diff options
| author | adam <adam@pkgsrc.org> | 2021-07-06 07:04:11 +0000 |
|---|---|---|
| committer | adam <adam@pkgsrc.org> | 2021-07-06 07:04:11 +0000 |
| commit | 29f34d2854de89ef20ff5c54246fefca158dcf04 (patch) | |
| tree | d575b2984a885312498083ea875295a9a11f4967 /lang | |
| parent | 6c938105c64d64b25b71add851027e8157cb42c5 (diff) | |
| download | pkgsrc-29f34d2854de89ef20ff5c54246fefca158dcf04.tar.gz | |
nodejs12: updated to 12.22.3
Version 12.22.3 'Erbium' (LTS)
Notable Changes
Node.js 12.22.2 introduced a regression in the Windows installer on non-English locales that is being fixed in this release. There is no need to download this release if you are not using the Windows installer.
Version 12.22.2 'Erbium' (LTS)
This is a security release.
Notable Changes
Vulnerabilities fixed:
CVE-2021-22918: libuv upgrade - Out of bounds read (Medium)
Node.js is vulnerable to out-of-bounds read in libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22918
CVE-2021-22921: Windows installer - Node Installer Local Privilege Escalation (Medium)
Node.js is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22921
CVE-2021-27290: npm upgrade - ssri Regular Expression Denial of Service (ReDoS) (High)
This is a vulnerability in the ssri npm mudule which may be vulnerable to denial of service attacks. You can read more about it in https://github.com/advisories/GHSA-vx3p-948g-6vhq
CVE-2021-23362: npm upgrade - hosted-git-info Regular Expression Denial of Service (ReDoS) (Medium)
This is a vulnerability in the hosted-git-info npm mudule which may be vulnerable to denial of service attacks. You can read more about it in https://nvd.nist.gov/vuln/detail/CVE-2021-23362
Diffstat (limited to 'lang')
| -rw-r--r-- | lang/nodejs12/Makefile | 5 | ||||
| -rw-r--r-- | lang/nodejs12/distinfo | 10 |
2 files changed, 7 insertions, 8 deletions
diff --git a/lang/nodejs12/Makefile b/lang/nodejs12/Makefile index 3111e875af8..f9303791c5c 100644 --- a/lang/nodejs12/Makefile +++ b/lang/nodejs12/Makefile @@ -1,11 +1,10 @@ -# $NetBSD: Makefile,v 1.34 2021/06/24 09:31:26 adam Exp $ +# $NetBSD: Makefile,v 1.35 2021/07/06 07:04:11 adam Exp $ -DISTNAME= node-v12.22.1 +DISTNAME= node-v12.22.3 EXTRACT_SUFX= .tar.xz USE_LANGUAGES= c gnu++14 -PKGREVISION= 2 .include "../../mk/bsd.prefs.mk" # XXX: figure out a way to add rpaths to torque diff --git a/lang/nodejs12/distinfo b/lang/nodejs12/distinfo index 388572ae614..e23c5a104ae 100644 --- a/lang/nodejs12/distinfo +++ b/lang/nodejs12/distinfo @@ -1,9 +1,9 @@ -$NetBSD: distinfo,v 1.23 2021/04/07 06:21:06 adam Exp $ +$NetBSD: distinfo,v 1.24 2021/07/06 07:04:11 adam Exp $ -SHA1 (node-v12.22.1.tar.xz) = a4bd1a34dfb82960f098f3a9aab04470c0315581 -RMD160 (node-v12.22.1.tar.xz) = 840b4f5835a00136164d9950709957d476cf14bf -SHA512 (node-v12.22.1.tar.xz) = eaead633611bda04ab9be200aeddf3b4004b8104e9c6af246023b8008003dd3a7103e1508ea690443e59c6591521b04a2d71c7344343f2a20d1c935ef51c66a0 -Size (node-v12.22.1.tar.xz) = 23650180 bytes +SHA1 (node-v12.22.3.tar.xz) = 0cb24e343ce26a96b20799ec234e5abe44985faa +RMD160 (node-v12.22.3.tar.xz) = d9d6526d038c0789299e0dd8b25edd2a25c3a872 +SHA512 (node-v12.22.3.tar.xz) = 11684b6df15b6b74b8674ebf2c2bb950d1e52b83f90478638e85dd11a163dc7c62ae888bc4c1c29e89179e0c47fdccc26bee2817d64eb3ff926b2d3e648c351c +Size (node-v12.22.3.tar.xz) = 23662268 bytes SHA1 (patch-common.gypi) = a3fa3b5b974f910b3c8fea640ded4dca262e1ba8 SHA1 (patch-deps_cares_cares.gyp) = 22b44f2ac59963f694dfe4f4585e08960b3dec32 SHA1 (patch-deps_uv_common.gypi) = d38a9c8d9e3522f15812aec2f5b1e1e636d4bab3 |