CVE-2020-15168

Impact

Node Fetch did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure.

For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.

Patches

We released patched versions for both stable and beta channels:

• For v2: 2.6.1
• For v3: 3.0.0-beta.9

Workarounds

None, it is strongly recommended to update as soon as possible.

For more information

If you have any questions or comments about this advisory:

• Open an issue in node-fetch
• Contact one of the core maintainers.

node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.

TuxCare rebuilt node-fetch to address 2 CVEs. Fixed in 2.6.0-tuxcare.1.

TuxCare rebuilt node-fetch to address 2 CVEs. Fixed in 2.1.2-tuxcare.1.

This update fixes the following issues:

bind-formula:

• Temporarily disable dnssec-validation as hotfix for bsc#1177790

grafana-formula:

• Use variable for product name
• Add HA/SAP dashboards
• Add support for system groups in Client Systems dashboard

image-sync-formula:

• Do not use .gz suffix for default initrd symlink
• Keep the old symlink 'initrd.gz' for compatibility

prometheus-exporters-formula:

• Fix empty directory values initialization
• Add systemd collector as default for node_exporters since otherwise some SAP/HA grafana dashboards will be empty
• Disable reverse proxy on default

prometheus-formula:

• Disable Alertmanager clustering (bsc#1178145)
• Use variable for product name

pxe-formula:

• Change default to 'initrd' without .gz suffix

py26-compat-salt:

• Properly validate eauth credentials and tokens on SSH calls made by Salt API (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)

python-susemanager-retail:

• Use name 'initrd' without .gz suffix

salt-netapi-client:

• Version 0.18.0 See: https://github.com/SUSE/salt-netapi-client/releases/tag/v0.18.0

saltboot-formula:

• Allow setting terminal kernel parameters in saltboot formula

spacecmd:

• Python3 fixes for errata in spacecmd (bsc#1169664)
• Added support for i18n of user-facing strings
• Python3 fix for sorted usage (bsc#1167907)

spacewalk-admin:

• Show info message when applying schema upgrade

spacewalk-backend:

• Prevent IntegrityError during mgr-inter-sync execution (bsc#1177235)

spacewalk-branding:

• Enable to switch to multiple webUI theme

spacewalk-client-tools:

• Remove RH references in Python/Ruby localization and use the product name instead

spacewalk-java:

• Use correct eauth module and credentials for Salt SSH calls (bsc#1178319)
• Remove expiration date from ics files (bsc#1177892)
• Execute Salt SSH actions in parallel (bsc#1173199)
• Enable to switch to multiple webUI theme
• Fix action chain resuming when patches updating salt-minion don't cause service to be restarted (bsc#1144447)
• Renaming autoinstall distro didn't change the name of the Cobbler distro (bsc#1175876)
• Fix the links for downloading the binaries in the package details UI (bsc#1176603)
• Allow nightly ISS sync to also cover custom channels
• Fix: reinspecting a container image (bsc#1177092)
• Add power management xmlrpc api
• Remove hostname from /var/lib/salt/.ssh/known_hosts when deleting system (bsc#1176159)
• Log exception trace on fatal Taskomatic startup error
• Fix max password length check at user creation (bsc#1176765)
• Notify about missing libvirt or hypervisor on virtual host
• Redesign maintenance schedule systems table to use paginated data from server
• Fix SP migration after dry run for cloned channels (bsc#1176307)
• Filter not available optional channels out

spacewalk-search:

• Change default maximum memory to 512 MB, preventing OutOfMemoryError

spacewalk-web:

• Enable to switch to multiple webUI theme
• Only refresh the virtual storage list when pool events are received
• Drop node-fetch to fix CVE-2020-15168
• Notify about missing libvirt or hypervisor on virtual host
• Redesign maintenance schedule systems table to use paginated data from server

susemanager:

• Create bootstrap repo should not flush by default (bsc#1175843)
• Improve detection of base channels for products (bsc#1177478)
• Add LTSS PIDs for SLE12SP1, SLE12SP2, SLE12SP3 and SLE12SP4 to the bootstrap definitions as some packages from LTSS are required (bsc#1177524)
• Fix logrotate config
• Add missing packages to ubuntu20.04 bootstrap data (bsc#1176629)

susemanager-build-keys:

• Replace 'SuSE' user-facing references with 'SUSE'

susemanager-doc-indexes:

• Documented zypper autorefresh feature in Upgrade Guide
• Update SP Migration chapter in Client Configuration Guide
• In Client Configuration and Upgrade Guide, add link to valid autoyast upgrade settings
• Move client upgrade related sections from…