{"update": {"autokarma": true, "autotime": true, "stable_karma": 2, "stable_days": 3, "unstable_karma": -1, "require_bugs": true, "require_testcases": true, "display_name": "", "notes": "## 2023-02-16, Version 16.19.1 'Gallium' (LTS), @richardlau\n\nThis is a security release.\n\n### Notable Changes\n\nThe following CVEs are fixed in this release:\n\n* **[CVE-2023-23918](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23918)**: Node.js Permissions policies can be bypassed via process.mainModule (High)\n* **[CVE-2023-23919](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23919)**: Node.js OpenSSL error handling issues in nodejs crypto library (Medium)\n* **[CVE-2023-23920](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23920)**: Node.js insecure loading of ICU data through ICU\\_DATA environment variable (Low)\n\nFixed by an update to undici:\n\n* **[CVE-2023-23936](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23936)**: Fetch API in Node.js did not protect against CRLF injection in host headers (Medium)\n  * See <https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff> for more information.\n* **[CVE-2023-24807](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24807)**: Regular Expression Denial of Service in Headers in Node.js fetch API (Low)\n  * See <https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w> for more information.\n\nMore detailed information on each of the vulnerabilities can be found in [February 2023 Security Releases](https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/) blog post.\n\nThis security release includes OpenSSL security updates as outlined in the recent\n[OpenSSL security advisory](https://www.openssl.org/news/secadv/20230207.txt).\n\n### Commits\n\n* \\[[`7fef050447`](https://github.com/nodejs/node/commit/7fef050447)] - **build**: build ICU with ICU\\_NO\\_USER\\_DATA\\_OVERRIDE (RafaelGSS) [nodejs-private/node-private#374](https://github.com/nodejs-private/node-private/pull/374)\n* \\[[`b558e9f476`](https://github.com/nodejs/node/commit/b558e9f476)] - **crypto**: clear OpenSSL error on invalid ca cert (RafaelGSS) [nodejs-private/node-private#375](https://github.com/nodejs-private/node-private/pull/375)\n* \\[[`160adb7ffc`](https://github.com/nodejs/node/commit/160adb7ffc)] - **crypto**: clear OpenSSL error queue after calling X509\\_check\\_private\\_key() (Filip Skokan) [#45495](https://github.com/nodejs/node/pull/45495)\n* \\[[`d0ece30948`](https://github.com/nodejs/node/commit/d0ece30948)] - **crypto**: clear OpenSSL error queue after calling X509\\_verify() (Takuro Sato) [#45377](https://github.com/nodejs/node/pull/45377)\n* \\[[`2d9ae4f184`](https://github.com/nodejs/node/commit/2d9ae4f184)] - **deps**: update undici to v5.19.1 (Matteo Collina) [nodejs-private/node-private#388](https://github.com/nodejs-private/node-private/pull/388)\n* \\[[`d80e8312fd`](https://github.com/nodejs/node/commit/d80e8312fd)] - **deps**: cherry-pick Windows ARM64 fix for openssl (Richard Lau) [#46568](https://github.com/nodejs/node/pull/46568)\n* \\[[`de5c8d2c2f`](https://github.com/nodejs/node/commit/de5c8d2c2f)] - **deps**: update archs files for quictls/openssl-1.1.1t+quic (RafaelGSS) [#46568](https://github.com/nodejs/node/pull/46568)\n* \\[[`1a8ccfe908`](https://github.com/nodejs/node/commit/1a8ccfe908)] - **deps**: upgrade openssl sources to OpenSSL\\_1\\_1\\_1t+quic (RafaelGSS) [#46568](https://github.com/nodejs/node/pull/46568)\n* \\[[`693789780b`](https://github.com/nodejs/node/commit/693789780b)] - **doc**: clarify release notes for Node.js 16.19.0 (Richard Lau) [#45846](https://github.com/nodejs/node/pull/45846)\n* \\[[`f95ef064f4`](https://github.com/nodejs/node/commit/f95ef064f4)] - **lib**: makeRequireFunction patch when experimental policy (RafaelGSS) [nodejs-private/node-private#358](https://github.com/nodejs-private/node-private/pull/358)\n* \\[[`b02d895137`](https://github.com/nodejs/node/commit/b02d895137)] - **policy**: makeRequireFunction on mainModule.require (RafaelGSS) [nodejs-private/node-private#358](https://github.com/nodejs-private/node-private/pull/358)\n* \\[[`d7f83c420c`](https://github.com/nodejs/node/commit/d7f83c420c)] - **test**: avoid left behind child processes (Richard Lau) [#46276](https://github.com/nodejs/node/pull/46276)", "type": "security", "status": "obsolete", "request": null, "severity": "medium", "suggest": "unspecified", "locked": false, "pushed": false, "critpath": false, "critpath_groups": "", "close_bugs": true, "date_submitted": "2023-03-02 15:15:23", "date_modified": null, "date_approved": null, "date_testing": "2023-03-03 02:21:14", "date_stable": null, "alias": "FEDORA-2023-3a6f96ad55", "test_gating_status": "failed", "from_tag": null, "date_pushed": "2023-03-03 02:21:14", "meets_testing_requirements": false, "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2023-3a6f96ad55", "title": "nodejs16-16.19.1-4.fc38", "version_hash": "bb96b874a49a05e36cba64ac86d308d7effbaa73", "release": {"name": "F38", "long_name": "Fedora 38", "version": "38", "id_prefix": "FEDORA", "branch": "f38", "dist_tag": "f38", "stable_tag": "f38-updates", "testing_tag": "f38-updates-testing", "candidate_tag": "f38-updates-candidate", "pending_signing_tag": "f38-signing-pending", "pending_testing_tag": "f38-updates-testing-pending", "pending_stable_tag": "f38-updates-pending", "override_tag": "f38-override", "mail_template": "fedora_errata_template", "state": "archived", "composed_by_bodhi": true, "create_automatic_updates": false, "package_manager": "dnf", "testing_repository": "updates-testing", "released_on": null, "eol": "2024-05-21", "critpath_mandatory_days_in_testing": 14, "mandatory_days_in_testing": 7, "critpath_min_karma": 2, "min_karma": 1, "setting_status": null}, "user": {"name": "sgallagh", "email": "sgallagh@redhat.com", "id": 535, "avatar": "https://seccdn.libravatar.org/avatar/bf298fff6edef11d0f53e6bd1fb1e649c131b75ad7200ab134883e8603591405?s=24&d=retro", "openid": "sgallagh.id.fedoraproject.org", "groups": [{"name": "provenpackager"}, {"name": "packager"}, {"name": "nodejs-sig"}, {"name": "eln-sig"}, {"name": "gitding-libs"}, {"name": "gitroller-derby"}, {"name": "communishift"}, {"name": "sysadmin-noc"}, {"name": "gitnodejs-packaging"}, {"name": "fedorabugs"}, {"name": "signed_fpca"}, {"name": "gitspin-kickstarts"}, {"name": "fesco"}, {"name": "epel-cabal"}, {"name": "gitsssd"}, {"name": "sysadmin"}, {"name": "modularity-wg"}, {"name": "cockpit-jenkins"}, {"name": "gitcura"}, {"name": "gitrolekit"}, {"name": "ipausers"}, {"name": "gitelapi"}, {"name": "cockpitteam"}, {"name": "server-wg"}, {"name": "fedora-contributor"}, {"name": "summer-coding"}, {"name": "bind-dyndb-ldap"}, {"name": "sysadmin-odcs"}, {"name": "gitlab-fedora-admin"}, {"name": "sysadmin-eln"}, {"name": "trust admins"}]}, "comments": [{"karma": 0, "karma_critpath": 0, "text": "This update has been submitted for testing by sgallagh. ", "timestamp": "2023-03-02 15:15:23", "update_id": 490523, "user_id": 91, "id": 2926389, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update's test gating status has been changed to 'waiting'.", "timestamp": "2023-03-02 15:15:24", "update_id": 490523, "user_id": 91, "id": 2926390, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update's test gating status has been changed to 'failed'.", "timestamp": "2023-03-02 17:46:08", "update_id": 490523, "user_id": 91, "id": 2926581, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been pushed to testing.", "timestamp": "2023-03-03 02:23:48", "update_id": 490523, "user_id": 91, "id": 2929127, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "Tests are failing", "timestamp": "2023-03-27 08:23:44", "update_id": 490523, "user_id": 491, "id": 2961870, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "pwalter", "email": "walter.pete@yandex.com", "id": 491, "avatar": "https://seccdn.libravatar.org/avatar/20f7756718e08ef810fe23344dfdcafe17dfb277e2c27d5cbf81e35b66247795?s=24&d=retro", "openid": "pwalter.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "trust admins"}]}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been obsoleted by [nodejs16-16.20.0-1.fc38](https://bodhi.fedoraproject.org/updates/FEDORA-2023-cdd4df1681).", "timestamp": "2023-03-30 16:07:09", "update_id": 490523, "user_id": 91, "id": 2968035, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}], "builds": [{"nvr": "nodejs16-16.19.1-4.fc38", "signed": true, "release_id": 66, "type": "rpm", "epoch": 1}], "bugs": [], "updateid": "FEDORA-2023-3a6f96ad55", "karma": 0, "content_type": "rpm", "test_cases": []}, "can_edit": false, "ci_allowed": false}