.3-2022-704,openSUSE-SLE-15.4-2022-704 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4BTHU2F626CTZYCXOBT5S7GWU3QXNTMZ/ E-Mail link for openSUSE-SU-2022:0704-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1191962 SUSE Bug 1191962 https://bugzilla.suse.com/1191963 SUSE Bug 1191963 https://bugzilla.suse.com/1192153 SUSE Bug 1192153 https://bugzilla.suse.com/1192154 SUSE Bug 1192154 https://bugzilla.suse.com/1192696 SUSE Bug 1192696 https://www.suse.com/security/cve/CVE-2021-23343/ SUSE CVE CVE-2021-23343 page https://www.suse.com/security/cve/CVE-2021-32803/ SUSE CVE CVE-2021-32803 page https://www.suse.com/security/cve/CVE-2021-32804/ SUSE CVE CVE-2021-32804 page https://www.suse.com/security/cve/CVE-2021-3807/ SUSE CVE CVE-2021-3807 page https://www.suse.com/security/cve/CVE-2021-3918/ SUSE CVE CVE-2021-3918 page openSUSE Leap 15.3 nodejs8-8.17.0-10.19.2 nodejs8-devel-8.17.0-10.19.2 nodejs8-docs-8.17.0-10.19.2 npm8-8.17.0-10.19.2 nodejs8-8.17.0-10.19.2 as a component of openSUSE Leap 15.3 nodejs8-devel-8.17.0-10.19.2 as a component of openSUSE Leap 15.3 nodejs8-docs-8.17.0-10.19.2 as a component of openSUSE Leap 15.3 npm8-8.17.0-10.19.2 as a component of openSUSE Leap 15.3 All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity. CVE-2021-23343 openSUSE Leap 15.3:nodejs8-8.17.0-10.19.2 openSUSE Leap 15.3:nodejs8-devel-8.17.0-10.19.2 openSUSE Leap 15.3:nodejs8-docs-8.17.0-10.19.2 openSUSE Leap 15.3:npm8-8.17.0-10.19.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4BTHU2F626CTZYCXOBT5S7GWU3QXNTMZ/ https://www.suse.com/security/cve/CVE-2021-23343.html CVE-2021-23343 https://bugzilla.suse.com/1192153 SUSE Bug 1192153 The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary `stat` calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the `node-tar` directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where `node-tar` checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass `node-tar` symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2. CVE-2021-32803 openSUSE Leap 15.3:nodejs8-8.17.0-10.19.2 openSUSE Leap 15.3:nodejs8-devel-8.17.0-10.19.2 openSUSE Leap 15.3:nodejs8-docs-8.17.0-10.19.2 openSUSE Leap 15.3:npm8-8.17.0-10.19.2 important 5.8 AV:N/AC:M/Au:N/C:N/I:P/A:P 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4BTHU2F626CTZYCXOBT5S7GWU3QXNTMZ/ https://www.suse.com/security/cve/CVE-2021-32803.html CVE-2021-32803 https://bugzilla.suse.com/1191962 SUSE Bug 1191962 https://bugzilla.suse.com/1191963 SUSE Bug 1191963 The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. This logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`. `node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar. CVE-2021-32804 openSUSE Leap 15.3:nodejs8-8.17.0-10.19.2 openSUSE Leap 15.3:nodejs8-devel-8.17.0-10.19.2 openSUSE Leap 15.3:nodejs8-docs-8.17.0-10.19.2 openSUSE Leap 15.3:npm8-8.17.0-10.19.2 important 5.8 AV:N/AC:M/Au:N/C:N/I:P/A:P 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4BTHU2F626CTZYCXOBT5S7GWU3QXNTMZ/ https://www.suse.com/security/cve/CVE-2021-32804.html CVE-2021-32804 https://bugzilla.suse.com/1191962 SUSE Bug 1191962 ansi-regex is vulnerable to Inefficient Regular Expression Complexity CVE-2021-3807 openSUSE Leap 15.3:nodejs8-8.17.0-10.19.2 openSUSE Leap 15.3:nodejs8-devel-8.17.0-10.19.2 openSUSE Leap 15.3:nodejs8-docs-8.17.0-10.19.2 openSUSE Leap 15.3:npm8-8.17.0-10.19.2 important 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4BTHU2F626CTZYCXOBT5S7GWU3QXNTMZ/ https://www.suse.com/security/cve/CVE-2021-3807.html CVE-2021-3807 https://bugzilla.suse.com/1192154 SUSE Bug 1192154 json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') CVE-2021-3918 openSUSE Leap 15.3:nodejs8-8.17.0-10.19.2 openSUSE Leap 15.3:nodejs8-devel-8.17.0-10.19.2 openSUSE Leap 15.3:nodejs8-docs-8.17.0-10.19.2 openSUSE Leap 15.3:npm8-8.17.0-10.19.2 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4BTHU2F626CTZYCXOBT5S7GWU3QXNTMZ/ https://www.suse.com/security/cve/CVE-2021-3918.html CVE-2021-3918 https://bugzilla.suse.com/1192696 SUSE Bug 1192696