openSUSE-SU-2021:3940-1
openSUSE-SU-2021:3940-1 · Security update for nodejs12
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
This update for nodejs12 fixes the following issues: - CVE-2021-22959: Fixed HTTP Request Smuggling due to spaced in headers (bsc#1191601). - CVE-2021-22960: Fixed HTTP Request Smuggling when parsing the body (bsc#1191602). - CVE-2021-37701: Fixed arbitrary file creation and overwrite in nodejs-tar (bsc#1190057). - CVE-2021-37712: Fixed arbitrary file creation and overwrite in nodejs-tar (bsc#1190056). - CVE-2021-37713: Fixed arbitrary code execution and file creation and overwrite in nodejs-tar (bsc#1190055). - CVE-2021-39134: Fixed symling following vulnerability in nodejs-arborist (bsc#1190054). - CVE-2021-39135: Fixed symling following vulnerability in nodejs-arborist (bsc#1190053).
Corrección disponible
- Publicación
- Actualización
Pila tecnológica: system
Productos y versiones afectados
nodejs12 openSUSE:Leap 15.3
- Intervalos de versiones afectados
- ECOSYSTEM: < 12.22.7-4.22.1
Actualiza a 12.22.7-4.22.1
Fuentes originales
- https://lists.opensuse.org/archives/list/[email protected]/thread/LB7JXCGGW7EKOPAS4IDMUQPYHXS3ZUZA/
- https://bugzilla.suse.com/1190053
- https://bugzilla.suse.com/1190054
- https://bugzilla.suse.com/1190055
- https://bugzilla.suse.com/1190056
- https://bugzilla.suse.com/1190057
- https://bugzilla.suse.com/1191601
- https://bugzilla.suse.com/1191602
- https://www.suse.com/security/cve/CVE-2021-22959
- https://www.suse.com/security/cve/CVE-2021-22960
- https://www.suse.com/security/cve/CVE-2021-37701
- https://www.suse.com/security/cve/CVE-2021-37712
- https://www.suse.com/security/cve/CVE-2021-37713
- https://www.suse.com/security/cve/CVE-2021-39134
- https://www.suse.com/security/cve/CVE-2021-39135
- https://osv.dev/vulnerability/openSUSE-SU-2021:3940-1