⌘ + K

SUSE-SU-2023:3306-1

Dashboard / Vulnerabilities / SUSE-SU-2023:3306-1

SUSE-SU-2023:3306-1

Published: 14 Aug 2023Last Modified: 4 Feb 2026

Upstream:

Aliases:

Summary: Security update for nodejs14

Details: This update for nodejs14 fixes the following issues: - CVE-2023-32002: Fixed permissions policies bypass via Module._load (bsc#1214150). - CVE-2023-32006: Fixed permissions policies impersonation using module.constructor.createRequire() (bsc#1214156). - CVE-2023-32559: Fixed permissions policies bypass via process.binding (bsc#1214154). - CVE-2023-30581: Fixed mainModule.proto bypass (bsc#1212574). - CVE-2023-30590: Fixed missing DiffieHellman key generation (bsc#1212583). - CVE-2023-30589: Fixed HTTP Request Smuggling via Empty headers separated by CR (bsc#1212582).

References: https://www.suse.com/support/update/announcement/2023/suse-su-20233306-1/, https://bugzilla.suse.com/1212574, https://bugzilla.suse.com/1212582, https://bugzilla.suse.com/1212583, https://bugzilla.suse.com/1214150, https://bugzilla.suse.com/1214154, https://bugzilla.suse.com/1214156, https://www.suse.com/security/cve/CVE-2023-30581, https://www.suse.com/security/cve/CVE-2023-30589, https://www.suse.com/security/cve/CVE-2023-30590, https://www.suse.com/security/cve/CVE-2023-32002, https://www.suse.com/security/cve/CVE-2023-32006, https://www.suse.com/security/cve/CVE-2023-32559

Affected packages

Package

Name: nodejs14

Purl: pkg:rpm/suse/nodejs14&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012

Affected ranges

Type: ECOSYSTEM

Events:

Introduced- 0

Fixed -14.21.3-6.46.1

Affected versions

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High