FEDORA-2020-43d5a372fc — security update for nodejs

stable

nodejs-14.15.1-1.fc33

FEDORA-2020-43d5a372fc created by sgallagh 3 years ago for Fedora 33

Update to 14.15.1

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2020-43d5a372fc

This update has been submitted for testing by sgallagh.

3 years ago

This update's test gating status has been changed to 'ignored'.

3 years ago

This update's test gating status has been changed to 'waiting'.

3 years ago

This update's test gating status has been changed to 'ignored'.

3 years ago

This update has been pushed to testing.

3 years ago

pwalter commented & provided feedback 3 years ago

karma

Works

This update can be pushed to stable now if the maintainer wishes

3 years ago

This update has been submitted for stable by bodhi.

3 years ago

This update has been pushed to stable.

3 years ago

Please login to add feedback.

Metadata

Type

security

Severity

medium

Karma

Signed

Content Type

RPM

Test Gating

ignored

Builds

nodejs-14.15.1-1.fc33

Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

7 days

Dates

submitted

3 years ago

in testing

3 years ago

in stable

3 years ago

BZ#1846887 CVE-2020-10531 nodejs: ICU: Integer overflow in UnicodeString::doAppend() [fedora-all]

BZ#1846892 CVE-2020-10531 nodejs:14/nodejs: ICU: Integer overflow in UnicodeString::doAppend() [fedora-all]

BZ#1847485 CVE-2020-11080 nodejs:14/nghttp2: overly large SETTINGS frames can lead to DoS [fedora-all]

BZ#1856877 CVE-2020-15095 nodejs: npm: Sensitive information exposure through logs [fedora-all]

BZ#1866840 CVE-2020-14354 nodejs: c-ares: ares_destroy() with pending ares_getaddrinfo() leads to Use-After-Free [fedora-all]

BZ#1879333 CVE-2020-8251 nodejs: Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests [fedora-all]

BZ#1879334 CVE-2020-8251 nodejs:14/nodejs: Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests [fedora-all]

BZ#1879336 CVE-2020-8252 nodejs: libuv: buffer overflow in realpath [fedora-all]

BZ#1879341 CVE-2020-8201 nodejs: HTTP Request Smuggling due to CR-to-Hyphen conversion [fedora-all]

BZ#1879342 CVE-2020-8252 nodejs:14/nodejs: libuv: buffer overflow in realpath [fedora-all]

BZ#1879346 CVE-2020-8201 nodejs:14/nodejs: HTTP Request Smuggling due to CR-to-Hyphen conversion [fedora-all]

nodejs-14.15.1-1.fc33

Automated Test Results

ignored