CVE-2024-36138

Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn / child_process.spawnSync. A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.

Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn / child_process.spawnSync. A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.

Nodejs 22 is the new active LTS branch and 5 CVE are fixed. CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High) CVE-2024-22020 - Bypass network import restriction via data URL (Medium) CVE-2024-22018 - fs.lstat bypasses permission model (Low) CVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low) CVE-2024-37372 - Permission model improperly processes UNC paths (Low) yarn package is updated with npm 10.8.2

These are all security issues fixed in the corepack22-22.10.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the corepack24-24.11.1-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the nodejs26-26.3.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for nodejs18 fixes the following issues:

Update to 18.20.4:

• CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)
• CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)

Changes in 18.20.3:

• This release fixes a regression introduced in Node.js 18.19.0 where http.server.close() was incorrectly closing idle connections. deps:
  • acorn updated to 8.11.3.
  • acorn-walk updated to 8.3.2.
  • ada updated to 2.7.8.
  • c-ares updated to 1.28.1.
  • corepack updated to 0.28.0.
  • nghttp2 updated to 1.61.0.
  • ngtcp2 updated to 1.3.0.
  • npm updated to 10.7.0. Includes a fix from [email protected] to limit the number of open connections npm/cli#7324.
  • simdutf updated to 5.2.4.

Changes in 18.20.2:

• CVE-2024-27980: Fixed command injection via args parameter of child_process.spawn without shell option enabled on Windows (bsc#1222665)

This update for nodejs18 fixes the following issues:

Update to 18.20.4:

• CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)
• CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)

Changes in 18.20.3:

• This release fixes a regression introduced in Node.js 18.19.0 where http.server.close() was incorrectly closing idle connections. deps:
  • acorn updated to 8.11.3.
  • acorn-walk updated to 8.3.2.
  • ada updated to 2.7.8.
  • c-ares updated to 1.28.1.
  • corepack updated to 0.28.0.
  • nghttp2 updated to 1.61.0.
  • ngtcp2 updated to 1.3.0.
  • npm updated to 10.7.0. Includes a fix from [email protected] to limit the number of open connections npm/cli#7324.
  • simdutf updated to 5.2.4.

Changes in 18.20.2:

• CVE-2024-27980: Fixed command injection via args parameter of child_process.spawn without shell option enabled on Windows (bsc#1222665)

This update for nodejs20 fixes the following issues:

Update to 20.15.1:

• CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)
• CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)
• CVE-2024-22018: Fixed fs.lstat bypasses permission model (bsc#1227562)
• CVE-2024-36137: Fixed fs.fchown/fchmod bypasses permission model (bsc#1227561)
• CVE-2024-37372: Fixed Permission model improperly processes UNC paths (bsc#1227563)

Changes in 20.15.0:

• test_runner: support test plans
• inspector: introduce the --inspect-wait flag
• zlib: expose zlib.crc32()
• cli: allow running wasm in limited vmem with --disable-wasm-trap-handler

Changes in 20.14.0

• src,permission: throw async errors on async APIs
• test_runner: support forced exit

Changes in 20.13.1:

• buffer: improve base64 and base64url performance
• crypto: deprecate implicitly shortened GCM tags
• events,doc: mark CustomEvent as stable
• fs: add stacktrace to fs/promises
• report: add --report-exclude-network option
• src: add uv_get_available_memory to report and process
• stream: support typed arrays
• util: support array of formats in util.styleText
• v8: implement v8.queryObjects() for memory leak regression testing
• watch: mark as stable

This update for nodejs20 fixes the following issues:

Update to 20.15.1:

• CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)
• CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)
• CVE-2024-22018: Fixed fs.lstat bypasses permission model (bsc#1227562)
• CVE-2024-36137: Fixed fs.fchown/fchmod bypasses permission model (bsc#1227561)
• CVE-2024-37372: Fixed Permission model improperly processes UNC paths (bsc#1227563)

Changes in 20.15.0:

• test_runner: support test plans
• inspector: introduce the --inspect-wait flag
• zlib: expose zlib.crc32()
• cli: allow running wasm in limited vmem with --disable-wasm-trap-handler

Changes in 20.14.0

• src,permission: throw async errors on async APIs
• test_runner: support forced exit

Changes in 20.13.1:

• buffer: improve base64 and base64url performance
• crypto: deprecate implicitly shortened GCM tags
• events,doc: mark CustomEvent as stable
• fs: add stacktrace to fs/promises
• report: add --report-exclude-network option
• src: add uv_get_available_memory to report and process
• stream: support typed arrays
• util: support array of formats in util.styleText
• v8: implement v8.queryObjects() for memory leak regression testing
• watch: mark as stable