FEDORA-2022-b7766ddf3e — security update for nodejs

obsolete

nodejs-18.9.1-1.fc37

FEDORA-2022-b7766ddf3e created by sgallagh 2 years ago for Fedora 37

September Security Updates for Node.js

Update to 18.9.0

https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V18.md#18.9.0

This update has been submitted for testing by sgallagh.

2 years ago

This update's test gating status has been changed to 'waiting'.

2 years ago

This update has obsoleted nodejs-18.9.0-1.fc37, and has inherited its bugs and notes.

2 years ago

This update's test gating status has been changed to 'failed'.

2 years ago

This update has been pushed to testing.

2 years ago

cairo provided feedback 2 years ago

karma

mhayden commented & provided feedback 2 years ago

karma

Working fine.

pwalter commented & provided feedback 2 years ago

karma

Works

smithp commented & provided feedback 2 years ago

karma

This update has been obsoleted by nodejs-18.10.0-1.fc37.

2 years ago

Please login to add feedback.

Metadata

Type

security

Severity

high

Karma

Signed

Content Type

RPM

Test Gating

failed

Autopush Settings

Unstable by Karma

-1

Stable by Karma

Stable by Time

7 days

Thresholds

Minimum Karma

Minimum Testing

7 days

Dates

submitted

2 years ago

in testing

2 years ago

Builds

nodejs-18.9.1-1.fc37

BZ#2105422 CVE-2022-32212 nodejs: DNS rebinding in --inspect via invalid IP addresses

BZ#2105426 CVE-2022-32215 nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding

BZ#2105430 CVE-2022-32213 nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding

BZ#2108493 CVE-2022-32213 nodejs: HTTP request smuggling due to flawed parsing of Transfer-Encoding [fedora-all]

BZ#2108512 CVE-2022-32215 nodejs: HTTP request smuggling due to incorrect parsing of multi-line Transfer-Encoding [fedora-all]

BZ#2108521 CVE-2022-32212 nodejs: DNS rebinding in --inspect via invalid IP addresses [fedora-all]

BZ#2121416 nodejs-18.9.0 is available

BZ#2130517 CVE-2022-35255 nodejs: weak randomness in WebCrypto keygen

BZ#2130518 CVE-2022-35256 nodejs: HTTP Request Smuggling due to incorrect parsing of header fields

BZ#2130523 CVE-2022-35255 nodejs: weak randomness in WebCrypto keygen [fedora-all]

BZ#2130532 CVE-2022-35256 nodejs: HTTP Request Smuggling due to incorrect parsing of header fields [fedora-all]

nodejs-18.9.1-1.fc37

Automated Test Results

For help debugging failed Fedora CI tests (fedora-ci.*), contact the Fedora CI team.
For help debugging failed Fedora CoreOS tests (coreos.*), contact the Fedora CoreOS team.
For help debugging failed openQA tests (update.*), contact the Fedora Quality team, who will usually investigate and diagnose all failures within 24 hours.

failed