Changes between Initial Version and Version 1 of Ticket #15623


Ignore:
Timestamp:
10/12/2021 07:00:58 PM (3 years ago)
Author:
ken@…
Comment:

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #15623

    • Property Owner changed from blfs-book to ken@…
    • Property Status new → assigned
    • Property Summary node.js-14.18.0 → node.js-14.18.1

  • Ticket #15623 – Description

    initial v1  
    1 New minor version.
     1New minor version (14.18.0) - now 14.18.1 with security fixes:
     2{{{
     3(Update 12-Oct-2021) Security releases available
     4
     5Updates are now available for the v16.x, v14.x, and v12.x Node.js release lines for the following issues.
     6HTTP Request Smuggling due to spaced in headers (Medium)(CVE-2021-22959)
     7
     8The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). More details will be available at CVE-2021-22959 after publication.
     9
     10THe fix for this is included in llhttp v2.1.4 and v6.0.6.
     11
     12Thanks to Mattias Grenfeldt (https://grenfeldt.dev/) and Asta Olofsson for reporting this vulnerability.
     13
     14Impacts:
     15
     16    All versions of the 16.x, 14.x, and 12.x releases lines.
     17
     18HTTP Request Smuggling when parsing the body (Medium)(CVE-2021-22960)
     19
     20The parse ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. More details will be available at CVE-2021-22960 after publication.
     21
     22The fix for this is included in llhttp v2.1.4 and v6.0.6.
     23
     24Thanks to Mattias Grenfeldt (https://grenfeldt.dev/) and Asta Olofsson for reporting this vulnerability.
     25
     26Impacts:
     27
     28    All versions of the 16.x, 14.x, and 12.x releases lines.
     29}}}