CVE-2021-44906

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Minimist prior to 1.2.6 and 0.2.4 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

This module is the guts of optimist's argument parser without all the fanciful decoration.

Security Fix(es):

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).(CVE-2021-44906)

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages were updated to later upstream versions: nodejs (16.18.1), nodejs-nodemon (2.0.20).

Security Fix(es):

• nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)

• nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)

• nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)

• minimist: prototype pollution (CVE-2021-44906)

• nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)

• nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)

• nodejs: Prototype pollution via console.table properties (CVE-2022-21824)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• nodejs:16/nodejs: Packaged version of undici does not fit with declared version. [Rocky Linux-8] (BZ#2151625)

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (14.21.1), nodejs-nodemon (2.0.20).

Security Fix(es):

• minimist: prototype pollution (CVE-2021-44906)

• node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)

• nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)

• express: "qs" prototype poisoning causes the hang of the node process (CVE-2022-24999)

• nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.18.1), nodejs-nodemon (2.0.20).

Security Fix(es):

• minimist: prototype pollution (CVE-2021-44906)

• nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)

• nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)

• nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• nodejs: Packaged version of undici does not fit with declared version. [Rocky Linux-9] (BZ#2151627)

Root has patched CVE-2021-44906 in the minimist package for Root:npm. Multiple fixed versions available.

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages were updated to later upstream versions: nodejs (16.18.1), nodejs-nodemon (2.0.20).

Security Fix(es):

• nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)
• nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)
• nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)
• minimist: prototype pollution (CVE-2021-44906)
• nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)
• nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)
• nodejs: Prototype pollution via console.table properties (CVE-2022-21824)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• nodejs:16/nodejs: Packaged version of undici does not fit with declared version. [almalinux-8] (BZ#2151625)

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (14.21.1), nodejs-nodemon (2.0.20).

Security Fix(es):

• minimist: prototype pollution (CVE-2021-44906)
• node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)
• nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)
• express: "qs" prototype poisoning causes the hang of the node process (CVE-2022-24999)
• nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (16.18.1), nodejs-nodemon (2.0.20).

Security Fix(es):

• minimist: prototype pollution (CVE-2021-44906)
• nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)
• nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)
• nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• nodejs: Packaged version of undici does not fit with declared version. [almalinux-9] (BZ#2151627)

TuxCare rebuilt minimist to address 2 CVEs. Fixed in 0.0.10-tuxcare.1.

TuxCare rebuilt minimist to address 2 CVEs. Fixed in 1.2.8-tuxcare.1.

TuxCare rebuilt minimist to address 2 CVEs. Fixed in 0.0.8-tuxcare.1.

TuxCare rebuilt minimist to address 2 CVEs. Fixed in 1.2.0-tuxcare.1.

TuxCare rebuilt minimist to address 2 CVEs. Fixed in 0.0.9-tuxcare.1.

TuxCare rebuilt minimist to address 2 CVEs. Fixed in 1.1.3-tuxcare.1.

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95). (CVE-2021-44906)

This update for nodejs14 fixes the following issues:

• CVE-2022-0778: Fixed a infinite loop in BN_mod_sqrt() reachable when parsing certificates (bsc#1196877).
• CVE-2021-44906: Fixed a prototype pollution in node-minimist (bsc#1198247).
• CVE-2021-44907: Fixed a potential Denial of Service vulnerability in node-qs (bsc#1197283).
• CVE-2022-0235: Fixed an exposure of sensitive information to an unauthorized actor in node-fetch (bsc#1194819).

This update for nodejs12 fixes the following issues:

• CVE-2022-0778: Fixed a infinite loop in BN_mod_sqrt() reachable when parsing certificates (bsc#1196877).
• CVE-2021-44906: Fixed a prototype pollution in node-minimist (bsc#1198247).
• CVE-2021-44907: Fixed a potential Denial of Service vulnerability in node-qs (bsc#1197283).
• CVE-2022-0235: Fixed an exposure of sensitive information to an unauthorized actor in node-fetch (bsc#1194819).

This update for nodejs14 fixes the following issues:

• CVE-2022-0778: Fixed a infinite loop in BN_mod_sqrt() reachable when parsing certificates (bsc#1196877).
• CVE-2021-44906: Fixed a prototype pollution in node-minimist (bsc#1198247).
• CVE-2021-44907: Fixed a potential Denial of Service vulnerability in node-qs (bsc#1197283).
• CVE-2022-0235: Fixed an exposure of sensitive information to an unauthorized actor in node-fetch (bsc#1194819).

This update for nodejs12 fixes the following issues:

• CVE-2021-44906: Fixed a prototype pollution in node-minimist (bsc#1198247).
• CVE-2021-44907: Fixed a potential Denial of Service vulnerability in node-qs (bsc#1197283).
• CVE-2022-0235: Fixed an exposure of sensitive information to an unauthorized actor in node-fetch (bsc#1194819).

This update for nodejs8 fixes the following issues:

• CVE-2021-44906: Fixed prototype pollution in npm dependency (bsc#1198247).
• CVE-2021-44907: Fixed insuficient sanitation in npm dependency (bsc#1197283).
• CVE-2022-0235: Fixed passing of cookie data and sensitive headers to different hostnames in node-fetch-npm (bsc#1194819).

This update for nodejs10 fixes the following issues:

• CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe (bsc#1192153).
• CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite (bsc#1191963).
• CVE-2021-32804: Fixed insufficient absolute path sanitization in node-tar allowing arbitrary file creation and overwrite (bsc#1191962).
• CVE-2021-3918: Fixed improper controlled modification of object prototype attributes in json-schema (bsc#1192696).
• CVE-2021-3807: Fixed regular expression denial of service (ReDoS) matching ANSI escape codes in node-ansi-regex (bsc#1192154).
• CVE-2022-21824: Fixed prototype pollution via console.table (bsc#1194514).
• CVE-2021-44906: Fixed prototype pollution in npm dependency (bsc#1198247).
• CVE-2021-44907: Fixed insuficient sanitation in npm dependency (bsc#1197283).
• CVE-2022-0235: Fixed passing of cookie data and sensitive headers to different hostnames in node-fetch-npm (bsc#1194819).

This update fixes the following issues:

inter-server-sync:

• version 0.2.2
  • Parameter --channel-with-children didn't export data (bsc#1199089)
  • Clean rhnchannelcloned table to rebuild hierarchy (bsc#1197400)
• Version 0.2.1
  • Correct sequence in use for table rhnpackagekey(bsc#1197400)
  • Make Docker image export compatible with Suse Manager 4.2
• Version 0.2.0
  • Allow images export and import (os based and Docker)

prometheus-formula:

• Version 0.6.2
  • Allow prometheus-formula only for SUSE systems (bsc#1199149)

salt-netapi-client:

• Improve the hotfix for bsc#1192550 (bsc#1197449):

smdba:

• Don't package egg-info file for Enterprise Linux.

spacecmd:

• Version 4.2.17-1
  • parse boolean paramaters correctly (bsc#1197689)

spacewalk-backend:

• version 4.2.22-1
  • Do not raise error on file:// based DEB repo when looking for alternative Release files (bsc#1199142)
• Version 4.2.21-1
  • Improve parsing deb packages dependencies (bsc#1194594)

spacewalk-certs-tools:

• Version 4.2.16-1
  • Add Salt Bundle support to bootstrap script generator

spacewalk-java:

• version 4.2.38-1
  • Remove unused gson-extras.jar during build
• version 4.2.37-1
  • CVE-2022-31248: User enumeration via weak error message. (bsc#1199629)
• version 4.2.36-1
  • CVE-2022-21952: Unauthenticated remote Denial of Service via resource exhaustion. (bsc#1199512)
• Version 4.2.35-1
  • faster display installable packages list (bsc#1187333)
  • Pass ssh_salt_pre_flight_script and ssh_use_salt_thin parameters to the generated roster files to enable optional Salt Bundle support with Salt SSH
  • Fix reboot time on salt-ssh client(bsc#1197591)
  • detect free products in Alpha and Beta stage and prevent checks on openSUSE products (bsc#1197488)
  • Allow monitoring entitlement for debian 11 and 10
  • Hide private methods in XMLRPC handlers
  • Warning log when hardware refresh result is not serializable
  • Optimize adding new products function (bsc#1193707)

spacewalk-utils:

• Version 4.2.16-1
  • Add Debian 11 repositories

spacewalk-web:

• Version 4.2.27-1
  • increase web page default timeout (bsc#1187333)
  • Add ssh_salt_pre_flight_script and ssh_use_salt_thin parameters to default rhn_web.conf
  • Upgrade minimist to fix CVE-2021-44906
  • susemanager-nodejs-sdk-devel is now provided by spacewalk-web
  • Resolve race conditions in CLM (bsc#1195710)

susemanager:

• version 4.2.32-1
  • Add python3-contextvars and python3-immutables to missing bootstrap repos (bsc#1200606)
• version 4.2.31-1
  • Add python3-gnupg to bootstrap repo definition for Ubuntu 20.04 (bsc#1200212)
• version 4.2.30-1
  • Fix a syntax problem at the bootstrap repository definitions
• Version 4.2.29-1
  • Add Salt Bundle support to mgr-create-bootstrap-repo
  • Enable bootstrapping for Debian 11
  • fix SLE15 bootstrap repo definition (bsc#1197438)
  • Add SLES15SP4 and SUMA Proxy 4.3 to bootstrap repo definitions (bsc#1196702)
  • Add missing dependencies for Salt 3004 into bootstrap repository for SLE15 family (bsc#1198221)

susemanager-doc-indexes:

• Updated Salt version for Server and Proxy to 3004
• Added details to Client Configuration Guide on using Salt Bundle as optional
• Updated saltversion attribute from 3002 to 3004
• In the Administration Guide, documented that monitoring tools are available in SUSE Linux Enterprise 12 and 15 and openSUSE Leap 15, but Grafana is not available on Proxy (bsc#1191143)
• Documented Autoyast installation features in Autoyast section of the Client Configuration Guide
• In Client Configuration Guide document Debian 11 as a supported OS as a client
• In Client Configuration Guide, clarified client upgrade issues
• In Client Configuration Guide, added information about registration of version 12 of SUSE Linux Enterprise clients
• In Client Configuration Guide, mark the applying patches features as supported on Ubuntu
• SLE Micro in Client Configuration Guide: Update version…

This update for release-notes-susemanager, release-notes-susemanager-proxy fixes the following issues:

Release notes for SUSE Manager:

• Update to 4.2.7
  • Salt has been upgraded to 3004 version
  • Enabled salt bundle as optional
  • Debian 11 client support has been added
  • Alertmanager has been upgraded to 0.23.0
  • Node exporter has been upgraded 1.3.0
  • CVEs fixed: CVE-2021-44906, CVE-2022-21952, CVE-2022-31248
  • Bugs mentioned: bsc#1187333, bsc#1191143, bsc#1192550, bsc#1193707, bsc#1194594 bsc#1195710, bsc#1196702, bsc#1197400, bsc#1197438, bsc#1197449 bsc#1197488, bsc#1197591, bsc#1197689, bsc#1198221

Release notes for SUSE Manager proxy:

• Update to 4.2.7
  • Salt has been upgraded to 3004 version
  • Bugs mentioned: bsc#1187333, bsc#1194594, bsc#1195710, bsc#1197689