Security update for nodejs14
This update for nodejs14 fixes the following issues: - CVE-2023-32002: Fixed permissions policies bypass via Module._load (bsc#1214150). - CVE-2023-32006: Fixed permissions policies impersonation using module.constructor.createRequire() (bsc#1214156). - CVE-2023-32559: Fixed permissions policies bypass via process.binding (bsc#1214154). - CVE-2023-30581: Fixed mainModule.proto bypass (bsc#1212574). - CVE-2023-30590: Fixed missing DiffieHellman key generation (bsc#1212583). - CVE-2023-30589: Fixed HTTP Request Smuggling via Empty headers separated by CR (bsc#1212582).
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for nodejs14 fixes the following issues: - CVE-2023-32002: Fixed permissions policies bypass via Module._load (bsc#1214150). - CVE-2023-32006: Fixed permissions policies impersonation using module.constructor.createRequire() (bsc#1214156). - CVE-2023-32559: Fixed permissions policies bypass via process.binding (bsc#1214154). - CVE-2023-30581: Fixed mainModule.proto bypass (bsc#1212574). - CVE-2023-30590: Fixed missing DiffieHellman key generation (bsc#1212583). - CVE-2023-30589: Fixed HTTP Request Smuggling via Empty headers separated by CR (bsc#1212582).
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1212574
- https://bugzilla.suse.com/1212582
- https://bugzilla.suse.com/1212583
- https://bugzilla.suse.com/1214150
- https://bugzilla.suse.com/1214154
- https://bugzilla.suse.com/1214156
- https://www.suse.com/security/cve/CVE-2023-30581
- https://www.suse.com/security/cve/CVE-2023-30589
- https://www.suse.com/security/cve/CVE-2023-30590
- https://www.suse.com/security/cve/CVE-2023-32002
- https://www.suse.com/security/cve/CVE-2023-32006
- https://www.suse.com/security/cve/CVE-2023-32559
- https://www.suse.com/support/update/announcement/2023/suse-su-20233306-1/