SUSE SLES12 Security Update : nodejs14 (SUSE-SU-2022:0114-1)

high Nessus Plugin ID 156805

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0114-1 advisory.

- Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly. (CVE-2021-44531)

- Node.js converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints. (CVE-2021-44532)

- Node.js did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification. (CVE-2021-44533)

- Due to the formatting logic of the console.table() function it was not safe to allow user controlled input to be passed to the properties parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be __proto__. The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.
(CVE-2022-21824)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected nodejs14, nodejs14-devel, nodejs14-docs and / or npm14 packages.

See Also

https://bugzilla.suse.com/1194511

https://bugzilla.suse.com/1194512

https://bugzilla.suse.com/1194513

https://bugzilla.suse.com/1194514

http://www.nessus.org/u?f0edef0e

https://www.suse.com/security/cve/CVE-2021-44531

https://www.suse.com/security/cve/CVE-2021-44532

https://www.suse.com/security/cve/CVE-2021-44533

https://www.suse.com/security/cve/CVE-2022-21824

Plugin Details

Severity: High

ID: 156805

File Name: suse_SU-2022-0114-1.nasl

Version: 1.6

Type: local

Agent: unix

Published: 1/19/2022

Updated: 3/9/2022

Supported Sensors: Nessus Agent

Risk Information

VPR

Risk Factor: Medium

Score: 6

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:P

Temporal Vector: E:U/RL:OF/RC:C

CVSS Score Source: CVE-2022-21824

CVSS v3

Risk Factor: High

Base Score: 8.2

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Temporal Vector: E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:nodejs14, p-cpe:/a:novell:suse_linux:nodejs14-devel, p-cpe:/a:novell:suse_linux:nodejs14-docs, p-cpe:/a:novell:suse_linux:npm14, cpe:/o:novell:suse_linux:12

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 1/18/2022

Vulnerability Publication Date: 1/11/2022

Reference Information

CVE: CVE-2021-44531, CVE-2021-44532, CVE-2021-44533, CVE-2022-21824

SuSE: SUSE-SU-2022:0114-1

IAVB: 2022-B-0002