mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-26 03:50:44 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/nodejs: security bump to version 20.18.2

Browse Source 
Fixes the following security vulnerabilities:

Worker permission bypass via InternalWorker leak in diagnostics
(CVE-2025-23083) - (high)

With the aid of the diagnostics_channel utility, an event can be hooked into
whenever a worker thread is created.  This is not limited only to workers
but also exposes internal workers, where an instance of them can be fetched,
and its constructor can be grabbed and reinstated for malicious usage.

This vulnerability affects Permission Model users (--permission) on Node.js
v20, v22, and v23.

GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085) - (medium)

A memory leak could occur when a remote peer abruptly closes the socket
without sending a GOAWAY notification.  Additionally, if an invalid header
was detected by nghttp2, causing the connection to be terminated by the
peer, the same leak was triggered.  This flaw could lead to increased memory
consumption and potential denial of service under certain conditions.

This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.

For more details, see the announcement:
https://nodejs.org/en/blog/vulnerability/january-2025-security-releases

Update the LICENSE hash for a reformatting and removal of the highlight.js license:

6ca0cfc602
1dfd238781

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit is contained in:
Peter Korsgaard
2025-01-28 21:22:47 +01:00
parent 5b5ee3de71
commit a34ad4d830
2 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
package/nodejs/nodejs.hash
View File

@@ -1,8 +1,10 @@
# From https://nodejs.org/dist/v20.15.1/SHASUMS256.txt.asc
sha256 10d47a46ef208b3e4b226e4d595a82659123b22397ed77b7975d989114ec317e node-v20.15.1-linux-arm64.tar.xz
sha256 7bc120efdd8018f6915471b963d9b80adf4ed406d6dc9edb4ae944b85f505c4c node-v20.15.1-linux-armv7l.tar.xz
sha256 b33e684802251397ad62ad3f8a1836267ee8b7723f87f669470018ad0035287b node-v20.15.1-linux-ppc64le.tar.xz
sha256 26700f8d3e78112ad4a2618a9c8e2816e38a49ecf0213ece80e54c38cb02563f node-v20.15.1-linux-x64.tar.xz
sha256 fdd53a5729d936691a2a1151046fb4897721cb8b0fca2af957823a9b40fe0c34 node-v20.15.1.tar.xz
# From https://nodejs.org/dist/v20.18.2/SHASUMS256.txt.asc
sha256 05819d72dcc0aa788baab1066e18ede5f1ab6730a1925cd6b15c131b55fd4272 node-v20.18.2-headers.tar.xz
sha256 5c1437aa16e7e6a2e0687a42c4d3f0a8f8a2039cda8880cb3be8cd983aeefb44 node-v20.18.2-linux-arm64.tar.xz
sha256 63d4df56fb2e34a5077345f78941094204d2223ce03b8ebc9c1500e6e2aae68d node-v20.18.2-linux-armv7l.tar.xz
sha256 828a2635261ca225cd4a8a4b1a914003cdc7b30656c2e9092ac7aab02ac361db node-v20.18.2-linux-ppc64le.tar.xz
sha256 4e50f727ae09bdafecf2322c72faf7cd82bf3b8851a16b8bb63974e0d8d6eceb node-v20.18.2-linux-x64.tar.xz
sha256 69bf81b70f3a95ae0763459f02860c282d7e3a47567c8afaf126cc778176a882 node-v20.18.2.tar.xz
# Locally calculated
sha256 49cd410e0fe6a8879a40d0764092d1e6114cc85fe41d4efed990d028eec25582 LICENSE
sha256 4f0e8660d7fe2f8f7759a54c53907300c555992b580e846b30b75121c53ad180 LICENSE

2
package/nodejs/nodejs.mk
View File

@@ -5,7 +5,7 @@
################################################################################
# _VERSION, _SOURCE and _SITE must be kept empty to avoid downloading anything
NODEJS_COMMON_VERSION = 20.15.1
NODEJS_COMMON_VERSION = 20.18.2
NODEJS_COMMON_SOURCE = node-v$(NODEJS_COMMON_VERSION).tar.xz
NODEJS_COMMON_SITE = http://nodejs.org/dist/v$(NODEJS_COMMON_VERSION)