Skip to contentSkip to conversation

package/nodejs: security bump to version 12.22.7

Buildroot Peter Korsgaard 1 participant 2 messages Oct 26, 2021

lore
Share & tools
lore

Peter Korsgaard

author
#0 lore raw

Fixes the following security issues:

- CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium) The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS).

- CVE-2021-22960: HTTP Request Smuggling when parsing the body (Medium)

The http parser ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions.

For more details, see the advisory:
https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/

Signed-off-by Peter Korsgaard <[email protected]>
---
 package/nodejs/nodejs.hash | 4 ++--
 package/nodejs/nodejs.mk   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)
package/nodejs/nodejs.hash +2 -2
index 8d39ef489d..f31c7d5d69 100644
@@ -1,5 +1,5 @@
-# From https://nodejs.org/dist/v12.22.6/SHASUMS256.txt
-sha256  c2022f16b8f689620c3472c2b5261fdabbd0ab976bf9ac3b7db6747a2e9b0f7a  node-v12.22.6.tar.xz
+# From https://nodejs.org/dist/v12.22.7/SHASUMS256.txt
+sha256  cc6a23b44870679a94bd8f3c8d4e1f4b77bb2712a36888ab87463459e6785f6b  node-v12.22.7.tar.xz
 
 # Hash for license file
 sha256  221417a7ca275112a5ac54639b36ee3c5184e74631ea1e1b01b701293b655190  LICENSE
package/nodejs/nodejs.mk +1 -1
index 38e8936986..c8c5223a0b 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-NODEJS_VERSION = 12.22.6
+NODEJS_VERSION = 12.22.7
 NODEJS_SOURCE = node-v$(NODEJS_VERSION).tar.xz
 NODEJS_SITE = http://nodejs.org/dist/v$(NODEJS_VERSION)
 NODEJS_DEPENDENCIES = host-python host-nodejs c-ares \
Signature · 6 lines
2.20.1

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
author
#1 lore raw
Quoted 9 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Peter" == Peter Korsgaard <[email protected]> writes:

Fixes the following security issues:
- CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium) The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS).

- CVE-2021-22960: HTTP Request Smuggling when parsing the body (Medium)

Quoted 8 lines

The http parser ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions.

For more details, see the advisory:
https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/

Signed-off-by Peter Korsgaard <[email protected]>

Committed to 2021.02.x and 2021.08.x, thanks.

Signature · 5 lines
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot