CVE-2024-37372

The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.

The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.

Nodejs 22 is the new active LTS branch and 5 CVE are fixed. CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High) CVE-2024-22020 - Bypass network import restriction via data URL (Medium) CVE-2024-22018 - fs.lstat bypasses permission model (Low) CVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low) CVE-2024-37372 - Permission model improperly processes UNC paths (Low) yarn package is updated with npm 10.8.2

These are all security issues fixed in the corepack20-20.15.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the corepack22-22.10.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the corepack24-24.11.1-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the nodejs26-26.3.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for nodejs20 fixes the following issues:

Update to 20.15.1:

• CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)
• CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)
• CVE-2024-22018: Fixed fs.lstat bypasses permission model (bsc#1227562)
• CVE-2024-36137: Fixed fs.fchown/fchmod bypasses permission model (bsc#1227561)
• CVE-2024-37372: Fixed Permission model improperly processes UNC paths (bsc#1227563)

Changes in 20.15.0:

• test_runner: support test plans
• inspector: introduce the --inspect-wait flag
• zlib: expose zlib.crc32()
• cli: allow running wasm in limited vmem with --disable-wasm-trap-handler

Changes in 20.14.0

• src,permission: throw async errors on async APIs
• test_runner: support forced exit

Changes in 20.13.1:

• buffer: improve base64 and base64url performance
• crypto: deprecate implicitly shortened GCM tags
• events,doc: mark CustomEvent as stable
• fs: add stacktrace to fs/promises
• report: add --report-exclude-network option
• src: add uv_get_available_memory to report and process
• stream: support typed arrays
• util: support array of formats in util.styleText
• v8: implement v8.queryObjects() for memory leak regression testing
• watch: mark as stable

This update for nodejs20 fixes the following issues:

Update to 20.15.1:

• CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)
• CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)
• CVE-2024-22018: Fixed fs.lstat bypasses permission model (bsc#1227562)
• CVE-2024-36137: Fixed fs.fchown/fchmod bypasses permission model (bsc#1227561)
• CVE-2024-37372: Fixed Permission model improperly processes UNC paths (bsc#1227563)

Changes in 20.15.0:

• test_runner: support test plans
• inspector: introduce the --inspect-wait flag
• zlib: expose zlib.crc32()
• cli: allow running wasm in limited vmem with --disable-wasm-trap-handler

Changes in 20.14.0

• src,permission: throw async errors on async APIs
• test_runner: support forced exit

Changes in 20.13.1:

• buffer: improve base64 and base64url performance
• crypto: deprecate implicitly shortened GCM tags
• events,doc: mark CustomEvent as stable
• fs: add stacktrace to fs/promises
• report: add --report-exclude-network option
• src: add uv_get_available_memory to report and process
• stream: support typed arrays
• util: support array of formats in util.styleText
• v8: implement v8.queryObjects() for memory leak regression testing
• watch: mark as stable