openSUSE-SU-2021:3940-1
openSUSE-SU-2021:3940-1 · Security update for nodejs12
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This update for nodejs12 fixes the following issues: - CVE-2021-22959: Fixed HTTP Request Smuggling due to spaced in headers (bsc#1191601). - CVE-2021-22960: Fixed HTTP Request Smuggling when parsing the body (bsc#1191602). - CVE-2021-37701: Fixed arbitrary file creation and overwrite in nodejs-tar (bsc#1190057). - CVE-2021-37712: Fixed arbitrary file creation and overwrite in nodejs-tar (bsc#1190056). - CVE-2021-37713: Fixed arbitrary code execution and file creation and overwrite in nodejs-tar (bsc#1190055). - CVE-2021-39134: Fixed symling following vulnerability in nodejs-arborist (bsc#1190054). - CVE-2021-39135: Fixed symling following vulnerability in nodejs-arborist (bsc#1190053).
Fix available
- Published
- Updated
Stack: system
Affected products and versions
nodejs12 openSUSE:Leap 15.3
- Affected ranges
- ECOSYSTEM: < 12.22.7-4.22.1
Update to 12.22.7-4.22.1
Original sources
- https://lists.opensuse.org/archives/list/[email protected]/thread/LB7JXCGGW7EKOPAS4IDMUQPYHXS3ZUZA/
- https://bugzilla.suse.com/1190053
- https://bugzilla.suse.com/1190054
- https://bugzilla.suse.com/1190055
- https://bugzilla.suse.com/1190056
- https://bugzilla.suse.com/1190057
- https://bugzilla.suse.com/1191601
- https://bugzilla.suse.com/1191602
- https://www.suse.com/security/cve/CVE-2021-22959
- https://www.suse.com/security/cve/CVE-2021-22960
- https://www.suse.com/security/cve/CVE-2021-37701
- https://www.suse.com/security/cve/CVE-2021-37712
- https://www.suse.com/security/cve/CVE-2021-37713
- https://www.suse.com/security/cve/CVE-2021-39134
- https://www.suse.com/security/cve/CVE-2021-39135
- https://osv.dev/vulnerability/openSUSE-SU-2021:3940-1