SUSE-SU-2023:4373-1

Details

This update for nodejs12 fixes the following issues:

CVE-2023-44487: Fixed the Rapid Reset attack in nghttp2. (bsc#1216190)
CVE-2023-38552: Fixed an integrity checks according to policies that could be circumvented. (bsc#1216272)

Affected Packages

nodejs14

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP2-LTSSSUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSSSUSE Linux Enterprise Server 15 SP2-LTSS

Fixed in:

14.21.3-150200.15.52.2

nodejs14-devel

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP2-LTSSSUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSSSUSE Linux Enterprise Server 15 SP2-LTSS

Fixed in:

14.21.3-150200.15.52.2

nodejs14-docs

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP2-LTSSSUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSSSUSE Linux Enterprise Server 15 SP2-LTSS

Fixed in:

14.21.3-150200.15.52.2

npm14

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP2-LTSSSUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSSSUSE Linux Enterprise Server 15 SP2-LTSS

Fixed in:

14.21.3-150200.15.52.2

corepack14

openSUSE Leap 15.4

Fixed in:

14.21.3-150200.15.52.2

References

REPORT

https://bugzilla.suse.com/1216190

REPORT

https://bugzilla.suse.com/1216272

WEB

https://www.suse.com/security/cve/CVE-2023-38552

WEB

https://www.suse.com/security/cve/CVE-2023-44487

ADVISORY

https://www.suse.com/support/update/announcement/2023/suse-su-20234373-1/