[Buildroot] [PATCH] package/nodejs: security bump to version 12.16.0
thomas.petazzoni at bootlin.com
Tue Feb 18 02:51:55 UTC 2020
On Mon, 17 Feb 2020 23:38:49 +0100
Peter Korsgaard <peter at korsgaard.com> wrote:
> Fixes the following security issues (12.15.0):
> - CVE-2019-15606: HTTP header values do not have trailing OWS trimmed
> - CVE-2019-15605: HTTP request smuggling using malformed Transfer-Encoding
> - CVE-2019-15604: Remotely trigger an assertion on a TLS server with a
> malformed certificate string
> For more details, see the advisory:
> On top of this, 12.16.0 brings a number of changes and bugfixes.
> Update the license hash for an addition of the (MIT) licensing terms for the
> uvwsai module:
> +- uvwasi, located at deps/uvwasi, is licensed as follows:
> + """
> + MIT License
> + Copyright (c) 2019 Colin Ihrig and Contributors
> + Permission is hereby granted, free of charge, to any person obtaining a copy
> + of this software and associated documentation files (the "Software"), to deal
> + in the Software without restriction, including without limitation the rights
> + to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
> + copies of the Software, and to permit persons to whom the Software is
> + furnished to do so, subject to the following conditions:
> + The above copyright notice and this permission notice shall be included in all
> + copies or substantial portions of the Software.
> + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
> + IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
> + FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
> + AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
> + LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
> + OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
> + SOFTWARE.
> + """
> While we are at it, adjust the white space in the .hash function to match
> the new agreements.
> Signed-off-by: Peter Korsgaard <peter at korsgaard.com>
> package/nodejs/nodejs.hash | 6 +++---
> package/nodejs/nodejs.mk | 2 +-
> 2 files changed, 4 insertions(+), 4 deletions(-)
Applied to master, thanks.
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
More information about the buildroot