SUSE-SU-2020:0454-1

Details

Description of the patch:

This update for nodejs8 fixes the following issues:

Security issues fixed:

CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).
CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).
CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).

Affected Packages

nodejs8

SUSE Linux Enterprise High Performance Computing 15-ESPOSSUSE Linux Enterprise High Performance Computing 15-LTSSSUSE Linux Enterprise Module for Web and Scripting 15SUSE Linux Enterprise Module for Web and Scripting 15 SP1SUSE Linux Enterprise Server 15-LTSS

Fixed in:

8.17.0-3.28.1

nodejs8-devel

SUSE Linux Enterprise High Performance Computing 15-ESPOSSUSE Linux Enterprise High Performance Computing 15-LTSSSUSE Linux Enterprise Module for Web and Scripting 15SUSE Linux Enterprise Module for Web and Scripting 15 SP1SUSE Linux Enterprise Server 15-LTSS

Fixed in:

8.17.0-3.28.1

nodejs8-docs

SUSE Linux Enterprise High Performance Computing 15-ESPOSSUSE Linux Enterprise High Performance Computing 15-LTSSSUSE Linux Enterprise Module for Web and Scripting 15SUSE Linux Enterprise Module for Web and Scripting 15 SP1SUSE Linux Enterprise Server 15-LTSS

Fixed in:

8.17.0-3.28.1

npm8

SUSE Linux Enterprise High Performance Computing 15-ESPOSSUSE Linux Enterprise High Performance Computing 15-LTSSSUSE Linux Enterprise Module for Web and Scripting 15SUSE Linux Enterprise Module for Web and Scripting 15 SP1SUSE Linux Enterprise Server 15-LTSS

Fixed in:

8.17.0-3.28.1

References

ADVISORY

https://bugzilla.suse.com/1163102

ADVISORY

https://bugzilla.suse.com/1163103

ADVISORY

https://bugzilla.suse.com/1163104

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2020-February/006527.html

ADVISORY