{"id":"SUSE-SU-2024:2496-1","summary":"Security update for nodejs18","details":"This update for nodejs18 fixes the following issues:\n\nUpdate to 18.20.4:\n\n- CVE-2024-36138: Fixed CVE-2024-27980 fix bypass (bsc#1227560)\n- CVE-2024-22020: Fixed a bypass of network import restriction via data URL (bsc#1227554)\n\nChanges in 18.20.3:\n\n- This release fixes a regression introduced in Node.js 18.19.0 where http.server.close() was incorrectly closing idle connections.\n  deps:\n  - acorn updated to 8.11.3.\n  - acorn-walk updated to 8.3.2.\n  - ada updated to 2.7.8.\n  - c-ares updated to 1.28.1.\n  - corepack updated to 0.28.0.\n  - nghttp2 updated to 1.61.0.\n  - ngtcp2 updated to 1.3.0.\n  - npm updated to 10.7.0. Includes a fix from npm@10.5.1 to limit the number of open connections npm/cli#7324.\n  - simdutf updated to 5.2.4.\n\nChanges in 18.20.2:\n\n- CVE-2024-27980: Fixed command injection via args parameter of child_process.spawn without shell option enabled on Windows (bsc#1222665)\n","modified":"2026-03-11T07:28:03.770278Z","published":"2024-07-16T07:33:47Z","related":["CVE-2024-22020","CVE-2024-27980","CVE-2024-36138"],"upstream":["CVE-2024-22020","CVE-2024-27980","CVE-2024-36138"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242496-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1222665"},{"type":"REPORT","url":"https://bugzilla.suse.com/1227554"},{"type":"REPORT","url":"https://bugzilla.suse.com/1227560"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-22020"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-27980"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-36138"}],"affected":[{"package":{"name":"nodejs18","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","purl":"pkg:rpm/suse/nodejs18&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2012"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.20.4-8.24.1"}]}],"ecosystem_specific":{"binaries":[{"nodejs18-docs":"18.20.4-8.24.1","nodejs18":"18.20.4-8.24.1","npm18":"18.20.4-8.24.1","nodejs18-devel":"18.20.4-8.24.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2024:2496-1.json"}}],"schema_version":"1.7.5"}