RHSA-2023:7205

Vulnerability from csaf_opensuse - Published: 2023-11-14 00:00 - Updated: 2026-09-20 11:33
Summary
security update for nodejs
Severity
Low
Notes
Title of the patch: security update for nodejs
Description of the patch: This security update provides a functional equivalent of RHSA-2023:7205. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2023:7205.
Patchnames: RHSA-2023:7205
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2023-38552
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Liberty Linux 8:nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:nodejs-devel-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:nodejs-docs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:nodejs-full-i18n-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:nodejs-nodemon-0:3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:nodejs-packaging-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:nodejs-packaging-bundler-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20 —
Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:npm-1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20 —
Vendor Fix
Threats
Impact moderate
CVE-2023-39331
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
Recommended 8 products, the same list as for CVE-2023-38552
Threats
Impact important
CVE-2023-39332
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
Recommended 8 products, the same list as for CVE-2023-38552
Threats
Impact important
CVE-2023-39333
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Recommended 8 products, the same list as for CVE-2023-38552
Threats
Impact moderate
CVE-2023-44487
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 8 products, the same list as for CVE-2023-38552
Threats
Impact important
CVE-2023-45143
3.9 (Low)
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L
Affected products
Recommended 8 products, the same list as for CVE-2023-38552
Threats
Impact low
References
URL Category
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/r… self
https://www.suse.com/security/cve/CVE-2023-38552/ self
https://www.suse.com/security/cve/CVE-2023-39331/ self
https://www.suse.com/security/cve/CVE-2023-39332/ self
https://www.suse.com/security/cve/CVE-2023-39333/ self
https://www.suse.com/security/cve/CVE-2023-44487/ self
https://www.suse.com/security/cve/CVE-2023-45143/ self
https://www.suse.com/security/cve/CVE-2023-38552 external
https://bugzilla.suse.com/1216272 external
https://www.suse.com/security/cve/CVE-2023-39331 external
https://bugzilla.suse.com/1216270 external
https://www.suse.com/security/cve/CVE-2023-39332 external
https://bugzilla.suse.com/1216271 external
https://www.suse.com/security/cve/CVE-2023-39333 external
https://bugzilla.suse.com/1216273 external
https://www.suse.com/security/cve/CVE-2023-44487 external
https://bugzilla.suse.com/1216109 external
https://bugzilla.suse.com/1216123 external
https://bugzilla.suse.com/1216169 external
https://bugzilla.suse.com/1216171 external
https://bugzilla.suse.com/1216174 external
https://bugzilla.suse.com/1216176 external
https://bugzilla.suse.com/1216181 external
https://bugzilla.suse.com/1216182 external
https://bugzilla.suse.com/1216190 external
https://bugzilla.suse.com/1243895 external
https://bugzilla.suse.com/1268251 external
https://bugzilla.suse.com/1269082 external
https://www.suse.com/security/cve/CVE-2023-45143 external
https://bugzilla.suse.com/1216205 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for nodejs",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2023:7205.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2023:7205.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2023:7205",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2023_7205.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-38552 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-38552/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-39331 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-39331/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-39332 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-39332/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-39333 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-39333/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-44487 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-44487/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-45143 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-45143/"
      }
    ],
    "title": "security update for nodejs",
    "tracking": {
      "current_release_date": "2026-09-20T11:33:55Z",
      "generator": {
        "date": "2023-11-14T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2023:7205",
      "initial_release_date": "2023-11-14T00:00:00Z",
      "revision_history": [
        {
          "date": "2023-11-14T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T11:33:55Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-docs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
                "product": {
                  "name": "nodejs-docs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch (nodejs:20)",
                  "product_id": "nodejs-docs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/nodejs-docs@20.8.1-1.module+el8.9.0+20473+c4e3d824?arch=noarch\u0026rpmmod=nodejs:20:8000020231114222239:rhel8\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-nodemon-0:3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
                "product": {
                  "name": "nodejs-nodemon-0:3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch (nodejs:20)",
                  "product_id": "nodejs-nodemon-0:3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/nodejs-nodemon@3.0.1-1.module+el8.9.0+20473+c4e3d824?arch=noarch\u0026rpmmod=nodejs:20:8000020240509100135:rhel8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
                "product": {
                  "name": "nodejs-packaging-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch (nodejs:20)",
                  "product_id": "nodejs-packaging-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/nodejs-packaging@2021.06-4.module+el8.9.0+19519+e25b965a?arch=noarch\u0026rpmmod=nodejs:20:8000020240509100135:rhel8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-packaging-bundler-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
                "product": {
                  "name": "nodejs-packaging-bundler-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch (nodejs:20)",
                  "product_id": "nodejs-packaging-bundler-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/nodejs-packaging-bundler@2021.06-4.module+el8.9.0+19519+e25b965a?arch=noarch\u0026rpmmod=nodejs:20:8000020240509100135:rhel8"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
                "product": {
                  "name": "nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64 (nodejs:20)",
                  "product_id": "nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:nodejs:node.js:20.8.1:*:*:*:-:*:*:*",
                    "purl": "pkg:rpm/suse/nodejs@20.8.1-1.module+el8.9.0+20473+c4e3d824?arch=x86_64\u0026rpmmod=nodejs:20:8000020231114222239:rhel8\u0026epoch=1\u0026upstream=nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-devel-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
                "product": {
                  "name": "nodejs-devel-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64 (nodejs:20)",
                  "product_id": "nodejs-devel-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/nodejs-devel@20.8.1-1.module+el8.9.0+20473+c4e3d824?arch=x86_64\u0026rpmmod=nodejs:20:8000020231114222239:rhel8\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs-full-i18n-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
                "product": {
                  "name": "nodejs-full-i18n-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64 (nodejs:20)",
                  "product_id": "nodejs-full-i18n-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/nodejs-full-i18n@20.8.1-1.module+el8.9.0+20473+c4e3d824?arch=x86_64\u0026rpmmod=nodejs:20:8000020231114222239:rhel8\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "npm-1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
                "product": {
                  "name": "npm-1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.x86_64 (nodejs:20)",
                  "product_id": "npm-1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/npm@10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824?arch=x86_64\u0026rpmmod=nodejs:20:8000020231114222239:rhel8\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 8",
                "product": {
                  "name": "SUSE Liberty Linux 8",
                  "product_id": "SUSE Liberty Linux 8",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20"
        },
        "product_reference": "nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-devel-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:nodejs-devel-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20"
        },
        "product_reference": "nodejs-devel-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-docs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:nodejs-docs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20"
        },
        "product_reference": "nodejs-docs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-full-i18n-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:nodejs-full-i18n-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20"
        },
        "product_reference": "nodejs-full-i18n-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-nodemon-0:3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:nodejs-nodemon-0:3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20"
        },
        "product_reference": "nodejs-nodemon-0:3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:nodejs-packaging-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20"
        },
        "product_reference": "nodejs-packaging-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-packaging-bundler-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:nodejs-packaging-bundler-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20"
        },
        "product_reference": "nodejs-packaging-bundler-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm-1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:npm-1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20"
        },
        "product_reference": "npm-1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-38552",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-38552"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node\u0027s policy implementation, thus effectively disabling the integrity check.\nImpacts:\nThis vulnerability affects all users using the experimental policy mechanism in all active release lines: 18.x and, 20.x.\nPlease note that at the time this CVE was issued, the policy mechanism is an experimental feature of Node.js.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-devel-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-docs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-full-i18n-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-nodemon-0:3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-packaging-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-packaging-bundler-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
          "SUSE Liberty Linux 8:npm-1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-38552",
          "url": "https://www.suse.com/security/cve/CVE-2023-38552"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1216272 for CVE-2023-38552",
          "url": "https://bugzilla.suse.com/1216272"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-devel-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-docs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-packaging-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-packaging-bundler-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
            "SUSE Liberty Linux 8:npm-1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-devel-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-docs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-packaging-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-packaging-bundler-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
            "SUSE Liberty Linux 8:npm-1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-11-14T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-38552"
    },
    {
      "cve": "CVE-2023-39331",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-39331"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability arises because the implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-devel-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-docs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-full-i18n-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-nodemon-0:3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-packaging-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-packaging-bundler-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
          "SUSE Liberty Linux 8:npm-1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-39331",
          "url": "https://www.suse.com/security/cve/CVE-2023-39331"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1216270 for CVE-2023-39331",
          "url": "https://bugzilla.suse.com/1216270"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-devel-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-docs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-packaging-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-packaging-bundler-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
            "SUSE Liberty Linux 8:npm-1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-devel-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-docs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-packaging-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-packaging-bundler-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
            "SUSE Liberty Linux 8:npm-1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-11-14T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-39331"
    },
    {
      "cve": "CVE-2023-39332",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-39332"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class extends the `Uint8Array` class. Node.js prevents path traversal through strings (see CVE-2023-30584) and `Buffer` objects (see CVE-2023-32004), but not through non-`Buffer` `Uint8Array` objects.\r\n\r\nThis is distinct from CVE-2023-32004 which only referred to `Buffer` objects. However, the vulnerability follows the same pattern using `Uint8Array` instead of `Buffer`.\r\n\r\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-devel-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-docs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-full-i18n-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-nodemon-0:3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-packaging-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-packaging-bundler-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
          "SUSE Liberty Linux 8:npm-1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-39332",
          "url": "https://www.suse.com/security/cve/CVE-2023-39332"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1216271 for CVE-2023-39332",
          "url": "https://bugzilla.suse.com/1216271"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-devel-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-docs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-packaging-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-packaging-bundler-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
            "SUSE Liberty Linux 8:npm-1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-devel-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-docs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-packaging-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-packaging-bundler-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
            "SUSE Liberty Linux 8:npm-1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-11-14T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-39332"
    },
    {
      "cve": "CVE-2023-39333",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-39333"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data and functions that the WebAssembly module itself does not have access to, similar to as if the WebAssembly module was a JavaScript module.\n\nThis vulnerability affects users of any active release line of Node.js. The vulnerable feature is only available if Node.js is started with the `--experimental-wasm-modules` command line option.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-devel-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-docs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-full-i18n-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-nodemon-0:3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-packaging-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-packaging-bundler-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
          "SUSE Liberty Linux 8:npm-1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-39333",
          "url": "https://www.suse.com/security/cve/CVE-2023-39333"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1216273 for CVE-2023-39333",
          "url": "https://bugzilla.suse.com/1216273"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-devel-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-docs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-packaging-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-packaging-bundler-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
            "SUSE Liberty Linux 8:npm-1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-devel-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-docs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-packaging-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-packaging-bundler-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
            "SUSE Liberty Linux 8:npm-1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-11-14T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-39333"
    },
    {
      "cve": "CVE-2023-44487",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-44487"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-devel-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-docs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-full-i18n-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-nodemon-0:3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-packaging-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-packaging-bundler-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
          "SUSE Liberty Linux 8:npm-1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-44487",
          "url": "https://www.suse.com/security/cve/CVE-2023-44487"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1216109 for CVE-2023-44487",
          "url": "https://bugzilla.suse.com/1216109"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1216123 for CVE-2023-44487",
          "url": "https://bugzilla.suse.com/1216123"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1216169 for CVE-2023-44487",
          "url": "https://bugzilla.suse.com/1216169"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1216171 for CVE-2023-44487",
          "url": "https://bugzilla.suse.com/1216171"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1216174 for CVE-2023-44487",
          "url": "https://bugzilla.suse.com/1216174"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1216176 for CVE-2023-44487",
          "url": "https://bugzilla.suse.com/1216176"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1216181 for CVE-2023-44487",
          "url": "https://bugzilla.suse.com/1216181"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1216182 for CVE-2023-44487",
          "url": "https://bugzilla.suse.com/1216182"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1216190 for CVE-2023-44487",
          "url": "https://bugzilla.suse.com/1216190"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1243895 for CVE-2023-44487",
          "url": "https://bugzilla.suse.com/1243895"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268251 for CVE-2023-44487",
          "url": "https://bugzilla.suse.com/1268251"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1269082 for CVE-2023-44487",
          "url": "https://bugzilla.suse.com/1269082"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-devel-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-docs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-packaging-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-packaging-bundler-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
            "SUSE Liberty Linux 8:npm-1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-devel-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-docs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-packaging-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-packaging-bundler-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
            "SUSE Liberty Linux 8:npm-1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-11-14T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-44487"
    },
    {
      "cve": "CVE-2023-45143",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-45143"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici\u0027s implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-devel-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-docs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-full-i18n-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-nodemon-0:3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-packaging-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
          "SUSE Liberty Linux 8:nodejs-packaging-bundler-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
          "SUSE Liberty Linux 8:npm-1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-45143",
          "url": "https://www.suse.com/security/cve/CVE-2023-45143"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1216205 for CVE-2023-45143",
          "url": "https://bugzilla.suse.com/1216205"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-devel-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-docs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-packaging-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-packaging-bundler-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
            "SUSE Liberty Linux 8:npm-1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.9,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:nodejs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-devel-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-docs-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-full-i18n-1:20.8.1-1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-nodemon-0:3.0.1-1.module+el8.9.0+20473+c4e3d824.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-packaging-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
            "SUSE Liberty Linux 8:nodejs-packaging-bundler-0:2021.06-4.module+el8.9.0+19519+e25b965a.noarch::nodejs:20",
            "SUSE Liberty Linux 8:npm-1:10.1.0-1.20.8.1.1.module+el8.9.0+20473+c4e3d824.x86_64::nodejs:20"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-11-14T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2023-45143"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.