openSUSE Security Update : nodejs6 (openSUSE-2018-444)

Medium Nessus Plugin ID 109717

Synopsis

The remote openSUSE host is missing a security update.

Description

This update for nodejs6 fixes the following issues :

- Fix some node-gyp permissions

- New upstream LTS release 6.14.1 :

- Security fixes :

+ CVE-2018-7160: Fix for inspector DNS rebinding vulnerability (bsc#1087463)

+ CVE-2018-7158: Fix for 'path' module regular expression denial of service (bsc#1087459)

+ CVE-2018-7159: Reject spaces in HTTP Content-Length header values (bsc#1087453)

- New upstream LTS release 6.13.1 :

- http,tls: better support for IPv6 addresses

- console: added console.count() and console.clear()

- crypto :

+ expose ECDH class

+ added cypto.randomFill() and crypto.randomFillSync()

+ warn on invalid authentication tag length

- deps: upgrade libuv to 1.16.1

- dgram: added socket.setMulticastInterface()

- http: add agent.keepSocketAlive and agent.reuseSocket as to allow overridable keep-alive behavior of Agent

- lib: return this from net.Socket.end()

- module: add builtinModules api that provides list of all builtin modules in Node

- net: return this from getConnections()

- promises: more robust stringification for unhandled rejections

- repl: improve require() autocompletion

- src :

+ add openssl-system-ca-path configure option

+ add --use-bundled-ca --use-openssl-ca check

+ add process.ppid

- tls: accept lookup option for tls.connect()

- tools,build: a new macOS installer!

- url: WHATWG URL api support

- util: add %i and %f formatting specifiers

- remove any old manpage files in %pre from before update-alternatives were used to manage symlinks to these manpages.

- Add Recommends and BuildRequire on python2 for npm.
node-gyp requires this old version of python for now.
This is only needed for binary modules.

- even on recent codestreams there is no binutils gold on s390 only on s390x

- New upstream LTS release 6.12.3 :

- v8: profiler-related fixes

- mostly documentation and test related changes

- Enable CI tests in %check target

This update was imported from the SUSE:SLE-12:Update update project.

Solution

Update the affected nodejs6 packages.

See Also

https://bugzilla.opensuse.org/show_bug.cgi?id=1087453

https://bugzilla.opensuse.org/show_bug.cgi?id=1087459

https://bugzilla.opensuse.org/show_bug.cgi?id=1087463

Plugin Details

Severity: Medium

ID: 109717

File Name: openSUSE-2018-444.nasl

Version: 1.3

Type: local

Agent: unix

Published: 2018/05/11

Updated: 2018/09/04

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS v3.0

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:nodejs6, p-cpe:/a:novell:opensuse:nodejs6-debuginfo, p-cpe:/a:novell:opensuse:nodejs6-debugsource, p-cpe:/a:novell:opensuse:nodejs6-devel, p-cpe:/a:novell:opensuse:npm6, cpe:/o:novell:opensuse:42.3

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu

Patch Publication Date: 2018/05/10

Reference Information

CVE: CVE-2018-7158, CVE-2018-7159, CVE-2018-7160