{"id":"CVE-2020-15168","aliases":["CLSA-2026-1792449835","CLSA-2026-1793203551","DEBIAN-CVE-2020-15168","EUVD-2020-1335","GHSA-w7rc-rwvf-8q5r","SUSE-SU-2020:3235-1","UBUNTU-CVE-2020-15168"],"status":"published","title":"File size limit bypass in node-fetch","description":"node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.","severity":{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01692,"percentile":0.77402,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-770"],"published":"2020-09-10T17:46:21Z","modified":"2026-10-28T19:45:12Z","fixes":[{"ecosystem":"npm","package":"node-fetch","fixed_in":["3.0.0-beta.9","2.6.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"node-fetch","fixed_in":["2.6.1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-fetch","fixed_in":["2.6.1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-fetch","fixed_in":["2.6.1-2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"node-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0-beta.1"},{"last_affected":"3.0.0-beta.8"},{"fixed":"3.0.0-beta.9"}]}]},{"source":"ghsa","ecosystem":"npm","package":"node-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.6.1"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"node-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0-tuxcare.0"},{"fixed":"2.6.0-tuxcare.1"}]}],"versions":["2.6.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"node-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.2-tuxcare.0"},{"fixed":"2.1.2-tuxcare.1"}]}],"versions":["2.1.2"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"node-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-2"}]}]},{"source":"osv","ecosystem":"npm","package":"node-fetch","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.6.1"}]}]},{"source":"osv","ecosystem":"npm","package":"node-fetch","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0-beta.1"},{"fixed":"3.0.0-beta.9"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"mgr-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.3-2.6.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.8-4.9.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.16-4.11.5"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.7-4.6.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.19-3.9.5"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.1","package":"susemanager-build-keys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.2-3.6.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"bind-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1603299886.60e4bcf-3.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"grafana-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0-3.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"image-sync-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1602150122.f08af0a-3.6.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"prometheus-exporters-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0-3.16.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"prometheus-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.0-3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"pxe-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1602490840.4f32148-3.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"py26-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.10-6.3.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"python-susemanager-retail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1602150122.f08af0a-3.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"salt-netapi-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0-15.7.5"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"saltboot-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1602150122.f08af0a-3.6.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.8-4.9.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-admin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.7-3.6.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.16-4.11.5"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-branding","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.11-3.9.6"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.7-4.6.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.22-3.16.4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-search","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.3-3.3.7"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.19-3.9.5"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.21-3.11.6"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-build-keys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.2-3.6.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-doc-indexes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-11.17.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-11.17.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.15-3.11.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.17-3.13.6"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.3-1","1.7.3-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-fetch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.3-1","1.7.3-2","1.7.3-2ubuntu0.1"]}],"products":[{"vendor":"node-fetch","product":"node-fetch"},{"vendor":"node-fetch_project","product":"node-fetch"}],"references":[{"url":"https://github.com/node-fetch/node-fetch/security/advisories/GHSA-w7rc-rwvf-8q5r","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://www.npmjs.com/package/node-fetch","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15168","tags":["advisory"]},{"url":"https://github.com/node-fetch/node-fetch/commit/2358a6c2563d1730a0cdaccc197c611949f6a334","tags":["web"]},{"url":"https://github.com/node-fetch/node-fetch/commit/eaff0094c4dfdd5b78711a8c4f1b61e33d282072","tags":["web"]},{"url":"https://github.com/advisories/GHSA-w7rc-rwvf-8q5r"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-15168","tags":["advisory"]},{"url":"https://github.com/node-fetch/node-fetch","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203235-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1144447","tags":["report"]},{"url":"https://bugzilla.suse.com/1167907","tags":["report"]},{"url":"https://bugzilla.suse.com/1169664","tags":["report"]},{"url":"https://bugzilla.suse.com/1173199","tags":["report"]},{"url":"https://bugzilla.suse.com/1175843","tags":["report"]},{"url":"https://bugzilla.suse.com/1175876","tags":["report"]},{"url":"https://bugzilla.suse.com/1176159","tags":["report"]},{"url":"https://bugzilla.suse.com/1176307","tags":["report"]},{"url":"https://bugzilla.suse.com/1176413","tags":["report"]},{"url":"https://bugzilla.suse.com/1176603","tags":["report"]},{"url":"https://bugzilla.suse.com/1176629","tags":["report"]},{"url":"https://bugzilla.suse.com/1176765","tags":["report"]},{"url":"https://bugzilla.suse.com/1177092","tags":["report"]},{"url":"https://bugzilla.suse.com/1177235","tags":["report"]},{"url":"https://bugzilla.suse.com/1177396","tags":["report"]},{"url":"https://bugzilla.suse.com/1177478","tags":["report"]},{"url":"https://bugzilla.suse.com/1177524","tags":["report"]},{"url":"https://bugzilla.suse.com/1177730","tags":["report"]},{"url":"https://bugzilla.suse.com/1177790","tags":["report"]},{"url":"https://bugzilla.suse.com/1177892","tags":["report"]},{"url":"https://bugzilla.suse.com/1178060","tags":["report"]},{"url":"https://bugzilla.suse.com/1178145","tags":["report"]},{"url":"https://bugzilla.suse.com/1178204","tags":["report"]},{"url":"https://bugzilla.suse.com/1178319","tags":["report"]},{"url":"https://bugzilla.suse.com/1178361","tags":["report"]},{"url":"https://bugzilla.suse.com/1178362","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25592","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-15168","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15168","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-15168","title":"File size limit bypass in node-fetch","description":"node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.","status":"published","published":"2020-09-10T18:25:13Z","modified":"2024-08-04T13:08:22.463Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-20","CWE-770"],"updated_at":"2026-11-02T14:35:50.228781Z"}],"euvd":[{"id":"EUVD-2020-1335","description":"node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.","status":"published","published":"2020-09-10T18:25:13Z","modified":"2024-08-04T13:08:22Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-03T03:07:32.55679Z"}],"ghsa":[{"id":"GHSA-w7rc-rwvf-8q5r","title":"The `size` option isn't honored after following a redirect in node-fetch","description":"### Impact\nNode Fetch did not honor the `size` option after following a redirect, which means that when a content size was over the limit, a `FetchError` would never get thrown and the process would end without failure.\n\nFor most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after `fetch()` has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.\n\n### Patches\nWe released patched versions for both stable and beta channels:\n\n- For `v2`: 2.6.1\n- For `v3`: 3.0.0-beta.9\n\n### Workarounds\nNone, it is strongly recommended to update as soon as possible.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [node-fetch](https://github.com/node-fetch/node-fetch/issues/new?assignees=\u0026labels=question\u0026template=support-or-usage.md\u0026title=Question%3A+)\n* Contact one of the core maintainers.","status":"published","published":"2020-09-10T17:46:21Z","modified":"2024-07-15T19:46:23Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-20","CWE-770"],"updated_at":"2026-11-02T14:37:56.530214Z"}],"nvd":[{"id":"CVE-2020-15168","description":"node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.","status":"published","published":"2020-09-10T19:15:13.49Z","modified":"2026-06-17T02:56:11.16Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20","CWE-770"],"updated_at":"2026-11-02T14:06:14.981587Z"}],"osv":[{"id":"CVE-2020-15168","description":"node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.","status":"published","published":"2020-09-10T19:15:13.49Z","modified":"2026-10-20T10:51:52.700929648Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"DEBIAN-CVE-2020-15168","description":"node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.","status":"published","published":"2020-09-10T19:15:13.49Z","modified":"2026-10-26T12:00:24.482890562Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"GHSA-w7rc-rwvf-8q5r","title":"The `size` option isn't honored after following a redirect in node-fetch","description":"### Impact\nNode Fetch did not honor the `size` option after following a redirect, which means that when a content size was over the limit, a `FetchError` would never get thrown and the process would end without failure.\n\nFor most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after `fetch()` has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.\n\n### Patches\nWe released patched versions for both stable and beta channels:\n\n- For `v2`: 2.6.1\n- For `v3`: 3.0.0-beta.9\n\n### Workarounds\nNone, it is strongly recommended to update as soon as possible.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [node-fetch](https://github.com/node-fetch/node-fetch/issues/new?assignees=\u0026labels=question\u0026template=support-or-usage.md\u0026title=Question%3A+)\n* Contact one of the core maintainers.","status":"published","published":"2020-09-10T17:46:21Z","modified":"2026-07-08T06:00:29.567074454Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-20","CWE-770"],"updated_at":"2026-11-02T15:46:58.401149Z"},{"id":"UBUNTU-CVE-2020-15168","description":"node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.","status":"published","published":"2020-09-10T19:15:00Z","modified":"2025-10-24T04:48:35Z","cvss":[{"version":"3.1","score":2.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L","level":"low"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"CLSA-2026-1792449835","title":"TuxCare security update for node-fetch (2 CVEs)","description":"TuxCare rebuilt node-fetch to address 2 CVEs. Fixed in 2.6.0-tuxcare.1.","status":"published","published":"2026-10-19T22:43:55Z","modified":"2026-10-20T01:45:16.010142132Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1793203551","title":"TuxCare security update for node-fetch (2 CVEs)","description":"TuxCare rebuilt node-fetch to address 2 CVEs. Fixed in 2.1.2-tuxcare.1.","status":"published","published":"2026-10-28T16:05:51Z","modified":"2026-10-28T19:45:12.035416863Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"SUSE-SU-2020:3235-1","title":"Security update for SUSE Manager Server 4.1","description":"\nThis update fixes the following issues:\n\nbind-formula:\n\n- Temporarily disable dnssec-validation as hotfix for bsc#1177790\n\ngrafana-formula:\n\n- Use variable for product name\n- Add HA/SAP dashboards\n- Add support for system groups in Client Systems dashboard\n\nimage-sync-formula:\n\n- Do not use .gz suffix for default initrd symlink\n- Keep the old symlink 'initrd.gz' for compatibility\n\nprometheus-exporters-formula:\n\n- Fix empty directory values initialization\n- Add systemd collector as default for node_exporters\n  since otherwise some SAP/HA grafana dashboards will be empty\n- Disable reverse proxy on default\n\nprometheus-formula:\n\n- Disable Alertmanager clustering (bsc#1178145)\n- Use variable for product name\n\npxe-formula:\n\n- Change default to 'initrd' without .gz suffix\n\npy26-compat-salt:\n\n- Properly validate eauth credentials and tokens on SSH calls made by Salt API \n  (bsc#1178319, bsc#1178362, bsc#1178361, CVE-2020-25592, CVE-2020-17490, CVE-2020-16846)\n\npython-susemanager-retail:\n\n- Use name 'initrd' without .gz suffix\n\nsalt-netapi-client:\n\n- Version 0.18.0\n  See: https://github.com/SUSE/salt-netapi-client/releases/tag/v0.18.0\n\nsaltboot-formula:\n\n- Allow setting terminal kernel parameters in saltboot formula\n\nspacecmd:\n\n- Python3 fixes for errata in spacecmd (bsc#1169664)\n- Added support for i18n of user-facing strings\n- Python3 fix for sorted usage (bsc#1167907)\n\nspacewalk-admin:\n\n- Show info message when applying schema upgrade\n\nspacewalk-backend:\n\n- Prevent IntegrityError during mgr-inter-sync execution (bsc#1177235)\n\nspacewalk-branding:\n\n- Enable to switch to multiple webUI theme\n\nspacewalk-client-tools:\n\n- Remove RH references in Python/Ruby localization and use the product name instead\n\nspacewalk-java:\n\n- Use correct eauth module and credentials for Salt SSH calls (bsc#1178319)\n- Remove expiration date from ics files (bsc#1177892)\n- Execute Salt SSH actions in parallel (bsc#1173199)\n- Enable to switch to multiple webUI theme\n- Fix action chain resuming when patches updating salt-minion don't cause service to be\n  restarted (bsc#1144447)\n- Renaming autoinstall distro didn't change the name of the Cobbler distro (bsc#1175876)\n- Fix the links for downloading the binaries in the package details UI (bsc#1176603)\n- Allow nightly ISS sync to also cover custom channels\n- Fix: reinspecting a container image (bsc#1177092)\n- Add power management xmlrpc api\n- Remove hostname from /var/lib/salt/.ssh/known_hosts when deleting system (bsc#1176159)\n- Log exception trace on fatal Taskomatic startup error\n- Fix max password length check at user creation (bsc#1176765)\n- Notify about missing libvirt or hypervisor on virtual host\n- Redesign maintenance schedule systems table to use paginated data from server\n- Fix SP migration after dry run for cloned channels (bsc#1176307)\n- Filter not available optional channels out\n\nspacewalk-search:\n\n- Change default maximum memory to 512 MB, preventing OutOfMemoryError\n\nspacewalk-web:\n\n- Enable to switch to multiple webUI theme\n- Only refresh the virtual storage list when pool events are received\n- Drop node-fetch to fix CVE-2020-15168\n- Notify about missing libvirt or hypervisor on virtual host\n- Redesign maintenance schedule systems table to use paginated data from server\n\nsusemanager:\n\n- Create bootstrap repo should not flush by default (bsc#1175843)\n- Improve detection of base channels for products (bsc#1177478)\n- Add LTSS PIDs for SLE12SP1, SLE12SP2, SLE12SP3 and SLE12SP4 to the bootstrap definitions as some packages from LTSS\n   are required (bsc#1177524)\n- Fix logrotate config\n- Add missing packages to ubuntu20.04 bootstrap data (bsc#1176629)\n\nsusemanager-build-keys:\n\n- Replace 'SuSE' user-facing references with 'SUSE'\n\nsusemanager-doc-indexes:\n\n- Documented zypper autorefresh feature in Upgrade Guide\n- Update SP Migration chapter in Client Configuration Guide \n- In Client Configuration and Upgrade Guide, add link to valid autoyast upgrade settings\n- Move client upgrade related sections from Reference and Upgrade Guide to Client Configuration Guide\n- Updated Requirements chapter in Installation Guide.  \n- Edits OpenSCAP section in Admin Guide (bsc#1176413)\n- Updated Terminology section in Salt Guide\n- Added on-demand images content to Install Guide\n- Adds webUI locale choice to Ref \u0026 Admin Guides\n- Adds new System Types section to Client Cfg\n- Updates supported client matrix in Install Guide\n- Add note about log file to Upgrade Guide \n- Removes outdated content from Activation Keys section (bsc#1177396)\n- Adds note about PAM Auth during migration (bsc#1177730)\n- Fixed broken table in admin guide\n\nsusemanager-docs_en:\n\n- Documented zypper autorefresh feature in Upgrade Guide\n- Update SP Migration chapter in Client Configuration Guide\n- In Client Configuration and Upgrade Guide, add link to valid autoyast upgrade settings\n- Move client upgrade related sections from Reference and Upgrade Guide to Client Configuration Guide\n- Updated Requirements chapter in Installation Guide.\n- Edits OpenSCAP section in Admin Guide (bsc#1176413)\n- Updated Terminology section in Salt Guide\n- Added on-demand images content to Install Guide\n- Adds webUI locale choice to Ref \u0026 Admin Guides\n- Adds new System Types section to Client Cfg\n- Updates supported client matrix in Install Guide\n- Add note about log file to Upgrade Guide\n- Removes outdated content from Activation Keys section (bsc#1177396)\n- Adds note about PAM Auth during migration (bsc#1177730)\n- Fixed broken table in admin guide \n\nsusemanager-schema:\n\n- Add web_theme user preferences column (bsc#1178204)\n- Execute Salt SSH actions in parallel (bsc#1173199)\n- Show info message when applying schema upgrade\n\nsusemanager-sls:\n\n- Fix action chain resuming when patches updating salt-minion don't cause service to be restarted (bsc#1144447)\n- Make grub2 autoinstall kernel path relative to the boot partition root (bsc#1175876)\n- Move channel token information from sources.list to auth.conf on Debian 10 and Ubuntu 18 and newer\n- Add support for activation keys on server configuration Salt modules\n- Ensure the yum/dnf plugins are enabled\n- Remove hostname from /var/lib/salt/.ssh/known_hosts when deleting system (bsc#1176159)\n- Fix grub2 autoinstall kernel path (bsc#1178060)\n\nHow to apply this update:\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\nspacewalk-service stop\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Upgrade the database schema:\nspacewalk-schema-upgrade\n5. Start the Spacewalk service:\nspacewalk-service start\n","status":"published","published":"2020-11-06T15:55:37Z","modified":"2026-02-04T04:02:56.224665Z","updated_at":"2026-11-02T15:53:48.11786Z"}]}}