{
  "document": {
    "acknowledgments": [
      {
        "organization": "Hitachi Energy",
        "summary": "reporting these vulnerabilities to CISA"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
        "title": "CISA Disclaimer"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "summary",
        "text": "Successful exploitation of these vulnerabilities could allow an attacker to eavesdrop on traffic between network source and destination, gain unauthorized access to information, or cause a denial-of-service condition.",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": "Energy",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Switzerland",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "other",
        "text": "No known public exploits specifically target these vulnerabilities.",
        "title": "Exploitability"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-22-111-03 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2022/icsa-22-111-03.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-22-111-03 Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-111-03"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Hitachi Energy MicroSCADA Pro/X SYS600",
    "tracking": {
      "current_release_date": "2022-04-21T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-22-111-03",
      "initial_release_date": "2022-04-21T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2022-04-21T00:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "ICSA-22-111-03 Hitachi Energy MicroSCADA ProX SYS600"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c= 10.1.1",
                "product": {
                  "name": " SYS600: Versions 10.1.1 and prior",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": " SYS600"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=9.4 FP1 | \u003e= 10.2.1",
                "product": {
                  "name": " SYS600: Versions 10.1.1 and prior",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": " SYS600"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003e= 10.0.0 | \u003c= 10.2.1",
                "product": {
                  "name": " SYS600: Versions 10.1.1 and prior",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": " SYS600"
          }
        ],
        "category": "vendor",
        "name": "Hitachi Energy"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-1968",
      "cwe": {
        "id": "CWE-203",
        "name": "Observable Discrepancy"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The Raccoon attack exploits a flaw in the TLS specification that can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. This would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections. Note this vulnerability only impacts DH ciphersuites and not ECDH ciphersuites. This vulnerability affects OpenSSL 1.0.2, which is out of support and no longer receiving public updates. OpenSSL 1.1.1 is not vulnerable to this issue. Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v).CVE-2020-1968 has been assigned to this vulnerability. A CVSS v3 base score of 3.7 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1968"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends users update to Versions 10.3 or later. For obtaining the update users should contact the Hitachi Energy technical support team. If users don\u0027t know who to contact, they should reach the closest Hitachi Energy sales office.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "For more information see Hitachi Energy advisory 8DBD000075",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ],
          "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000075\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-8265",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Node.js versions prior to 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two transfer-encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP request smuggling.CVE-2020-8265 has been assigned to this vulnerability. A CVSS v3 base score of 8.1 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-8265"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends users update to Versions 10.3 or later. For obtaining the update users should contact the Hitachi Energy technical support team. If users don\u0027t know who to contact, they should reach the closest Hitachi Energy sales office.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "For more information see Hitachi Energy advisory 8DBD000075",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ],
          "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000075\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-8287",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Node.js versions prior to 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two transfer-encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP request smuggling.CVE-2020-8287 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-8287"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends users update to Versions 10.3 or later. For obtaining the update users should contact the Hitachi Energy technical support team. If users don\u0027t know who to contact, they should reach the closest Hitachi Energy sales office.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "For more information see Hitachi Energy advisory 8DBD000075",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ],
          "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000075\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-8201",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Node.js \u003c 12.18.4 and \u003c 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack is possible due to a bug in processing of carrier-return symbols in the HTTP header names.CVE-2020-8201 has been assigned to this vulnerability. A CVSS v3 base score of 7.4 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-8201"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends users update to Versions 10.3 or later. For obtaining the update users should contact the Hitachi Energy technical support team. If users don\u0027t know who to contact, they should reach the closest Hitachi Energy sales office.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "For more information see Hitachi Energy advisory 8DBD000075",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ],
          "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000075\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-8252",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The implementation of realpath in libuv \u003c 10.22.1, \u003c 12.18.4, and \u003c 14.9.0 used within Node.js incorrectly determined the buffer size, which can result in a buffer overflow if the resolved path is longer than 256 bytes.CVE-2020-8252 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-8252"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends users update to Versions 10.3 or later. For obtaining the update users should contact the Hitachi Energy technical support team. If users don\u0027t know who to contact, they should reach the closest Hitachi Energy sales office.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "For more information see Hitachi Energy advisory 8DBD000075",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ],
          "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000075\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-8172",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "TLS session reuse can lead to host certificate verification bypass in node version \u003c 12.18.0 and \u003c 14.4.0.CVE-2020-8172 has been assigned to this vulnerability. A CVSS v3 base score of 7.4 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-8172"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends users update to Versions 10.3 or later. For obtaining the update users should contact the Hitachi Energy technical support team. If users don\u0027t know who to contact, they should reach the closest Hitachi Energy sales office.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "For more information see Hitachi Energy advisory 8DBD000075",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ],
          "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000075\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2020-8174",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "notes": [
        {
          "category": "summary",
          "text": "napi_get_value_string_*() allows various kinds of memory corruption in node \u003c 10.21.0, 12.18.0, and \u003c 14.4.0.CVE-2020-8174 has been assigned to this vulnerability. A CVSS v3 base score of 8.1 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-8174"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends users update to Versions 10.3 or later. For obtaining the update users should contact the Hitachi Energy technical support team. If users don\u0027t know who to contact, they should reach the closest Hitachi Energy sales office.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "For more information see Hitachi Energy advisory 8DBD000075",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ],
          "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000075\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-32027",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A vulnerability was found in postgresql in versions prior to 13.3, 12.7, 11.12, 10.17, and 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.CVE-2021-32027 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-32027"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends users update to Versions 10.3 or later. For obtaining the update users should contact the Hitachi Energy technical support team. If users don\u0027t know who to contact, they should reach the closest Hitachi Energy sales office.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "For more information see Hitachi Energy advisory 8DBD000075",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ],
          "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000075\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2021-32028",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.CVE-2021-32028 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-32028"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends users update to Versions 10.3 or later. For obtaining the update users should contact the Hitachi Energy technical support team. If users don\u0027t know who to contact, they should reach the closest Hitachi Energy sales office.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Hitachi Energy recommends security practices and firewall configurations to help protect process control networks from attacks that originate from outside the network. Such practices include physically protecting process control systems from direct access by unauthorized personnel, having no direct connections to the Internet, separating from other networks by means of a firewall system that has a minimal number of ports exposed, and others that must be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "For more information see Hitachi Energy advisory 8DBD000075",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ],
          "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000075\u0026LanguageCode=en\u0026DocumentPartId=\u0026Action=Launch"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        }
      ]
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for nodejs12",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for nodejs12 fixes the following issues:\n\n- New upstream LTS version 12.20.1:\n  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS\n    implementation. When writing to a TLS enabled socket,\n    node::StreamBase::Write calls node::TLSWrap::DoWrite with\n    a freshly allocated WriteWrap object as first argument.\n    If the DoWrite method does not return an error, this object is\n    passed back to the caller as part of a StreamWriteResult structure.\n    This may be exploited to corrupt memory leading to a\n    Denial of Service or potentially other exploits (bsc#1180553)\n  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a\n    header field in a http request. For example, two Transfer-Encoding\n    header fields. In this case Node.js identifies the first header\n    field and ignores the second. This can lead to HTTP Request\n    Smuggling (https://cwe.mitre.org/data/definitions/444.html).\n    (bsc#1180554)\n  * CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference\n    (High) This is a vulnerability in OpenSSL which may be exploited\n    through Node.js. (bsc#1179491)\n\n- New upstream LTS version 12.20.0:\n  * deps:\n    + update llhttp \u00272.1.2\u0027 -\u003e \u00272.1.3\u0027\n    + update uv \u00271.39.0\u0027 -\u003e \u00271.40.0\u0027\n    + update uvwasi \u00270.0.10\u0027 -\u003e \u00270.0.11\u0027\n  * fs: add .ref() and .unref() methods to watcher classes\n  * http: added scheduling option to http agent\n  * module:\n    + exports pattern support\n    + named exports for CJS via static analysis\n  * n-api: add more property defaults (gh#35214)\n\n- New upstream LTS version 12.19.1:\n  * deps: Denial of Service through DNS request (High).\n  A Node.js application that allows an attacker to trigger a DNS\n  request for a host of their choice could trigger a Denial of Service\n  by getting the application to resolve a DNS record with\n  a larger number of responses (bsc#1178882, CVE-2020-8277)\n\n- New upstream LTS version 12.19.0:\n  * crypto: add randomInt function\n  * deps:\n    + upgrade to libuv 1.39.0\n    + deps: upgrade npm to 6.14.7\n    + deps: upgrade to libuv 1.38.1\n  * doc: deprecate process.umask() with no arguments\n  * module:\n    + package \u0027imports\u0027 field\n    + module: deprecate module.parent\n  * n-api: create N-API version 7\n  * zlib: switch to lazy init for zlib streams\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2021-64",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2021_0064-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2021:0064-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EIIX5B6YLG6I6J4WR546EWZU23BNUSV6/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2021:0064-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EIIX5B6YLG6I6J4WR546EWZU23BNUSV6/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178882",
        "url": "https://bugzilla.suse.com/1178882"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179491",
        "url": "https://bugzilla.suse.com/1179491"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1180553",
        "url": "https://bugzilla.suse.com/1180553"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1180554",
        "url": "https://bugzilla.suse.com/1180554"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-1971 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-1971/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8265 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8265/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8277 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8277/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8287 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8287/"
      }
    ],
    "title": "Security update for nodejs12",
    "tracking": {
      "current_release_date": "2021-01-15T09:23:17Z",
      "generator": {
        "date": "2021-01-15T09:23:17Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2021:0064-1",
      "initial_release_date": "2021-01-15T09:23:17Z",
      "revision_history": [
        {
          "date": "2021-01-15T09:23:17Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs12-docs-12.20.1-lp152.3.9.1.noarch",
                "product": {
                  "name": "nodejs12-docs-12.20.1-lp152.3.9.1.noarch",
                  "product_id": "nodejs12-docs-12.20.1-lp152.3.9.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs12-12.20.1-lp152.3.9.1.x86_64",
                "product": {
                  "name": "nodejs12-12.20.1-lp152.3.9.1.x86_64",
                  "product_id": "nodejs12-12.20.1-lp152.3.9.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs12-devel-12.20.1-lp152.3.9.1.x86_64",
                "product": {
                  "name": "nodejs12-devel-12.20.1-lp152.3.9.1.x86_64",
                  "product_id": "nodejs12-devel-12.20.1-lp152.3.9.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "npm12-12.20.1-lp152.3.9.1.x86_64",
                "product": {
                  "name": "npm12-12.20.1-lp152.3.9.1.x86_64",
                  "product_id": "npm12-12.20.1-lp152.3.9.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.2",
                "product": {
                  "name": "openSUSE Leap 15.2",
                  "product_id": "openSUSE Leap 15.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs12-12.20.1-lp152.3.9.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:nodejs12-12.20.1-lp152.3.9.1.x86_64"
        },
        "product_reference": "nodejs12-12.20.1-lp152.3.9.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs12-devel-12.20.1-lp152.3.9.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:nodejs12-devel-12.20.1-lp152.3.9.1.x86_64"
        },
        "product_reference": "nodejs12-devel-12.20.1-lp152.3.9.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs12-docs-12.20.1-lp152.3.9.1.noarch as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:nodejs12-docs-12.20.1-lp152.3.9.1.noarch"
        },
        "product_reference": "nodejs12-docs-12.20.1-lp152.3.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm12-12.20.1-lp152.3.9.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:npm12-12.20.1-lp152.3.9.1.x86_64"
        },
        "product_reference": "npm12-12.20.1-lp152.3.9.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-1971",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-1971"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL\u0027s s_server, s_client and verify tools have support for the \"-crl_download\" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL\u0027s parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nodejs12-12.20.1-lp152.3.9.1.x86_64",
          "openSUSE Leap 15.2:nodejs12-devel-12.20.1-lp152.3.9.1.x86_64",
          "openSUSE Leap 15.2:nodejs12-docs-12.20.1-lp152.3.9.1.noarch",
          "openSUSE Leap 15.2:npm12-12.20.1-lp152.3.9.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-1971",
          "url": "https://www.suse.com/security/cve/CVE-2020-1971"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179491 for CVE-2020-1971",
          "url": "https://bugzilla.suse.com/1179491"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1196179 for CVE-2020-1971",
          "url": "https://bugzilla.suse.com/1196179"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1199303 for CVE-2020-1971",
          "url": "https://bugzilla.suse.com/1199303"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nodejs12-12.20.1-lp152.3.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-devel-12.20.1-lp152.3.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-docs-12.20.1-lp152.3.9.1.noarch",
            "openSUSE Leap 15.2:npm12-12.20.1-lp152.3.9.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:nodejs12-12.20.1-lp152.3.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-devel-12.20.1-lp152.3.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-docs-12.20.1-lp152.3.9.1.noarch",
            "openSUSE Leap 15.2:npm12-12.20.1-lp152.3.9.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-15T09:23:17Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-1971"
    },
    {
      "cve": "CVE-2020-8265",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8265"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nodejs12-12.20.1-lp152.3.9.1.x86_64",
          "openSUSE Leap 15.2:nodejs12-devel-12.20.1-lp152.3.9.1.x86_64",
          "openSUSE Leap 15.2:nodejs12-docs-12.20.1-lp152.3.9.1.noarch",
          "openSUSE Leap 15.2:npm12-12.20.1-lp152.3.9.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8265",
          "url": "https://www.suse.com/security/cve/CVE-2020-8265"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1180553 for CVE-2020-8265",
          "url": "https://bugzilla.suse.com/1180553"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nodejs12-12.20.1-lp152.3.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-devel-12.20.1-lp152.3.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-docs-12.20.1-lp152.3.9.1.noarch",
            "openSUSE Leap 15.2:npm12-12.20.1-lp152.3.9.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:nodejs12-12.20.1-lp152.3.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-devel-12.20.1-lp152.3.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-docs-12.20.1-lp152.3.9.1.noarch",
            "openSUSE Leap 15.2:npm12-12.20.1-lp152.3.9.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-15T09:23:17Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-8265"
    },
    {
      "cve": "CVE-2020-8277",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8277"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions \u003c 15.2.1, \u003c 14.15.1, and \u003c 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nodejs12-12.20.1-lp152.3.9.1.x86_64",
          "openSUSE Leap 15.2:nodejs12-devel-12.20.1-lp152.3.9.1.x86_64",
          "openSUSE Leap 15.2:nodejs12-docs-12.20.1-lp152.3.9.1.noarch",
          "openSUSE Leap 15.2:npm12-12.20.1-lp152.3.9.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8277",
          "url": "https://www.suse.com/security/cve/CVE-2020-8277"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178882 for CVE-2020-8277",
          "url": "https://bugzilla.suse.com/1178882"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nodejs12-12.20.1-lp152.3.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-devel-12.20.1-lp152.3.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-docs-12.20.1-lp152.3.9.1.noarch",
            "openSUSE Leap 15.2:npm12-12.20.1-lp152.3.9.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:nodejs12-12.20.1-lp152.3.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-devel-12.20.1-lp152.3.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-docs-12.20.1-lp152.3.9.1.noarch",
            "openSUSE Leap 15.2:npm12-12.20.1-lp152.3.9.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-15T09:23:17Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-8277"
    },
    {
      "cve": "CVE-2020-8287",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8287"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nodejs12-12.20.1-lp152.3.9.1.x86_64",
          "openSUSE Leap 15.2:nodejs12-devel-12.20.1-lp152.3.9.1.x86_64",
          "openSUSE Leap 15.2:nodejs12-docs-12.20.1-lp152.3.9.1.noarch",
          "openSUSE Leap 15.2:npm12-12.20.1-lp152.3.9.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8287",
          "url": "https://www.suse.com/security/cve/CVE-2020-8287"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1180554 for CVE-2020-8287",
          "url": "https://bugzilla.suse.com/1180554"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nodejs12-12.20.1-lp152.3.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-devel-12.20.1-lp152.3.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-docs-12.20.1-lp152.3.9.1.noarch",
            "openSUSE Leap 15.2:npm12-12.20.1-lp152.3.9.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:nodejs12-12.20.1-lp152.3.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-devel-12.20.1-lp152.3.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs12-docs-12.20.1-lp152.3.9.1.noarch",
            "openSUSE Leap 15.2:npm12-12.20.1-lp152.3.9.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-15T09:23:17Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-8287"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for nodejs10",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for nodejs10 fixes the following issues:\n\n- New upstream LTS version 10.23.1:\n  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS\n    implementation. When writing to a TLS enabled socket,\n    node::StreamBase::Write calls node::TLSWrap::DoWrite with\n    a freshly allocated WriteWrap object as first argument.\n    If the DoWrite method does not return an error, this object is\n    passed back to the caller as part of a StreamWriteResult structure.\n    This may be exploited to corrupt memory leading to a\n    Denial of Service or potentially other exploits (bsc#1180553)\n  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a\n    header field in a http request. For example, two Transfer-Encoding\n    header fields. In this case Node.js identifies the first header\n    field and ignores the second. This can lead to HTTP Request\n    Smuggling (https://cwe.mitre.org/data/definitions/444.html).\n    (bsc#1180554)\n  * CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference\n    (High) This is a vulnerability in OpenSSL which may be exploited\n    through Node.js. (bsc#1179491)\n\n- New upstream LTS version 10.23.0:\n  * deps: upgrade npm to 6.14.8\n  * n-api:\n    + create N-API version 7\n    + expose napi_build_version variable\n\nThis update was imported from the SUSE:SLE-15:Update update project.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2021-65",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2021_0065-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2021:0065-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3MAV3V72VVUTVO6VC6SN5XB5EYX3TJWK/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2021:0065-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3MAV3V72VVUTVO6VC6SN5XB5EYX3TJWK/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179491",
        "url": "https://bugzilla.suse.com/1179491"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1180553",
        "url": "https://bugzilla.suse.com/1180553"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1180554",
        "url": "https://bugzilla.suse.com/1180554"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-1971 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-1971/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8265 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8265/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8287 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8287/"
      }
    ],
    "title": "Security update for nodejs10",
    "tracking": {
      "current_release_date": "2021-01-15T09:23:23Z",
      "generator": {
        "date": "2021-01-15T09:23:23Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2021:0065-1",
      "initial_release_date": "2021-01-15T09:23:23Z",
      "revision_history": [
        {
          "date": "2021-01-15T09:23:23Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs10-10.23.1-lp152.2.9.1.i586",
                "product": {
                  "name": "nodejs10-10.23.1-lp152.2.9.1.i586",
                  "product_id": "nodejs10-10.23.1-lp152.2.9.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs10-devel-10.23.1-lp152.2.9.1.i586",
                "product": {
                  "name": "nodejs10-devel-10.23.1-lp152.2.9.1.i586",
                  "product_id": "nodejs10-devel-10.23.1-lp152.2.9.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "npm10-10.23.1-lp152.2.9.1.i586",
                "product": {
                  "name": "npm10-10.23.1-lp152.2.9.1.i586",
                  "product_id": "npm10-10.23.1-lp152.2.9.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs10-docs-10.23.1-lp152.2.9.1.noarch",
                "product": {
                  "name": "nodejs10-docs-10.23.1-lp152.2.9.1.noarch",
                  "product_id": "nodejs10-docs-10.23.1-lp152.2.9.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs10-10.23.1-lp152.2.9.1.x86_64",
                "product": {
                  "name": "nodejs10-10.23.1-lp152.2.9.1.x86_64",
                  "product_id": "nodejs10-10.23.1-lp152.2.9.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs10-devel-10.23.1-lp152.2.9.1.x86_64",
                "product": {
                  "name": "nodejs10-devel-10.23.1-lp152.2.9.1.x86_64",
                  "product_id": "nodejs10-devel-10.23.1-lp152.2.9.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "npm10-10.23.1-lp152.2.9.1.x86_64",
                "product": {
                  "name": "npm10-10.23.1-lp152.2.9.1.x86_64",
                  "product_id": "npm10-10.23.1-lp152.2.9.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.2",
                "product": {
                  "name": "openSUSE Leap 15.2",
                  "product_id": "openSUSE Leap 15.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs10-10.23.1-lp152.2.9.1.i586 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:nodejs10-10.23.1-lp152.2.9.1.i586"
        },
        "product_reference": "nodejs10-10.23.1-lp152.2.9.1.i586",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs10-10.23.1-lp152.2.9.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:nodejs10-10.23.1-lp152.2.9.1.x86_64"
        },
        "product_reference": "nodejs10-10.23.1-lp152.2.9.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs10-devel-10.23.1-lp152.2.9.1.i586 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:nodejs10-devel-10.23.1-lp152.2.9.1.i586"
        },
        "product_reference": "nodejs10-devel-10.23.1-lp152.2.9.1.i586",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs10-devel-10.23.1-lp152.2.9.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:nodejs10-devel-10.23.1-lp152.2.9.1.x86_64"
        },
        "product_reference": "nodejs10-devel-10.23.1-lp152.2.9.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs10-docs-10.23.1-lp152.2.9.1.noarch as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:nodejs10-docs-10.23.1-lp152.2.9.1.noarch"
        },
        "product_reference": "nodejs10-docs-10.23.1-lp152.2.9.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm10-10.23.1-lp152.2.9.1.i586 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:npm10-10.23.1-lp152.2.9.1.i586"
        },
        "product_reference": "npm10-10.23.1-lp152.2.9.1.i586",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm10-10.23.1-lp152.2.9.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:npm10-10.23.1-lp152.2.9.1.x86_64"
        },
        "product_reference": "npm10-10.23.1-lp152.2.9.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-1971",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-1971"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL\u0027s s_server, s_client and verify tools have support for the \"-crl_download\" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL\u0027s parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nodejs10-10.23.1-lp152.2.9.1.i586",
          "openSUSE Leap 15.2:nodejs10-10.23.1-lp152.2.9.1.x86_64",
          "openSUSE Leap 15.2:nodejs10-devel-10.23.1-lp152.2.9.1.i586",
          "openSUSE Leap 15.2:nodejs10-devel-10.23.1-lp152.2.9.1.x86_64",
          "openSUSE Leap 15.2:nodejs10-docs-10.23.1-lp152.2.9.1.noarch",
          "openSUSE Leap 15.2:npm10-10.23.1-lp152.2.9.1.i586",
          "openSUSE Leap 15.2:npm10-10.23.1-lp152.2.9.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-1971",
          "url": "https://www.suse.com/security/cve/CVE-2020-1971"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179491 for CVE-2020-1971",
          "url": "https://bugzilla.suse.com/1179491"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1196179 for CVE-2020-1971",
          "url": "https://bugzilla.suse.com/1196179"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1199303 for CVE-2020-1971",
          "url": "https://bugzilla.suse.com/1199303"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nodejs10-10.23.1-lp152.2.9.1.i586",
            "openSUSE Leap 15.2:nodejs10-10.23.1-lp152.2.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs10-devel-10.23.1-lp152.2.9.1.i586",
            "openSUSE Leap 15.2:nodejs10-devel-10.23.1-lp152.2.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs10-docs-10.23.1-lp152.2.9.1.noarch",
            "openSUSE Leap 15.2:npm10-10.23.1-lp152.2.9.1.i586",
            "openSUSE Leap 15.2:npm10-10.23.1-lp152.2.9.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:nodejs10-10.23.1-lp152.2.9.1.i586",
            "openSUSE Leap 15.2:nodejs10-10.23.1-lp152.2.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs10-devel-10.23.1-lp152.2.9.1.i586",
            "openSUSE Leap 15.2:nodejs10-devel-10.23.1-lp152.2.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs10-docs-10.23.1-lp152.2.9.1.noarch",
            "openSUSE Leap 15.2:npm10-10.23.1-lp152.2.9.1.i586",
            "openSUSE Leap 15.2:npm10-10.23.1-lp152.2.9.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-15T09:23:23Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-1971"
    },
    {
      "cve": "CVE-2020-8265",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8265"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nodejs10-10.23.1-lp152.2.9.1.i586",
          "openSUSE Leap 15.2:nodejs10-10.23.1-lp152.2.9.1.x86_64",
          "openSUSE Leap 15.2:nodejs10-devel-10.23.1-lp152.2.9.1.i586",
          "openSUSE Leap 15.2:nodejs10-devel-10.23.1-lp152.2.9.1.x86_64",
          "openSUSE Leap 15.2:nodejs10-docs-10.23.1-lp152.2.9.1.noarch",
          "openSUSE Leap 15.2:npm10-10.23.1-lp152.2.9.1.i586",
          "openSUSE Leap 15.2:npm10-10.23.1-lp152.2.9.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8265",
          "url": "https://www.suse.com/security/cve/CVE-2020-8265"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1180553 for CVE-2020-8265",
          "url": "https://bugzilla.suse.com/1180553"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nodejs10-10.23.1-lp152.2.9.1.i586",
            "openSUSE Leap 15.2:nodejs10-10.23.1-lp152.2.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs10-devel-10.23.1-lp152.2.9.1.i586",
            "openSUSE Leap 15.2:nodejs10-devel-10.23.1-lp152.2.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs10-docs-10.23.1-lp152.2.9.1.noarch",
            "openSUSE Leap 15.2:npm10-10.23.1-lp152.2.9.1.i586",
            "openSUSE Leap 15.2:npm10-10.23.1-lp152.2.9.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:nodejs10-10.23.1-lp152.2.9.1.i586",
            "openSUSE Leap 15.2:nodejs10-10.23.1-lp152.2.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs10-devel-10.23.1-lp152.2.9.1.i586",
            "openSUSE Leap 15.2:nodejs10-devel-10.23.1-lp152.2.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs10-docs-10.23.1-lp152.2.9.1.noarch",
            "openSUSE Leap 15.2:npm10-10.23.1-lp152.2.9.1.i586",
            "openSUSE Leap 15.2:npm10-10.23.1-lp152.2.9.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-15T09:23:23Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-8265"
    },
    {
      "cve": "CVE-2020-8287",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8287"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nodejs10-10.23.1-lp152.2.9.1.i586",
          "openSUSE Leap 15.2:nodejs10-10.23.1-lp152.2.9.1.x86_64",
          "openSUSE Leap 15.2:nodejs10-devel-10.23.1-lp152.2.9.1.i586",
          "openSUSE Leap 15.2:nodejs10-devel-10.23.1-lp152.2.9.1.x86_64",
          "openSUSE Leap 15.2:nodejs10-docs-10.23.1-lp152.2.9.1.noarch",
          "openSUSE Leap 15.2:npm10-10.23.1-lp152.2.9.1.i586",
          "openSUSE Leap 15.2:npm10-10.23.1-lp152.2.9.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8287",
          "url": "https://www.suse.com/security/cve/CVE-2020-8287"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1180554 for CVE-2020-8287",
          "url": "https://bugzilla.suse.com/1180554"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nodejs10-10.23.1-lp152.2.9.1.i586",
            "openSUSE Leap 15.2:nodejs10-10.23.1-lp152.2.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs10-devel-10.23.1-lp152.2.9.1.i586",
            "openSUSE Leap 15.2:nodejs10-devel-10.23.1-lp152.2.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs10-docs-10.23.1-lp152.2.9.1.noarch",
            "openSUSE Leap 15.2:npm10-10.23.1-lp152.2.9.1.i586",
            "openSUSE Leap 15.2:npm10-10.23.1-lp152.2.9.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:nodejs10-10.23.1-lp152.2.9.1.i586",
            "openSUSE Leap 15.2:nodejs10-10.23.1-lp152.2.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs10-devel-10.23.1-lp152.2.9.1.i586",
            "openSUSE Leap 15.2:nodejs10-devel-10.23.1-lp152.2.9.1.x86_64",
            "openSUSE Leap 15.2:nodejs10-docs-10.23.1-lp152.2.9.1.noarch",
            "openSUSE Leap 15.2:npm10-10.23.1-lp152.2.9.1.i586",
            "openSUSE Leap 15.2:npm10-10.23.1-lp152.2.9.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-15T09:23:23Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-8287"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for nodejs14",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for nodejs14 fixes the following issues:\n\n- New upstream LTS version 14.15.4:\n  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS\n    implementation. When writing to a TLS enabled socket,\n    node::StreamBase::Write calls node::TLSWrap::DoWrite with\n    a freshly allocated WriteWrap object as first argument.\n    If the DoWrite method does not return an error, this object is\n    passed back to the caller as part of a StreamWriteResult structure.\n    This may be exploited to corrupt memory leading to a\n    Denial of Service or potentially other exploits (bsc#1180553)\n  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a\n    header field in a http request. For example, two Transfer-Encoding\n    header fields. In this case Node.js identifies the first header\n    field and ignores the second. This can lead to HTTP Request\n    Smuggling (https://cwe.mitre.org/data/definitions/444.html).\n    (bsc#1180554)\n\n- New upstream LTS version 14.15.3:\n  * deps:\n    + upgrade npm to 6.14.9\n    + update acorn to v8.0.4\n  * http2: check write not scheduled in scope destructor\n  * stream: fix regression on duplex end\n\n- New upstream LTS version 14.15.1:\n  * deps: Denial of Service through DNS request (High).\n  A Node.js application that allows an attacker to trigger a DNS\n  request for a host of their choice could trigger a Denial of Service\n  by getting the application to resolve a DNS record with\n  a larger number of responses (bsc#1178882, CVE-2020-8277)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2021-66",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2021_0066-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2021:0066-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WYFKSVZAWD7RDU5OST2FANHMDWL4VNM7/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2021:0066-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WYFKSVZAWD7RDU5OST2FANHMDWL4VNM7/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1178882",
        "url": "https://bugzilla.suse.com/1178882"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1180553",
        "url": "https://bugzilla.suse.com/1180553"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1180554",
        "url": "https://bugzilla.suse.com/1180554"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8265 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8265/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8277 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8277/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8287 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8287/"
      }
    ],
    "title": "Security update for nodejs14",
    "tracking": {
      "current_release_date": "2021-01-15T09:23:32Z",
      "generator": {
        "date": "2021-01-15T09:23:32Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2021:0066-1",
      "initial_release_date": "2021-01-15T09:23:32Z",
      "revision_history": [
        {
          "date": "2021-01-15T09:23:32Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs14-docs-14.15.4-lp152.5.1.noarch",
                "product": {
                  "name": "nodejs14-docs-14.15.4-lp152.5.1.noarch",
                  "product_id": "nodejs14-docs-14.15.4-lp152.5.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs14-14.15.4-lp152.5.1.x86_64",
                "product": {
                  "name": "nodejs14-14.15.4-lp152.5.1.x86_64",
                  "product_id": "nodejs14-14.15.4-lp152.5.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs14-devel-14.15.4-lp152.5.1.x86_64",
                "product": {
                  "name": "nodejs14-devel-14.15.4-lp152.5.1.x86_64",
                  "product_id": "nodejs14-devel-14.15.4-lp152.5.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "npm14-14.15.4-lp152.5.1.x86_64",
                "product": {
                  "name": "npm14-14.15.4-lp152.5.1.x86_64",
                  "product_id": "npm14-14.15.4-lp152.5.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.2",
                "product": {
                  "name": "openSUSE Leap 15.2",
                  "product_id": "openSUSE Leap 15.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs14-14.15.4-lp152.5.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:nodejs14-14.15.4-lp152.5.1.x86_64"
        },
        "product_reference": "nodejs14-14.15.4-lp152.5.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs14-devel-14.15.4-lp152.5.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:nodejs14-devel-14.15.4-lp152.5.1.x86_64"
        },
        "product_reference": "nodejs14-devel-14.15.4-lp152.5.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs14-docs-14.15.4-lp152.5.1.noarch as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:nodejs14-docs-14.15.4-lp152.5.1.noarch"
        },
        "product_reference": "nodejs14-docs-14.15.4-lp152.5.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm14-14.15.4-lp152.5.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:npm14-14.15.4-lp152.5.1.x86_64"
        },
        "product_reference": "npm14-14.15.4-lp152.5.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-8265",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8265"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nodejs14-14.15.4-lp152.5.1.x86_64",
          "openSUSE Leap 15.2:nodejs14-devel-14.15.4-lp152.5.1.x86_64",
          "openSUSE Leap 15.2:nodejs14-docs-14.15.4-lp152.5.1.noarch",
          "openSUSE Leap 15.2:npm14-14.15.4-lp152.5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8265",
          "url": "https://www.suse.com/security/cve/CVE-2020-8265"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1180553 for CVE-2020-8265",
          "url": "https://bugzilla.suse.com/1180553"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nodejs14-14.15.4-lp152.5.1.x86_64",
            "openSUSE Leap 15.2:nodejs14-devel-14.15.4-lp152.5.1.x86_64",
            "openSUSE Leap 15.2:nodejs14-docs-14.15.4-lp152.5.1.noarch",
            "openSUSE Leap 15.2:npm14-14.15.4-lp152.5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:nodejs14-14.15.4-lp152.5.1.x86_64",
            "openSUSE Leap 15.2:nodejs14-devel-14.15.4-lp152.5.1.x86_64",
            "openSUSE Leap 15.2:nodejs14-docs-14.15.4-lp152.5.1.noarch",
            "openSUSE Leap 15.2:npm14-14.15.4-lp152.5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-15T09:23:32Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-8265"
    },
    {
      "cve": "CVE-2020-8277",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8277"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions \u003c 15.2.1, \u003c 14.15.1, and \u003c 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nodejs14-14.15.4-lp152.5.1.x86_64",
          "openSUSE Leap 15.2:nodejs14-devel-14.15.4-lp152.5.1.x86_64",
          "openSUSE Leap 15.2:nodejs14-docs-14.15.4-lp152.5.1.noarch",
          "openSUSE Leap 15.2:npm14-14.15.4-lp152.5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8277",
          "url": "https://www.suse.com/security/cve/CVE-2020-8277"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178882 for CVE-2020-8277",
          "url": "https://bugzilla.suse.com/1178882"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nodejs14-14.15.4-lp152.5.1.x86_64",
            "openSUSE Leap 15.2:nodejs14-devel-14.15.4-lp152.5.1.x86_64",
            "openSUSE Leap 15.2:nodejs14-docs-14.15.4-lp152.5.1.noarch",
            "openSUSE Leap 15.2:npm14-14.15.4-lp152.5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:nodejs14-14.15.4-lp152.5.1.x86_64",
            "openSUSE Leap 15.2:nodejs14-devel-14.15.4-lp152.5.1.x86_64",
            "openSUSE Leap 15.2:nodejs14-docs-14.15.4-lp152.5.1.noarch",
            "openSUSE Leap 15.2:npm14-14.15.4-lp152.5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-15T09:23:32Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-8277"
    },
    {
      "cve": "CVE-2020-8287",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8287"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nodejs14-14.15.4-lp152.5.1.x86_64",
          "openSUSE Leap 15.2:nodejs14-devel-14.15.4-lp152.5.1.x86_64",
          "openSUSE Leap 15.2:nodejs14-docs-14.15.4-lp152.5.1.noarch",
          "openSUSE Leap 15.2:npm14-14.15.4-lp152.5.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8287",
          "url": "https://www.suse.com/security/cve/CVE-2020-8287"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1180554 for CVE-2020-8287",
          "url": "https://bugzilla.suse.com/1180554"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nodejs14-14.15.4-lp152.5.1.x86_64",
            "openSUSE Leap 15.2:nodejs14-devel-14.15.4-lp152.5.1.x86_64",
            "openSUSE Leap 15.2:nodejs14-docs-14.15.4-lp152.5.1.noarch",
            "openSUSE Leap 15.2:npm14-14.15.4-lp152.5.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:nodejs14-14.15.4-lp152.5.1.x86_64",
            "openSUSE Leap 15.2:nodejs14-devel-14.15.4-lp152.5.1.x86_64",
            "openSUSE Leap 15.2:nodejs14-docs-14.15.4-lp152.5.1.noarch",
            "openSUSE Leap 15.2:npm14-14.15.4-lp152.5.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-15T09:23:32Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-8287"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for nodejs10",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for nodejs10 fixes the following issues:\n\n- New upstream LTS version 10.23.1:\n  * CVE-2020-8265: use-after-free in TLSWrap (High) bug in TLS\n    implementation. When writing to a TLS enabled socket,\n    node::StreamBase::Write calls node::TLSWrap::DoWrite with\n    a freshly allocated WriteWrap object as first argument.\n    If the DoWrite method does not return an error, this object is\n    passed back to the caller as part of a StreamWriteResult structure.\n    This may be exploited to corrupt memory leading to a\n    Denial of Service or potentially other exploits (bsc#1180553)\n  * CVE-2020-8287: HTTP Request Smuggling allow two copies of a\n    header field in a http request. For example, two Transfer-Encoding\n    header fields. In this case Node.js identifies the first header\n    field and ignores the second. This can lead to HTTP Request\n    Smuggling (https://cwe.mitre.org/data/definitions/444.html).\n    (bsc#1180554)\n  * CVE-2020-1971: OpenSSL - EDIPARTYNAME NULL pointer de-reference\n    (High) This is a vulnerability in OpenSSL which may be exploited\n    through Node.js. (bsc#1179491)\n\n- New upstream LTS version 10.23.0:\n  * deps: upgrade npm to 6.14.8\n  * n-api:\n    + create N-API version 7\n    + expose napi_build_version variable\n\nThis update was imported from the SUSE:SLE-15:Update update project.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2021-82",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2021_0082-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2021:0082-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JQ2RC7AEXMLHMCFO7K3XLJO5WMPQXS7V/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2021:0082-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JQ2RC7AEXMLHMCFO7K3XLJO5WMPQXS7V/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179491",
        "url": "https://bugzilla.suse.com/1179491"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1180553",
        "url": "https://bugzilla.suse.com/1180553"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1180554",
        "url": "https://bugzilla.suse.com/1180554"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-1971 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-1971/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8265 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8265/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8287 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8287/"
      }
    ],
    "title": "Security update for nodejs10",
    "tracking": {
      "current_release_date": "2021-01-16T11:24:40Z",
      "generator": {
        "date": "2021-01-16T11:24:40Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2021:0082-1",
      "initial_release_date": "2021-01-16T11:24:40Z",
      "revision_history": [
        {
          "date": "2021-01-16T11:24:40Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs10-10.23.1-lp151.2.15.1.i586",
                "product": {
                  "name": "nodejs10-10.23.1-lp151.2.15.1.i586",
                  "product_id": "nodejs10-10.23.1-lp151.2.15.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs10-devel-10.23.1-lp151.2.15.1.i586",
                "product": {
                  "name": "nodejs10-devel-10.23.1-lp151.2.15.1.i586",
                  "product_id": "nodejs10-devel-10.23.1-lp151.2.15.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "npm10-10.23.1-lp151.2.15.1.i586",
                "product": {
                  "name": "npm10-10.23.1-lp151.2.15.1.i586",
                  "product_id": "npm10-10.23.1-lp151.2.15.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs10-docs-10.23.1-lp151.2.15.1.noarch",
                "product": {
                  "name": "nodejs10-docs-10.23.1-lp151.2.15.1.noarch",
                  "product_id": "nodejs10-docs-10.23.1-lp151.2.15.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs10-10.23.1-lp151.2.15.1.x86_64",
                "product": {
                  "name": "nodejs10-10.23.1-lp151.2.15.1.x86_64",
                  "product_id": "nodejs10-10.23.1-lp151.2.15.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs10-devel-10.23.1-lp151.2.15.1.x86_64",
                "product": {
                  "name": "nodejs10-devel-10.23.1-lp151.2.15.1.x86_64",
                  "product_id": "nodejs10-devel-10.23.1-lp151.2.15.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "npm10-10.23.1-lp151.2.15.1.x86_64",
                "product": {
                  "name": "npm10-10.23.1-lp151.2.15.1.x86_64",
                  "product_id": "npm10-10.23.1-lp151.2.15.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.1",
                "product": {
                  "name": "openSUSE Leap 15.1",
                  "product_id": "openSUSE Leap 15.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs10-10.23.1-lp151.2.15.1.i586 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:nodejs10-10.23.1-lp151.2.15.1.i586"
        },
        "product_reference": "nodejs10-10.23.1-lp151.2.15.1.i586",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs10-10.23.1-lp151.2.15.1.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:nodejs10-10.23.1-lp151.2.15.1.x86_64"
        },
        "product_reference": "nodejs10-10.23.1-lp151.2.15.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs10-devel-10.23.1-lp151.2.15.1.i586 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:nodejs10-devel-10.23.1-lp151.2.15.1.i586"
        },
        "product_reference": "nodejs10-devel-10.23.1-lp151.2.15.1.i586",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs10-devel-10.23.1-lp151.2.15.1.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:nodejs10-devel-10.23.1-lp151.2.15.1.x86_64"
        },
        "product_reference": "nodejs10-devel-10.23.1-lp151.2.15.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs10-docs-10.23.1-lp151.2.15.1.noarch as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:nodejs10-docs-10.23.1-lp151.2.15.1.noarch"
        },
        "product_reference": "nodejs10-docs-10.23.1-lp151.2.15.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm10-10.23.1-lp151.2.15.1.i586 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:npm10-10.23.1-lp151.2.15.1.i586"
        },
        "product_reference": "npm10-10.23.1-lp151.2.15.1.i586",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm10-10.23.1-lp151.2.15.1.x86_64 as component of openSUSE Leap 15.1",
          "product_id": "openSUSE Leap 15.1:npm10-10.23.1-lp151.2.15.1.x86_64"
        },
        "product_reference": "npm10-10.23.1-lp151.2.15.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-1971",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-1971"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL\u0027s s_server, s_client and verify tools have support for the \"-crl_download\" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL\u0027s parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:nodejs10-10.23.1-lp151.2.15.1.i586",
          "openSUSE Leap 15.1:nodejs10-10.23.1-lp151.2.15.1.x86_64",
          "openSUSE Leap 15.1:nodejs10-devel-10.23.1-lp151.2.15.1.i586",
          "openSUSE Leap 15.1:nodejs10-devel-10.23.1-lp151.2.15.1.x86_64",
          "openSUSE Leap 15.1:nodejs10-docs-10.23.1-lp151.2.15.1.noarch",
          "openSUSE Leap 15.1:npm10-10.23.1-lp151.2.15.1.i586",
          "openSUSE Leap 15.1:npm10-10.23.1-lp151.2.15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-1971",
          "url": "https://www.suse.com/security/cve/CVE-2020-1971"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179491 for CVE-2020-1971",
          "url": "https://bugzilla.suse.com/1179491"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1196179 for CVE-2020-1971",
          "url": "https://bugzilla.suse.com/1196179"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1199303 for CVE-2020-1971",
          "url": "https://bugzilla.suse.com/1199303"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:nodejs10-10.23.1-lp151.2.15.1.i586",
            "openSUSE Leap 15.1:nodejs10-10.23.1-lp151.2.15.1.x86_64",
            "openSUSE Leap 15.1:nodejs10-devel-10.23.1-lp151.2.15.1.i586",
            "openSUSE Leap 15.1:nodejs10-devel-10.23.1-lp151.2.15.1.x86_64",
            "openSUSE Leap 15.1:nodejs10-docs-10.23.1-lp151.2.15.1.noarch",
            "openSUSE Leap 15.1:npm10-10.23.1-lp151.2.15.1.i586",
            "openSUSE Leap 15.1:npm10-10.23.1-lp151.2.15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.1:nodejs10-10.23.1-lp151.2.15.1.i586",
            "openSUSE Leap 15.1:nodejs10-10.23.1-lp151.2.15.1.x86_64",
            "openSUSE Leap 15.1:nodejs10-devel-10.23.1-lp151.2.15.1.i586",
            "openSUSE Leap 15.1:nodejs10-devel-10.23.1-lp151.2.15.1.x86_64",
            "openSUSE Leap 15.1:nodejs10-docs-10.23.1-lp151.2.15.1.noarch",
            "openSUSE Leap 15.1:npm10-10.23.1-lp151.2.15.1.i586",
            "openSUSE Leap 15.1:npm10-10.23.1-lp151.2.15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-16T11:24:40Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-1971"
    },
    {
      "cve": "CVE-2020-8265",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8265"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:nodejs10-10.23.1-lp151.2.15.1.i586",
          "openSUSE Leap 15.1:nodejs10-10.23.1-lp151.2.15.1.x86_64",
          "openSUSE Leap 15.1:nodejs10-devel-10.23.1-lp151.2.15.1.i586",
          "openSUSE Leap 15.1:nodejs10-devel-10.23.1-lp151.2.15.1.x86_64",
          "openSUSE Leap 15.1:nodejs10-docs-10.23.1-lp151.2.15.1.noarch",
          "openSUSE Leap 15.1:npm10-10.23.1-lp151.2.15.1.i586",
          "openSUSE Leap 15.1:npm10-10.23.1-lp151.2.15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8265",
          "url": "https://www.suse.com/security/cve/CVE-2020-8265"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1180553 for CVE-2020-8265",
          "url": "https://bugzilla.suse.com/1180553"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:nodejs10-10.23.1-lp151.2.15.1.i586",
            "openSUSE Leap 15.1:nodejs10-10.23.1-lp151.2.15.1.x86_64",
            "openSUSE Leap 15.1:nodejs10-devel-10.23.1-lp151.2.15.1.i586",
            "openSUSE Leap 15.1:nodejs10-devel-10.23.1-lp151.2.15.1.x86_64",
            "openSUSE Leap 15.1:nodejs10-docs-10.23.1-lp151.2.15.1.noarch",
            "openSUSE Leap 15.1:npm10-10.23.1-lp151.2.15.1.i586",
            "openSUSE Leap 15.1:npm10-10.23.1-lp151.2.15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.1:nodejs10-10.23.1-lp151.2.15.1.i586",
            "openSUSE Leap 15.1:nodejs10-10.23.1-lp151.2.15.1.x86_64",
            "openSUSE Leap 15.1:nodejs10-devel-10.23.1-lp151.2.15.1.i586",
            "openSUSE Leap 15.1:nodejs10-devel-10.23.1-lp151.2.15.1.x86_64",
            "openSUSE Leap 15.1:nodejs10-docs-10.23.1-lp151.2.15.1.noarch",
            "openSUSE Leap 15.1:npm10-10.23.1-lp151.2.15.1.i586",
            "openSUSE Leap 15.1:npm10-10.23.1-lp151.2.15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-16T11:24:40Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-8265"
    },
    {
      "cve": "CVE-2020-8287",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8287"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.1:nodejs10-10.23.1-lp151.2.15.1.i586",
          "openSUSE Leap 15.1:nodejs10-10.23.1-lp151.2.15.1.x86_64",
          "openSUSE Leap 15.1:nodejs10-devel-10.23.1-lp151.2.15.1.i586",
          "openSUSE Leap 15.1:nodejs10-devel-10.23.1-lp151.2.15.1.x86_64",
          "openSUSE Leap 15.1:nodejs10-docs-10.23.1-lp151.2.15.1.noarch",
          "openSUSE Leap 15.1:npm10-10.23.1-lp151.2.15.1.i586",
          "openSUSE Leap 15.1:npm10-10.23.1-lp151.2.15.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8287",
          "url": "https://www.suse.com/security/cve/CVE-2020-8287"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1180554 for CVE-2020-8287",
          "url": "https://bugzilla.suse.com/1180554"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.1:nodejs10-10.23.1-lp151.2.15.1.i586",
            "openSUSE Leap 15.1:nodejs10-10.23.1-lp151.2.15.1.x86_64",
            "openSUSE Leap 15.1:nodejs10-devel-10.23.1-lp151.2.15.1.i586",
            "openSUSE Leap 15.1:nodejs10-devel-10.23.1-lp151.2.15.1.x86_64",
            "openSUSE Leap 15.1:nodejs10-docs-10.23.1-lp151.2.15.1.noarch",
            "openSUSE Leap 15.1:npm10-10.23.1-lp151.2.15.1.i586",
            "openSUSE Leap 15.1:npm10-10.23.1-lp151.2.15.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.1:nodejs10-10.23.1-lp151.2.15.1.i586",
            "openSUSE Leap 15.1:nodejs10-10.23.1-lp151.2.15.1.x86_64",
            "openSUSE Leap 15.1:nodejs10-devel-10.23.1-lp151.2.15.1.i586",
            "openSUSE Leap 15.1:nodejs10-devel-10.23.1-lp151.2.15.1.x86_64",
            "openSUSE Leap 15.1:nodejs10-docs-10.23.1-lp151.2.15.1.noarch",
            "openSUSE Leap 15.1:npm10-10.23.1-lp151.2.15.1.i586",
            "openSUSE Leap 15.1:npm10-10.23.1-lp151.2.15.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-16T11:24:40Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-8287"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for nodejs8",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for nodejs8 fixes the following issue:\n\n- CVE-2020-8287: Fixed an HTTP request smuggling vulnerability (bsc#1180554).\n\nThis update was imported from the SUSE:SLE-15:Update update project.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2021-195",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2021_0195-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2021:0195-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FBRCEZ5AUMB5RCV3OQ3WB7MSZEL755XF/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2021:0195-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FBRCEZ5AUMB5RCV3OQ3WB7MSZEL755XF/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1180554",
        "url": "https://bugzilla.suse.com/1180554"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8287 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8287/"
      }
    ],
    "title": "Security update for nodejs8",
    "tracking": {
      "current_release_date": "2021-01-30T05:13:16Z",
      "generator": {
        "date": "2021-01-30T05:13:16Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2021:0195-1",
      "initial_release_date": "2021-01-30T05:13:16Z",
      "revision_history": [
        {
          "date": "2021-01-30T05:13:16Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs8-8.17.0-lp152.3.8.1.i586",
                "product": {
                  "name": "nodejs8-8.17.0-lp152.3.8.1.i586",
                  "product_id": "nodejs8-8.17.0-lp152.3.8.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs8-devel-8.17.0-lp152.3.8.1.i586",
                "product": {
                  "name": "nodejs8-devel-8.17.0-lp152.3.8.1.i586",
                  "product_id": "nodejs8-devel-8.17.0-lp152.3.8.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "npm8-8.17.0-lp152.3.8.1.i586",
                "product": {
                  "name": "npm8-8.17.0-lp152.3.8.1.i586",
                  "product_id": "npm8-8.17.0-lp152.3.8.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs8-docs-8.17.0-lp152.3.8.1.noarch",
                "product": {
                  "name": "nodejs8-docs-8.17.0-lp152.3.8.1.noarch",
                  "product_id": "nodejs8-docs-8.17.0-lp152.3.8.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs8-8.17.0-lp152.3.8.1.x86_64",
                "product": {
                  "name": "nodejs8-8.17.0-lp152.3.8.1.x86_64",
                  "product_id": "nodejs8-8.17.0-lp152.3.8.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs8-devel-8.17.0-lp152.3.8.1.x86_64",
                "product": {
                  "name": "nodejs8-devel-8.17.0-lp152.3.8.1.x86_64",
                  "product_id": "nodejs8-devel-8.17.0-lp152.3.8.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "npm8-8.17.0-lp152.3.8.1.x86_64",
                "product": {
                  "name": "npm8-8.17.0-lp152.3.8.1.x86_64",
                  "product_id": "npm8-8.17.0-lp152.3.8.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.2",
                "product": {
                  "name": "openSUSE Leap 15.2",
                  "product_id": "openSUSE Leap 15.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs8-8.17.0-lp152.3.8.1.i586 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:nodejs8-8.17.0-lp152.3.8.1.i586"
        },
        "product_reference": "nodejs8-8.17.0-lp152.3.8.1.i586",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs8-8.17.0-lp152.3.8.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:nodejs8-8.17.0-lp152.3.8.1.x86_64"
        },
        "product_reference": "nodejs8-8.17.0-lp152.3.8.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs8-devel-8.17.0-lp152.3.8.1.i586 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:nodejs8-devel-8.17.0-lp152.3.8.1.i586"
        },
        "product_reference": "nodejs8-devel-8.17.0-lp152.3.8.1.i586",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs8-devel-8.17.0-lp152.3.8.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:nodejs8-devel-8.17.0-lp152.3.8.1.x86_64"
        },
        "product_reference": "nodejs8-devel-8.17.0-lp152.3.8.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs8-docs-8.17.0-lp152.3.8.1.noarch as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:nodejs8-docs-8.17.0-lp152.3.8.1.noarch"
        },
        "product_reference": "nodejs8-docs-8.17.0-lp152.3.8.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm8-8.17.0-lp152.3.8.1.i586 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:npm8-8.17.0-lp152.3.8.1.i586"
        },
        "product_reference": "npm8-8.17.0-lp152.3.8.1.i586",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm8-8.17.0-lp152.3.8.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:npm8-8.17.0-lp152.3.8.1.x86_64"
        },
        "product_reference": "npm8-8.17.0-lp152.3.8.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-8287",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8287"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:nodejs8-8.17.0-lp152.3.8.1.i586",
          "openSUSE Leap 15.2:nodejs8-8.17.0-lp152.3.8.1.x86_64",
          "openSUSE Leap 15.2:nodejs8-devel-8.17.0-lp152.3.8.1.i586",
          "openSUSE Leap 15.2:nodejs8-devel-8.17.0-lp152.3.8.1.x86_64",
          "openSUSE Leap 15.2:nodejs8-docs-8.17.0-lp152.3.8.1.noarch",
          "openSUSE Leap 15.2:npm8-8.17.0-lp152.3.8.1.i586",
          "openSUSE Leap 15.2:npm8-8.17.0-lp152.3.8.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8287",
          "url": "https://www.suse.com/security/cve/CVE-2020-8287"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1180554 for CVE-2020-8287",
          "url": "https://bugzilla.suse.com/1180554"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:nodejs8-8.17.0-lp152.3.8.1.i586",
            "openSUSE Leap 15.2:nodejs8-8.17.0-lp152.3.8.1.x86_64",
            "openSUSE Leap 15.2:nodejs8-devel-8.17.0-lp152.3.8.1.i586",
            "openSUSE Leap 15.2:nodejs8-devel-8.17.0-lp152.3.8.1.x86_64",
            "openSUSE Leap 15.2:nodejs8-docs-8.17.0-lp152.3.8.1.noarch",
            "openSUSE Leap 15.2:npm8-8.17.0-lp152.3.8.1.i586",
            "openSUSE Leap 15.2:npm8-8.17.0-lp152.3.8.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:nodejs8-8.17.0-lp152.3.8.1.i586",
            "openSUSE Leap 15.2:nodejs8-8.17.0-lp152.3.8.1.x86_64",
            "openSUSE Leap 15.2:nodejs8-devel-8.17.0-lp152.3.8.1.i586",
            "openSUSE Leap 15.2:nodejs8-devel-8.17.0-lp152.3.8.1.x86_64",
            "openSUSE Leap 15.2:nodejs8-docs-8.17.0-lp152.3.8.1.noarch",
            "openSUSE Leap 15.2:npm8-8.17.0-lp152.3.8.1.i586",
            "openSUSE Leap 15.2:npm8-8.17.0-lp152.3.8.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-01-30T05:13:16Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-8287"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "nodejs14-14.17.5-1.2 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the nodejs14-14.17.5-1.2 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-11096",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11096-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-11080 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-11080/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-15095 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-15095/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-7774 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-7774/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8172 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8172/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8174 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8174/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8201 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8201/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8251 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8251/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8265 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8265/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8277 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8277/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-8287 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-8287/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-21148 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-21148/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-22883 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-22883/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-22884 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-22884/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-22918 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-22918/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-22930 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-22930/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-22939 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-22939/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-22940 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-22940/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-27290 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-27290/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-3672 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-3672/"
      }
    ],
    "title": "nodejs14-14.17.5-1.2 on GA media",
    "tracking": {
      "current_release_date": "2024-06-15T00:00:00Z",
      "generator": {
        "date": "2024-06-15T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:11096-1",
      "initial_release_date": "2024-06-15T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-06-15T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs14-14.17.5-1.2.aarch64",
                "product": {
                  "name": "nodejs14-14.17.5-1.2.aarch64",
                  "product_id": "nodejs14-14.17.5-1.2.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs14-devel-14.17.5-1.2.aarch64",
                "product": {
                  "name": "nodejs14-devel-14.17.5-1.2.aarch64",
                  "product_id": "nodejs14-devel-14.17.5-1.2.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs14-docs-14.17.5-1.2.aarch64",
                "product": {
                  "name": "nodejs14-docs-14.17.5-1.2.aarch64",
                  "product_id": "nodejs14-docs-14.17.5-1.2.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "npm14-14.17.5-1.2.aarch64",
                "product": {
                  "name": "npm14-14.17.5-1.2.aarch64",
                  "product_id": "npm14-14.17.5-1.2.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs14-14.17.5-1.2.ppc64le",
                "product": {
                  "name": "nodejs14-14.17.5-1.2.ppc64le",
                  "product_id": "nodejs14-14.17.5-1.2.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs14-devel-14.17.5-1.2.ppc64le",
                "product": {
                  "name": "nodejs14-devel-14.17.5-1.2.ppc64le",
                  "product_id": "nodejs14-devel-14.17.5-1.2.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs14-docs-14.17.5-1.2.ppc64le",
                "product": {
                  "name": "nodejs14-docs-14.17.5-1.2.ppc64le",
                  "product_id": "nodejs14-docs-14.17.5-1.2.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "npm14-14.17.5-1.2.ppc64le",
                "product": {
                  "name": "npm14-14.17.5-1.2.ppc64le",
                  "product_id": "npm14-14.17.5-1.2.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs14-14.17.5-1.2.s390x",
                "product": {
                  "name": "nodejs14-14.17.5-1.2.s390x",
                  "product_id": "nodejs14-14.17.5-1.2.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs14-devel-14.17.5-1.2.s390x",
                "product": {
                  "name": "nodejs14-devel-14.17.5-1.2.s390x",
                  "product_id": "nodejs14-devel-14.17.5-1.2.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs14-docs-14.17.5-1.2.s390x",
                "product": {
                  "name": "nodejs14-docs-14.17.5-1.2.s390x",
                  "product_id": "nodejs14-docs-14.17.5-1.2.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "npm14-14.17.5-1.2.s390x",
                "product": {
                  "name": "npm14-14.17.5-1.2.s390x",
                  "product_id": "npm14-14.17.5-1.2.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs14-14.17.5-1.2.x86_64",
                "product": {
                  "name": "nodejs14-14.17.5-1.2.x86_64",
                  "product_id": "nodejs14-14.17.5-1.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs14-devel-14.17.5-1.2.x86_64",
                "product": {
                  "name": "nodejs14-devel-14.17.5-1.2.x86_64",
                  "product_id": "nodejs14-devel-14.17.5-1.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "nodejs14-docs-14.17.5-1.2.x86_64",
                "product": {
                  "name": "nodejs14-docs-14.17.5-1.2.x86_64",
                  "product_id": "nodejs14-docs-14.17.5-1.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "npm14-14.17.5-1.2.x86_64",
                "product": {
                  "name": "npm14-14.17.5-1.2.x86_64",
                  "product_id": "npm14-14.17.5-1.2.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs14-14.17.5-1.2.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64"
        },
        "product_reference": "nodejs14-14.17.5-1.2.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs14-14.17.5-1.2.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le"
        },
        "product_reference": "nodejs14-14.17.5-1.2.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs14-14.17.5-1.2.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x"
        },
        "product_reference": "nodejs14-14.17.5-1.2.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs14-14.17.5-1.2.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64"
        },
        "product_reference": "nodejs14-14.17.5-1.2.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs14-devel-14.17.5-1.2.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64"
        },
        "product_reference": "nodejs14-devel-14.17.5-1.2.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs14-devel-14.17.5-1.2.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le"
        },
        "product_reference": "nodejs14-devel-14.17.5-1.2.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs14-devel-14.17.5-1.2.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x"
        },
        "product_reference": "nodejs14-devel-14.17.5-1.2.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs14-devel-14.17.5-1.2.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64"
        },
        "product_reference": "nodejs14-devel-14.17.5-1.2.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs14-docs-14.17.5-1.2.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64"
        },
        "product_reference": "nodejs14-docs-14.17.5-1.2.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs14-docs-14.17.5-1.2.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le"
        },
        "product_reference": "nodejs14-docs-14.17.5-1.2.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs14-docs-14.17.5-1.2.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x"
        },
        "product_reference": "nodejs14-docs-14.17.5-1.2.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs14-docs-14.17.5-1.2.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64"
        },
        "product_reference": "nodejs14-docs-14.17.5-1.2.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm14-14.17.5-1.2.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64"
        },
        "product_reference": "npm14-14.17.5-1.2.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm14-14.17.5-1.2.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le"
        },
        "product_reference": "npm14-14.17.5-1.2.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm14-14.17.5-1.2.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x"
        },
        "product_reference": "npm14-14.17.5-1.2.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "npm14-14.17.5-1.2.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
        },
        "product_reference": "npm14-14.17.5-1.2.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-11080",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-11080"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., \u003e 32), then drop the connection.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-11080",
          "url": "https://www.suse.com/security/cve/CVE-2020-11080"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1172441 for CVE-2020-11080",
          "url": "https://bugzilla.suse.com/1172441"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1172442 for CVE-2020-11080",
          "url": "https://bugzilla.suse.com/1172442"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1181358 for CVE-2020-11080",
          "url": "https://bugzilla.suse.com/1181358"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-11080"
    },
    {
      "cve": "CVE-2020-15095",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-15095"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like \"\u003cprotocol\u003e://[\u003cuser\u003e[:\u003cpassword\u003e]@]\u003chostname\u003e[:\u003cport\u003e][:][/]\u003cpath\u003e\". The password value is not redacted and is printed to stdout and also to any generated log files.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-15095",
          "url": "https://www.suse.com/security/cve/CVE-2020-15095"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1173937 for CVE-2020-15095",
          "url": "https://bugzilla.suse.com/1173937"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-15095"
    },
    {
      "cve": "CVE-2020-7774",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-7774"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-7774",
          "url": "https://www.suse.com/security/cve/CVE-2020-7774"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1184450 for CVE-2020-7774",
          "url": "https://bugzilla.suse.com/1184450"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-7774"
    },
    {
      "cve": "CVE-2020-8172",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8172"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "TLS session reuse can lead to host certificate verification bypass in node version \u003c 12.18.0 and \u003c 14.4.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8172",
          "url": "https://www.suse.com/security/cve/CVE-2020-8172"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1172441 for CVE-2020-8172",
          "url": "https://bugzilla.suse.com/1172441"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-8172"
    },
    {
      "cve": "CVE-2020-8174",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8174"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "napi_get_value_string_*() allows various kinds of memory corruption in node \u003c 10.21.0, 12.18.0, and \u003c 14.4.0.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8174",
          "url": "https://www.suse.com/security/cve/CVE-2020-8174"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1172443 for CVE-2020-8174",
          "url": "https://bugzilla.suse.com/1172443"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2020-8174"
    },
    {
      "cve": "CVE-2020-8201",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8201"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Node.js \u003c 12.18.4 and \u003c 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8201",
          "url": "https://www.suse.com/security/cve/CVE-2020-8201"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1176605 for CVE-2020-8201",
          "url": "https://bugzilla.suse.com/1176605"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-8201"
    },
    {
      "cve": "CVE-2020-8251",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8251"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Node.js \u003c 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8251",
          "url": "https://www.suse.com/security/cve/CVE-2020-8251"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1176604 for CVE-2020-8251",
          "url": "https://bugzilla.suse.com/1176604"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-8251"
    },
    {
      "cve": "CVE-2020-8265",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8265"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8265",
          "url": "https://www.suse.com/security/cve/CVE-2020-8265"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1180553 for CVE-2020-8265",
          "url": "https://bugzilla.suse.com/1180553"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-8265"
    },
    {
      "cve": "CVE-2020-8277",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8277"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions \u003c 15.2.1, \u003c 14.15.1, and \u003c 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8277",
          "url": "https://www.suse.com/security/cve/CVE-2020-8277"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1178882 for CVE-2020-8277",
          "url": "https://bugzilla.suse.com/1178882"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-8277"
    },
    {
      "cve": "CVE-2020-8287",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-8287"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-8287",
          "url": "https://www.suse.com/security/cve/CVE-2020-8287"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1180554 for CVE-2020-8287",
          "url": "https://bugzilla.suse.com/1180554"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-8287"
    },
    {
      "cve": "CVE-2021-21148",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-21148"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-21148",
          "url": "https://www.suse.com/security/cve/CVE-2021-21148"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1181827 for CVE-2021-21148",
          "url": "https://bugzilla.suse.com/1181827"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-21148"
    },
    {
      "cve": "CVE-2021-22883",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-22883"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an \u0027unknownProtocol\u0027 are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-22883",
          "url": "https://www.suse.com/security/cve/CVE-2021-22883"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1182619 for CVE-2021-22883",
          "url": "https://bugzilla.suse.com/1182619"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-22883"
    },
    {
      "cve": "CVE-2021-22884",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-22884"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes \"localhost6\". When \"localhost6\" is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim\u0027s DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the \"localhost6\" domain. As long as the attacker uses the \"localhost6\" domain, they can still apply the attack described in CVE-2018-7160.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-22884",
          "url": "https://www.suse.com/security/cve/CVE-2021-22884"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1182620 for CVE-2021-22884",
          "url": "https://bugzilla.suse.com/1182620"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1188549 for CVE-2021-22884",
          "url": "https://bugzilla.suse.com/1188549"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1201328 for CVE-2021-22884",
          "url": "https://bugzilla.suse.com/1201328"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-22884"
    },
    {
      "cve": "CVE-2021-22918",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-22918"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to information disclosures or crashes. This function can be triggered via uv_getaddrinfo().",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-22918",
          "url": "https://www.suse.com/security/cve/CVE-2021-22918"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1187973 for CVE-2021-22918",
          "url": "https://bugzilla.suse.com/1187973"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-22918"
    },
    {
      "cve": "CVE-2021-22930",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-22930"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-22930",
          "url": "https://www.suse.com/security/cve/CVE-2021-22930"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1188917 for CVE-2021-22930",
          "url": "https://bugzilla.suse.com/1188917"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1189368 for CVE-2021-22930",
          "url": "https://bugzilla.suse.com/1189368"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2021-22930"
    },
    {
      "cve": "CVE-2021-22939",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-22939"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "If the Node.js https API was used incorrectly and \"undefined\" was in passed for the \"rejectUnauthorized\" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-22939",
          "url": "https://www.suse.com/security/cve/CVE-2021-22939"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1189369 for CVE-2021-22939",
          "url": "https://bugzilla.suse.com/1189369"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-22939"
    },
    {
      "cve": "CVE-2021-22940",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-22940"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-22940",
          "url": "https://www.suse.com/security/cve/CVE-2021-22940"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1189368 for CVE-2021-22940",
          "url": "https://bugzilla.suse.com/1189368"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2021-22940"
    },
    {
      "cve": "CVE-2021-27290",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-27290"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-27290",
          "url": "https://www.suse.com/security/cve/CVE-2021-27290"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1187976 for CVE-2021-27290",
          "url": "https://bugzilla.suse.com/1187976"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-27290"
    },
    {
      "cve": "CVE-2021-3672",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-3672"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
          "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-3672",
          "url": "https://www.suse.com/security/cve/CVE-2021-3672"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1188881 for CVE-2021-3672",
          "url": "https://bugzilla.suse.com/1188881"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1193099 for CVE-2021-3672",
          "url": "https://bugzilla.suse.com/1193099"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-devel-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:nodejs14-docs-14.17.5-1.2.x86_64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.aarch64",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.ppc64le",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.s390x",
            "openSUSE Tumbleweed:npm14-14.17.5-1.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-3672"
    }
  ]
}