FEDORA-2023-973319d5b7 — security update for nodejs16, nodejs18, & 1 more

stable

nodejs16-16.20.0-2.fc38, nodejs18-18.15.0-6.fc38, & 1 more

FEDORA-2023-973319d5b7 created by sgallagh a year ago for Fedora 38

Fixes for virtual Provides/Requires of nodejs and nodejs-devel

Assorted fixes for v8-devel

Update to 19.8.1

Fix confilct with nodejs18

2023-02-16, Version 16.19.1 'Gallium' (LTS), @richardlau

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

CVE-2023-23918: Node.js Permissions policies can be bypassed via process.mainModule (High)
CVE-2023-23919: Node.js OpenSSL error handling issues in nodejs crypto library (Medium)
CVE-2023-23920: Node.js insecure loading of ICU data through ICU_DATA environment variable (Low)

Fixed by an update to undici:

CVE-2023-23936: Fetch API in Node.js did not protect against CRLF injection in host headers (Medium)
See https://github.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff for more information.
CVE-2023-24807: Regular Expression Denial of Service in Headers in Node.js fetch API (Low)
See https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w for more information.

More detailed information on each of the vulnerabilities can be found in February 2023 Security Releases blog post.

This security release includes OpenSSL security updates as outlined in the recent OpenSSL security advisory.

Commits

[7fef050447] - build: build ICU with ICU_NO_USER_DATA_OVERRIDE (RafaelGSS) nodejs-private/node-private#374
[b558e9f476] - crypto: clear OpenSSL error on invalid ca cert (RafaelGSS) nodejs-private/node-private#375
[160adb7ffc] - crypto: clear OpenSSL error queue after calling X509_check_private_key() (Filip Skokan) #45495
[d0ece30948] - crypto: clear OpenSSL error queue after calling X509_verify() (Takuro Sato) #45377
[2d9ae4f184] - deps: update undici to v5.19.1 (Matteo Collina) nodejs-private/node-private#388
[d80e8312fd] - deps: cherry-pick Windows ARM64 fix for openssl (Richard Lau) #46568
[de5c8d2c2f] - deps: update archs files for quictls/openssl-1.1.1t+quic (RafaelGSS) #46568
[1a8ccfe908] - deps: upgrade openssl sources to OpenSSL_1_1_1t+quic (RafaelGSS) #46568
[693789780b] - doc: clarify release notes for Node.js 16.19.0 (Richard Lau) #45846
[f95ef064f4] - lib: makeRequireFunction patch when experimental policy (RafaelGSS) nodejs-private/node-private#358
[b02d895137] - policy: makeRequireFunction on mainModule.require (RafaelGSS) nodejs-private/node-private#358
[d7f83c420c] - test: avoid left behind child processes (Richard Lau) #46276

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2023-973319d5b7

This update has been submitted for testing by sgallagh.

a year ago

This update's test gating status has been changed to 'waiting'.

a year ago

This update has obsoleted nodejs16-16.20.0-1.fc38, and has inherited its bugs and notes.

a year ago

This update's test gating status has been changed to 'failed'.

a year ago

This update's test gating status has been changed to 'passed'.

a year ago

This update's test gating status has been changed to 'waiting'.

a year ago

This update's test gating status has been changed to 'passed'.

a year ago

This update has been pushed to testing.

a year ago

pwalter commented & provided feedback a year ago

karma

Works

frantisekz commented & provided feedback a year ago

karma

Works well

This update has been submitted for stable by bodhi.

a year ago

There is an ongoing freeze; this will be pushed to stable after the freeze is over.

a year ago

This update has been pushed to stable.

a year ago

ellert commented & provided feedback a year ago

karma

This is an improvement, but BR: npm still installs nodejs20-npm instead of nodejs-npm.

See the following koji scratch build: https://koji.fedoraproject.org/koji/taskinfo?taskID=99528731

The root.log shows that the following packages gets installed:

DEBUG util.py:445:  Dependencies resolved.
DEBUG util.py:445:  ================================================================================
DEBUG util.py:445:   Package                  Arch      Version                      Repo      Size
DEBUG util.py:445:  ================================================================================
DEBUG util.py:445:  Installing:
DEBUG util.py:445:   nodejs20-npm             i686      1:9.5.1-1.19.8.1.7.fc38      build    2.0 M
DEBUG util.py:445:   web-assets-devel         noarch    5-19.fc38                    build    9.3 k
DEBUG util.py:445:  Installing dependencies:
DEBUG util.py:445:   fonts-filesystem         noarch    1:2.0.5-11.fc38              build    8.1 k
DEBUG util.py:445:   libuv                    i686      1:1.44.2-3.fc38              build    159 k
DEBUG util.py:445:   nodejs                   i686      1:18.15.0-6.fc38             build    1.8 M
DEBUG util.py:445:   nodejs-libs              i686      1:18.15.0-6.fc38             build     14 M
DEBUG util.py:445:   nodejs20                 i686      1:19.8.1-7.fc38              build    1.8 M
DEBUG util.py:445:   nodejs20-libs            i686      1:19.8.1-7.fc38              build     15 M
DEBUG util.py:445:   web-assets-filesystem    noarch    5-19.fc38                    build    7.9 k
DEBUG util.py:445:  Transaction Summary
DEBUG util.py:445:  ================================================================================
DEBUG util.py:445:  Install  9 Packages

I.e. nodejs20-npm gets installed instead of nodejs-npm, which results in FTBFS since the non-standard nodejs20-npm does not have a banary named npm, and the build fails with (see build.log):

+ npm run compile
/var/tmp/rpm-tmp.pU6JSV: line 44: npm: command not found
error: Bad exit status from /var/tmp/rpm-tmp.pU6JSV (%build)

Please login to add feedback.

Metadata

Type

security

Severity

medium

Karma

Signed

Content Type

RPM

Test Gating

passed

Builds

nodejs16-16.20.0-2.fc38

nodejs18-18.15.0-6.fc38

nodejs20-19.8.1-7.fc38

Settings

Unstable by Karma

-1

Stable by Karma

Stable by Time

7 days

Dates

submitted

a year ago

in testing

a year ago

in stable

a year ago

approved

a year ago

nodejs16-16.20.0-2.fc38

nodejs18-18.15.0-6.fc38

nodejs20-19.8.1-7.fc38

Automated Test Results

passed