GNU bug report logs - #46634
[PATCH] gnu: node: Update to 10.23.3. [security fixes]

Previous Next

Full log

Message #13 received at 46634-done <at> debbugs.gnu.org (full text, mbox):

From: Jelle Licht <jlicht <at> fsfe.org>
To: Jonathan Brielmaier <jonathan.brielmaier <at> web.de>,
 46634-done <at> debbugs.gnu.org
Subject: Re: [bug#46634] [PATCH] gnu: node: Update to 10.23.3. [security fixes]
Date: Wed, 24 Feb 2021 10:38:34 +0100

Jonathan Brielmaier <jonathan.brielmaier <at> web.de> writes:

> On 19.02.21 12:02, Jelle Licht wrote:
>> Hey Guix,
>>
>> The attached two patches together should address CVE-2020-8287 (in
>> Node). I am kind of fuzzy on the details, but to me it seems that the
>> vulnerability is actually in http-parser (and llhttp), not node. I
>> informed upstream about my findings, but in the mean time we should
>> probably apply these.
>>
>> The node package subsequently has a regression test to demonstrate that
>> the applied fix works. Nonetheless, http-parser has quite some
>> dependents, and I only verified everything to still work with node.
>>
>>   - Jelle
>
> Impressive work. Looks nice! node-10.23 is required for Firefox >= 86.0
> so as well for the next ESR branch of icecat and icedove...

Good to know, I wouldn't want to block any other ongoing packaging efforts:

I pushed the patches to master, with the security fix at 66fa2d318a.
 - Jelle

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.