node.js-14.17.4

[Bruce Dubbs]

New point version.

[ken@…]

From the oss-security list:

Updates are now available for v16.x, v14.x, and v12.x Node.js release lines.

We normally like to give advance notice and provide releases in which the
only  changes are security fixes, but since this vulnerability was already
public we felt it was more important to get this fix out fast in releases
that were  already planned.

For more information see:
[https://nodejs.org/en/blog/vulnerability/july-2021-security-releases-2]

Use after free on close http2 on stream canceling (High) (CVE-2021-22930)

Node.js is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.

You can read more about it in ​https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22930

Thank you to Eran Levin (exx8) for reporting this vulnerability.

Impacts:

All versions of the 16.x, 14.x, and 12.x releases lines

(The CVE currently shows as Reserved)

[ken@…]

Fixed in @d63fed6200877253f8ae60d56a71b4b91b5f4ca0 10.1-701 Security Advisory 10.1-084.

[Bruce Dubbs]

Milestone renamed