suse/nodejs12&distro=SUSE Linux Enterprise Module for Web and Scripting 12

Vulnerabilities (66)

• CVE-2022-43548Dec 5, 2022
  affected < 12.22.12-1.57.1fixed 12.22.12-1.57.1

  A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing

• CVE-2022-35256Dec 5, 2022
  affected < 12.22.12-1.54.1fixed 12.22.12-1.54.1

  The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.

• CVE-2022-32215Jul 14, 2022
  affected < 12.22.12-1.51.1fixed 12.22.12-1.51.1

  The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).

• CVE-2022-32214Jul 14, 2022
  affected < 12.22.12-1.51.1fixed 12.22.12-1.51.1

  The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).

• CVE-2022-32213Jul 14, 2022
  affected < 12.22.12-1.51.1fixed 12.22.12-1.51.1

  The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

• CVE-2022-32212Jul 14, 2022
  affected < 12.22.12-1.51.1fixed 12.22.12-1.51.1

  A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding

• CVE-2022-2097Jul 5, 2022
  affected < 12.22.12-1.51.1fixed 12.22.12-1.51.1

  AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in

• CVE-2021-44906Mar 17, 2022
  affected < 12.22.12-1.48.1fixed 12.22.12-1.48.1

  Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

• CVE-2022-0778HigMar 15, 2022
  affected < 12.22.11-1.45.1fixed 12.22.11-1.45.1

  The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curv

• CVE-2021-44533Feb 24, 2022
  affected < 12.22.9-1.38.1fixed 12.22.9-1.38.1

  Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguis

• CVE-2021-44532Feb 24, 2022
  affected < 12.22.9-1.38.1fixed 12.22.9-1.38.1

  Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name

• CVE-2021-44531Feb 24, 2022
  affected < 12.22.9-1.38.1fixed 12.22.9-1.38.1

  Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are o

• CVE-2022-21824Feb 24, 2022
  affected < 12.22.9-1.38.1fixed 12.22.9-1.38.1

  Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The p

• CVE-2022-0235Jan 16, 2022
  affected < 12.22.12-1.48.1fixed 12.22.12-1.48.1

  node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

• CVE-2021-3672Nov 23, 2021
  affected < 12.22.5-1.35.1fixed 12.22.5-1.35.1

  A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality

• CVE-2021-22959Nov 15, 2021
  affected < 12.22.9-1.38.1fixed 12.22.9-1.38.1

  The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6.

• CVE-2021-3918Nov 13, 2021
  affected < 12.22.10-1.42.2fixed 12.22.10-1.42.2

  json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

• CVE-2021-22960Nov 3, 2021
  affected < 12.22.9-1.38.1fixed 12.22.9-1.38.1

  The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions.

• CVE-2021-22930Oct 7, 2021
  affected < 12.22.5-1.35.1fixed 12.22.5-1.35.1

  Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

• CVE-2021-3807Sep 17, 2021
  affected < 12.22.10-1.42.2fixed 12.22.10-1.42.2

  ansi-regex is vulnerable to Inefficient Regular Expression Complexity