CVE-2024-22018

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.(CVE-2024-22018)

A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.(CVE-2024-22020)

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.(CVE-2024-22018)

A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers.(CVE-2024-22020)

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: Bypass network import restriction via data URL (CVE-2024-22020)

• nodejs: fs.lstat bypasses permission model (CVE-2024-22018)

• nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• node-tar: denial of service while parsing a tar file due to lack of folders depth validation (CVE-2024-28863)
• nodejs: Bypass network import restriction via data URL (CVE-2024-22020)
• nodejs: fs.lstat bypasses permission model (CVE-2024-22018)
• nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• nodejs: Bypass network import restriction via data URL (CVE-2024-22020)
• nodejs: fs.lstat bypasses permission model (CVE-2024-22018)
• nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

Nodejs 22 is the new active LTS branch and 5 CVE are fixed. CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High) CVE-2024-22020 - Bypass network import restriction via data URL (Medium) CVE-2024-22018 - fs.lstat bypasses permission model (Low) CVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low) CVE-2024-37372 - Permission model improperly processes UNC paths (Low) yarn package is updated with npm 10.8.2

These are all security issues fixed in the corepack20-20.15.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the corepack22-22.10.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the corepack24-24.11.1-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the nodejs26-26.3.1-1.1 package on the GA media of openSUSE Tumbleweed.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• node-tar: denial of service while parsing a tar file due to lack of folders depth validation (CVE-2024-28863)

• nodejs: Bypass network import restriction via data URL (CVE-2024-22020)

• nodejs: fs.lstat bypasses permission model (CVE-2024-22018)

• nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for nodejs20 fixes the following issues:

Update to 20.15.1:

• CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)
• CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)
• CVE-2024-22018: Fixed fs.lstat bypasses permission model (bsc#1227562)
• CVE-2024-36137: Fixed fs.fchown/fchmod bypasses permission model (bsc#1227561)
• CVE-2024-37372: Fixed Permission model improperly processes UNC paths (bsc#1227563)

Changes in 20.15.0:

• test_runner: support test plans
• inspector: introduce the --inspect-wait flag
• zlib: expose zlib.crc32()
• cli: allow running wasm in limited vmem with --disable-wasm-trap-handler

Changes in 20.14.0

• src,permission: throw async errors on async APIs
• test_runner: support forced exit

Changes in 20.13.1:

• buffer: improve base64 and base64url performance
• crypto: deprecate implicitly shortened GCM tags
• events,doc: mark CustomEvent as stable
• fs: add stacktrace to fs/promises
• report: add --report-exclude-network option
• src: add uv_get_available_memory to report and process
• stream: support typed arrays
• util: support array of formats in util.styleText
• v8: implement v8.queryObjects() for memory leak regression testing
• watch: mark as stable

This update for nodejs20 fixes the following issues:

Update to 20.15.1:

• CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)
• CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)
• CVE-2024-22018: Fixed fs.lstat bypasses permission model (bsc#1227562)
• CVE-2024-36137: Fixed fs.fchown/fchmod bypasses permission model (bsc#1227561)
• CVE-2024-37372: Fixed Permission model improperly processes UNC paths (bsc#1227563)

Changes in 20.15.0:

• test_runner: support test plans
• inspector: introduce the --inspect-wait flag
• zlib: expose zlib.crc32()
• cli: allow running wasm in limited vmem with --disable-wasm-trap-handler

Changes in 20.14.0

• src,permission: throw async errors on async APIs
• test_runner: support forced exit

Changes in 20.13.1:

• buffer: improve base64 and base64url performance
• crypto: deprecate implicitly shortened GCM tags
• events,doc: mark CustomEvent as stable
• fs: add stacktrace to fs/promises
• report: add --report-exclude-network option
• src: add uv_get_available_memory to report and process
• stream: support typed arrays
• util: support array of formats in util.styleText
• v8: implement v8.queryObjects() for memory leak regression testing
• watch: mark as stable