Vulnerability from csaf_suse
Published
2024-07-16 07:33
Modified
2024-07-16 07:33
Summary
Security update for nodejs18

Notes

Title of the patch
Security update for nodejs18
Description of the patch
This update for nodejs18 fixes the following issues: Update to 18.20.4: - CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560) - CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554) Changes in 18.20.3: - This release fixes a regression introduced in Node.js 18.19.0 where http.server.close() was incorrectly closing idle connections. deps: - acorn updated to 8.11.3. - acorn-walk updated to 8.3.2. - ada updated to 2.7.8. - c-ares updated to 1.28.1. - corepack updated to 0.28.0. - nghttp2 updated to 1.61.0. - ngtcp2 updated to 1.3.0. - npm updated to 10.7.0. Includes a fix from npm@10.5.1 to limit the number of open connections npm/cli#7324. - simdutf updated to 5.2.4. Changes in 18.20.2: - CVE-2024-27980: Fixed command injection via args parameter of child_process.spawn without shell option enabled on Windows (bsc#1222665)
Patchnames
SUSE-2024-2496,SUSE-SLE-Module-Web-Scripting-12-2024-2496
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Security update for nodejs18",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "This update for nodejs18 fixes the following issues:\n\nUpdate to 18.20.4:\n\n- CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)\n- CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)\n\nChanges in 18.20.3:\n\n- This release fixes a regression introduced in Node.js 18.19.0 where http.server.close() was incorrectly closing idle connections.\n  deps:\n  - acorn updated to 8.11.3.\n  - acorn-walk updated to 8.3.2.\n  - ada updated to 2.7.8.\n  - c-ares updated to 1.28.1.\n  - corepack updated to 0.28.0.\n  - nghttp2 updated to 1.61.0.\n  - ngtcp2 updated to 1.3.0.\n  - npm updated to 10.7.0. Includes a fix from npm@10.5.1 to limit the number of open connections npm/cli#7324.\n  - simdutf updated to 5.2.4.\n\nChanges in 18.20.2:\n\n- CVE-2024-27980: Fixed command injection via args parameter of child_process.spawn without shell option enabled on Windows (bsc#1222665)\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "SUSE-2024-2496,SUSE-SLE-Module-Web-Scripting-12-2024-2496",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2024_2496-1.json",
         },
         {
            category: "self",
            summary: "URL for SUSE-SU-2024:2496-1",
            url: "https://www.suse.com/support/update/announcement/2024/suse-su-20242496-1/",
         },
         {
            category: "self",
            summary: "E-Mail link for SUSE-SU-2024:2496-1",
            url: "https://lists.suse.com/pipermail/sle-security-updates/2024-July/018981.html",
         },
         {
            category: "self",
            summary: "SUSE Bug 1222665",
            url: "https://bugzilla.suse.com/1222665",
         },
         {
            category: "self",
            summary: "SUSE Bug 1227554",
            url: "https://bugzilla.suse.com/1227554",
         },
         {
            category: "self",
            summary: "SUSE Bug 1227560",
            url: "https://bugzilla.suse.com/1227560",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-22020 page",
            url: "https://www.suse.com/security/cve/CVE-2024-22020/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-27980 page",
            url: "https://www.suse.com/security/cve/CVE-2024-27980/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-36138 page",
            url: "https://www.suse.com/security/cve/CVE-2024-36138/",
         },
      ],
      title: "Security update for nodejs18",
      tracking: {
         current_release_date: "2024-07-16T07:33:47Z",
         generator: {
            date: "2024-07-16T07:33:47Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "SUSE-SU-2024:2496-1",
         initial_release_date: "2024-07-16T07:33:47Z",
         revision_history: [
            {
               date: "2024-07-16T07:33:47Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "corepack18-18.20.4-8.24.1.aarch64",
                        product: {
                           name: "corepack18-18.20.4-8.24.1.aarch64",
                           product_id: "corepack18-18.20.4-8.24.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs18-18.20.4-8.24.1.aarch64",
                        product: {
                           name: "nodejs18-18.20.4-8.24.1.aarch64",
                           product_id: "nodejs18-18.20.4-8.24.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs18-devel-18.20.4-8.24.1.aarch64",
                        product: {
                           name: "nodejs18-devel-18.20.4-8.24.1.aarch64",
                           product_id: "nodejs18-devel-18.20.4-8.24.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm18-18.20.4-8.24.1.aarch64",
                        product: {
                           name: "npm18-18.20.4-8.24.1.aarch64",
                           product_id: "npm18-18.20.4-8.24.1.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "corepack18-18.20.4-8.24.1.i586",
                        product: {
                           name: "corepack18-18.20.4-8.24.1.i586",
                           product_id: "corepack18-18.20.4-8.24.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs18-18.20.4-8.24.1.i586",
                        product: {
                           name: "nodejs18-18.20.4-8.24.1.i586",
                           product_id: "nodejs18-18.20.4-8.24.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs18-devel-18.20.4-8.24.1.i586",
                        product: {
                           name: "nodejs18-devel-18.20.4-8.24.1.i586",
                           product_id: "nodejs18-devel-18.20.4-8.24.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm18-18.20.4-8.24.1.i586",
                        product: {
                           name: "npm18-18.20.4-8.24.1.i586",
                           product_id: "npm18-18.20.4-8.24.1.i586",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "i586",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "nodejs18-docs-18.20.4-8.24.1.noarch",
                        product: {
                           name: "nodejs18-docs-18.20.4-8.24.1.noarch",
                           product_id: "nodejs18-docs-18.20.4-8.24.1.noarch",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "corepack18-18.20.4-8.24.1.ppc64le",
                        product: {
                           name: "corepack18-18.20.4-8.24.1.ppc64le",
                           product_id: "corepack18-18.20.4-8.24.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs18-18.20.4-8.24.1.ppc64le",
                        product: {
                           name: "nodejs18-18.20.4-8.24.1.ppc64le",
                           product_id: "nodejs18-18.20.4-8.24.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs18-devel-18.20.4-8.24.1.ppc64le",
                        product: {
                           name: "nodejs18-devel-18.20.4-8.24.1.ppc64le",
                           product_id: "nodejs18-devel-18.20.4-8.24.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm18-18.20.4-8.24.1.ppc64le",
                        product: {
                           name: "npm18-18.20.4-8.24.1.ppc64le",
                           product_id: "npm18-18.20.4-8.24.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "corepack18-18.20.4-8.24.1.s390x",
                        product: {
                           name: "corepack18-18.20.4-8.24.1.s390x",
                           product_id: "corepack18-18.20.4-8.24.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs18-18.20.4-8.24.1.s390x",
                        product: {
                           name: "nodejs18-18.20.4-8.24.1.s390x",
                           product_id: "nodejs18-18.20.4-8.24.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs18-devel-18.20.4-8.24.1.s390x",
                        product: {
                           name: "nodejs18-devel-18.20.4-8.24.1.s390x",
                           product_id: "nodejs18-devel-18.20.4-8.24.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm18-18.20.4-8.24.1.s390x",
                        product: {
                           name: "npm18-18.20.4-8.24.1.s390x",
                           product_id: "npm18-18.20.4-8.24.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "corepack18-18.20.4-8.24.1.x86_64",
                        product: {
                           name: "corepack18-18.20.4-8.24.1.x86_64",
                           product_id: "corepack18-18.20.4-8.24.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs18-18.20.4-8.24.1.x86_64",
                        product: {
                           name: "nodejs18-18.20.4-8.24.1.x86_64",
                           product_id: "nodejs18-18.20.4-8.24.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "nodejs18-devel-18.20.4-8.24.1.x86_64",
                        product: {
                           name: "nodejs18-devel-18.20.4-8.24.1.x86_64",
                           product_id: "nodejs18-devel-18.20.4-8.24.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "npm18-18.20.4-8.24.1.x86_64",
                        product: {
                           name: "npm18-18.20.4-8.24.1.x86_64",
                           product_id: "npm18-18.20.4-8.24.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Module for Web and Scripting 12",
                        product: {
                           name: "SUSE Linux Enterprise Module for Web and Scripting 12",
                           product_id: "SUSE Linux Enterprise Module for Web and Scripting 12",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sle-module-web-scripting:12",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs18-18.20.4-8.24.1.aarch64 as component of SUSE Linux Enterprise Module for Web and Scripting 12",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.aarch64",
            },
            product_reference: "nodejs18-18.20.4-8.24.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs18-18.20.4-8.24.1.ppc64le as component of SUSE Linux Enterprise Module for Web and Scripting 12",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.ppc64le",
            },
            product_reference: "nodejs18-18.20.4-8.24.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs18-18.20.4-8.24.1.s390x as component of SUSE Linux Enterprise Module for Web and Scripting 12",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.s390x",
            },
            product_reference: "nodejs18-18.20.4-8.24.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs18-18.20.4-8.24.1.x86_64 as component of SUSE Linux Enterprise Module for Web and Scripting 12",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.x86_64",
            },
            product_reference: "nodejs18-18.20.4-8.24.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs18-devel-18.20.4-8.24.1.aarch64 as component of SUSE Linux Enterprise Module for Web and Scripting 12",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.aarch64",
            },
            product_reference: "nodejs18-devel-18.20.4-8.24.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs18-devel-18.20.4-8.24.1.ppc64le as component of SUSE Linux Enterprise Module for Web and Scripting 12",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.ppc64le",
            },
            product_reference: "nodejs18-devel-18.20.4-8.24.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs18-devel-18.20.4-8.24.1.s390x as component of SUSE Linux Enterprise Module for Web and Scripting 12",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.s390x",
            },
            product_reference: "nodejs18-devel-18.20.4-8.24.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs18-devel-18.20.4-8.24.1.x86_64 as component of SUSE Linux Enterprise Module for Web and Scripting 12",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.x86_64",
            },
            product_reference: "nodejs18-devel-18.20.4-8.24.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "nodejs18-docs-18.20.4-8.24.1.noarch as component of SUSE Linux Enterprise Module for Web and Scripting 12",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-docs-18.20.4-8.24.1.noarch",
            },
            product_reference: "nodejs18-docs-18.20.4-8.24.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm18-18.20.4-8.24.1.aarch64 as component of SUSE Linux Enterprise Module for Web and Scripting 12",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.aarch64",
            },
            product_reference: "npm18-18.20.4-8.24.1.aarch64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm18-18.20.4-8.24.1.ppc64le as component of SUSE Linux Enterprise Module for Web and Scripting 12",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.ppc64le",
            },
            product_reference: "npm18-18.20.4-8.24.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm18-18.20.4-8.24.1.s390x as component of SUSE Linux Enterprise Module for Web and Scripting 12",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.s390x",
            },
            product_reference: "npm18-18.20.4-8.24.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 12",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "npm18-18.20.4-8.24.1.x86_64 as component of SUSE Linux Enterprise Module for Web and Scripting 12",
               product_id: "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.x86_64",
            },
            product_reference: "npm18-18.20.4-8.24.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Web and Scripting 12",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2024-22020",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-22020",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A security flaw in Node.js  allows a bypass of network import restrictions.\nBy embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.\nVerified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.\nExploiting this flaw can violate network import security, posing a risk to developers and servers.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-docs-18.20.4-8.24.1.noarch",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-22020",
               url: "https://www.suse.com/security/cve/CVE-2024-22020",
            },
            {
               category: "external",
               summary: "SUSE Bug 1227554 for CVE-2024-22020",
               url: "https://bugzilla.suse.com/1227554",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-docs-18.20.4-8.24.1.noarch",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-docs-18.20.4-8.24.1.noarch",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-07-16T07:33:47Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-22020",
      },
      {
         cve: "CVE-2024-27980",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-27980",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-docs-18.20.4-8.24.1.noarch",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-27980",
               url: "https://www.suse.com/security/cve/CVE-2024-27980",
            },
            {
               category: "external",
               summary: "SUSE Bug 1222665 for CVE-2024-27980",
               url: "https://bugzilla.suse.com/1222665",
            },
            {
               category: "external",
               summary: "SUSE Bug 1227560 for CVE-2024-27980",
               url: "https://bugzilla.suse.com/1227560",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-docs-18.20.4-8.24.1.noarch",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-07-16T07:33:47Z",
               details: "important",
            },
         ],
         title: "CVE-2024-27980",
      },
      {
         cve: "CVE-2024-36138",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-36138",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn / child_process.spawnSync. A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.x86_64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-docs-18.20.4-8.24.1.noarch",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.aarch64",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.ppc64le",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.s390x",
               "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-36138",
               url: "https://www.suse.com/security/cve/CVE-2024-36138",
            },
            {
               category: "external",
               summary: "SUSE Bug 1227560 for CVE-2024-36138",
               url: "https://bugzilla.suse.com/1227560",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-18.20.4-8.24.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-devel-18.20.4-8.24.1.x86_64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:nodejs18-docs-18.20.4-8.24.1.noarch",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.aarch64",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.ppc64le",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.s390x",
                  "SUSE Linux Enterprise Module for Web and Scripting 12:npm18-18.20.4-8.24.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-07-16T07:33:47Z",
               details: "important",
            },
         ],
         title: "CVE-2024-36138",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.