SUSE SLES15 Security Update : nodejs10 (SUSE-SU-2022:1717-1)

critical Nessus Plugin ID 161258

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1717-1 advisory.

- All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity. (CVE-2021-23343)

- The npm package tar (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary `stat` calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the `node-tar` directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where `node-tar` checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass `node-tar` symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2. (CVE-2021-32803)

- The npm package tar (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. This logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`.
`node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar. (CVE-2021-32804)

- ansi-regex is vulnerable to Inefficient Regular Expression Complexity (CVE-2021-3807)

- json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CVE-2021-3918)

- Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
(CVE-2021-44906)

- ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. (CVE-2021-44907)

- node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor (CVE-2022-0235)

- Due to the formatting logic of the console.table() function it was not safe to allow user controlled input to be passed to the properties parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be __proto__. The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to. (CVE-2022-21824)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected nodejs10, nodejs10-devel, nodejs10-docs and / or npm10 packages.

See Also

https://bugzilla.suse.com/1191962

https://bugzilla.suse.com/1191963

https://bugzilla.suse.com/1192153

https://bugzilla.suse.com/1192154

https://bugzilla.suse.com/1192696

https://bugzilla.suse.com/1194514

https://bugzilla.suse.com/1194819

https://bugzilla.suse.com/1197283

https://bugzilla.suse.com/1198247

http://www.nessus.org/u?fa764554

https://www.suse.com/security/cve/CVE-2021-23343

https://www.suse.com/security/cve/CVE-2021-32803

https://www.suse.com/security/cve/CVE-2021-32804

https://www.suse.com/security/cve/CVE-2021-3807

https://www.suse.com/security/cve/CVE-2021-3918

https://www.suse.com/security/cve/CVE-2021-44906

https://www.suse.com/security/cve/CVE-2021-44907

https://www.suse.com/security/cve/CVE-2022-0235

https://www.suse.com/security/cve/CVE-2022-21824

Plugin Details

Severity: Critical

ID: 161258

File Name: suse_SU-2022-1717-1.nasl

Version: 1.2

Type: local

Agent: unix

Published: 5/18/2022

Updated: 5/18/2022

Supported Sensors: Nessus Agent

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: E:U/RL:OF/RC:C

CVSS Score Source: CVE-2021-44906

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:nodejs10, p-cpe:/a:novell:suse_linux:nodejs10-devel, p-cpe:/a:novell:suse_linux:nodejs10-docs, p-cpe:/a:novell:suse_linux:npm10, cpe:/o:novell:suse_linux:15

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 5/17/2022

Vulnerability Publication Date: 5/4/2021

Reference Information

CVE: CVE-2021-3807, CVE-2021-3918, CVE-2021-23343, CVE-2021-32803, CVE-2021-32804, CVE-2021-44906, CVE-2021-44907, CVE-2022-0235, CVE-2022-21824

SuSE: SUSE-SU-2022:1717-1