Security update for nodejs16 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:3250-1 Final 1 1 2022-09-12T07:06:54Z current 2022-09-12T07:06:54Z 2022-09-12T07:06:54Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for nodejs16 This update for nodejs16 fixes the following issues: - CVE-2022-35949: Fixed SSRF when an application takes in user input into the path/pathname option of undici.request (bsc#1202382). - CVE-2022-35948: Fixed CRLF injection via Content-Type (bsc#1202383). - CVE-2022-29244: Fixed npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace (bsc#1200517). - CVE-2022-31150: Fixed CRLF injection in node-undici (bsc#1201710). Bugfixes: - Enable crypto-policies for SLE15 SP4+ and TW (bsc#1200303) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container bci/node:16-2022-3250,SUSE-2022-3250,SUSE-SLE-Module-Web-Scripting-15-SP4-2022-3250,openSUSE-SLE-15.4-2022-3250 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20223250-1/ Link for SUSE-SU-2022:3250-1 https://lists.suse.com/pipermail/sle-security-updates/2022-September/012208.html E-Mail link for SUSE-SU-2022:3250-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1200303 SUSE Bug 1200303 https://bugzilla.suse.com/1200517 SUSE Bug 1200517 https://bugzilla.suse.com/1201710 SUSE Bug 1201710 https://bugzilla.suse.com/1202382 SUSE Bug 1202382 https://bugzilla.suse.com/1202383 SUSE Bug 1202383 https://www.suse.com/security/cve/CVE-2022-29244/ SUSE CVE CVE-2022-29244 page https://www.suse.com/security/cve/CVE-2022-31150/ SUSE CVE CVE-2022-31150 page https://www.suse.com/security/cve/CVE-2022-35948/ SUSE CVE CVE-2022-35948 page https://www.suse.com/security/cve/CVE-2022-35949/ SUSE CVE CVE-2022-35949 page Container bci/node:16 SUSE Linux Enterprise Module for Web and Scripting 15 SP4 openSUSE Leap 15.4 nodejs16-16.17.0-150400.3.6.1 npm16-16.17.0-150400.3.6.1 corepack16-16.17.0-150400.3.6.1 nodejs16-devel-16.17.0-150400.3.6.1 nodejs16-docs-16.17.0-150400.3.6.1 nodejs16-16.17.0-150400.3.6.1 as a component of Container bci/node:16 npm16-16.17.0-150400.3.6.1 as a component of Container bci/node:16 nodejs16-16.17.0-150400.3.6.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP4 nodejs16-devel-16.17.0-150400.3.6.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP4 nodejs16-docs-16.17.0-150400.3.6.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP4 npm16-16.17.0-150400.3.6.1 as a component of SUSE Linux Enterprise Module for Web and Scripting 15 SP4 corepack16-16.17.0-150400.3.6.1 as a component of openSUSE Leap 15.4 nodejs16-16.17.0-150400.3.6.1 as a component of openSUSE Leap 15.4 nodejs16-devel-16.17.0-150400.3.6.1 as a component of openSUSE Leap 15.4 nodejs16-docs-16.17.0-150400.3.6.1 as a component of openSUSE Leap 15.4 npm16-16.17.0-150400.3.6.1 as a component of openSUSE Leap 15.4 npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include. Users should upgrade to the latest, patched version of npm v8.11.0, run: npm i -g npm@latest . Node.js versions v16.15.1, v17.19.1, and v18.3.0 include the patched v8.11.0 version of npm. CVE-2022-29244 Container bci/node:16:nodejs16-16.17.0-150400.3.6.1 Container bci/node:16:npm16-16.17.0-150400.3.6.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP4:nodejs16-16.17.0-150400.3.6.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP4:nodejs16-devel-16.17.0-150400.3.6.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP4:nodejs16-docs-16.17.0-150400.3.6.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP4:npm16-16.17.0-150400.3.6.1 openSUSE Leap 15.4:corepack16-16.17.0-150400.3.6.1 openSUSE Leap 15.4:nodejs16-16.17.0-150400.3.6.1 openSUSE Leap 15.4:nodejs16-devel-16.17.0-150400.3.6.1 openSUSE Leap 15.4:nodejs16-docs-16.17.0-150400.3.6.1 openSUSE Leap 15.4:npm16-16.17.0-150400.3.6.1 moderate 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223250-1/ https://www.suse.com/security/cve/CVE-2022-29244.html CVE-2022-29244 https://bugzilla.suse.com/1200517 SUSE Bug 1200517 undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate `\r\n` is a workaround for this issue. CVE-2022-31150 Container bci/node:16:nodejs16-16.17.0-150400.3.6.1 Container bci/node:16:npm16-16.17.0-150400.3.6.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP4:nodejs16-16.17.0-150400.3.6.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP4:nodejs16-devel-16.17.0-150400.3.6.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP4:nodejs16-docs-16.17.0-150400.3.6.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP4:npm16-16.17.0-150400.3.6.1 openSUSE Leap 15.4:corepack16-16.17.0-150400.3.6.1 openSUSE Leap 15.4:nodejs16-16.17.0-150400.3.6.1 openSUSE Leap 15.4:nodejs16-devel-16.17.0-150400.3.6.1 openSUSE Leap 15.4:nodejs16-docs-16.17.0-150400.3.6.1 openSUSE Leap 15.4:npm16-16.17.0-150400.3.6.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223250-1/ https://www.suse.com/security/cve/CVE-2022-31150.html CVE-2022-31150 https://bugzilla.suse.com/1201710 SUSE Bug 1201710 undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content-type` header. Example: ``` import { request } from 'undici' const unsanitizedContentTypeInput = 'application/json\r\n\r\nGET /foo2 HTTP/1.1' await request('http://localhost:3000, { method: 'GET', headers: { 'content-type': unsanitizedContentTypeInput }, }) ``` The above snippet will perform two requests in a single `request` API call: 1) `http://localhost:3000/` 2) `http://localhost:3000/foo2` This issue was patched in Undici v5.8.1. Sanitize input when sending content-type headers using user input as a workaround. CVE-2022-35948 Container bci/node:16:nodejs16-16.17.0-150400.3.6.1 Container bci/node:16:npm16-16.17.0-150400.3.6.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP4:nodejs16-16.17.0-150400.3.6.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP4:nodejs16-devel-16.17.0-150400.3.6.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP4:nodejs16-docs-16.17.0-150400.3.6.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP4:npm16-16.17.0-150400.3.6.1 openSUSE Leap 15.4:corepack16-16.17.0-150400.3.6.1 openSUSE Leap 15.4:nodejs16-16.17.0-150400.3.6.1 openSUSE Leap 15.4:nodejs16-devel-16.17.0-150400.3.6.1 openSUSE Leap 15.4:nodejs16-docs-16.17.0-150400.3.6.1 openSUSE Leap 15.4:npm16-16.17.0-150400.3.6.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223250-1/ https://www.suse.com/security/cve/CVE-2022-35948.html CVE-2022-35948 https://bugzilla.suse.com/1202383 SUSE Bug 1202383 undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`. If a user specifies a URL such as `http://127.0.0.1` or `//127.0.0.1` ```js const undici = require("undici") undici.request({origin: "http://example.com", pathname: "//127.0.0.1"}) ``` Instead of processing the request as `http://example.org//127.0.0.1` (or `http://example.org/http://127.0.0.1` when `http://127.0.0.1 is used`), it actually processes the request as `http://127.0.0.1/` and sends it to `http://127.0.0.1`. If a developer passes in user input into `path` parameter of `undici.request`, it can result in an _SSRF_ as they will assume that the hostname cannot change, when in actual fact it can change because the specified path parameter is combined with the base URL. This issue was fixed in `undici@5.8.1`. The best workaround is to validate user input before passing it to the `undici.request` call. CVE-2022-35949 Container bci/node:16:nodejs16-16.17.0-150400.3.6.1 Container bci/node:16:npm16-16.17.0-150400.3.6.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP4:nodejs16-16.17.0-150400.3.6.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP4:nodejs16-devel-16.17.0-150400.3.6.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP4:nodejs16-docs-16.17.0-150400.3.6.1 SUSE Linux Enterprise Module for Web and Scripting 15 SP4:npm16-16.17.0-150400.3.6.1 openSUSE Leap 15.4:corepack16-16.17.0-150400.3.6.1 openSUSE Leap 15.4:nodejs16-16.17.0-150400.3.6.1 openSUSE Leap 15.4:nodejs16-devel-16.17.0-150400.3.6.1 openSUSE Leap 15.4:nodejs16-docs-16.17.0-150400.3.6.1 openSUSE Leap 15.4:npm16-16.17.0-150400.3.6.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20223250-1/ https://www.suse.com/security/cve/CVE-2022-35949.html CVE-2022-35949 https://bugzilla.suse.com/1202382 SUSE Bug 1202382