-------------------------------------------------------------------------------
-
Fedora Update Notification
FEDORA-2021-cbad295a90
2021-10-23 03:24:50.227257
-------------------------------------------------------------------------------
-

Name        : nodejs
Product     : Fedora 33
Version     : 14.18.1
Release     : 1.fc33
URL         : http://nodejs.org/
Summary     : JavaScript runtime
Description :
Node.js is a platform built on Chrome's JavaScript runtime
for easily building fast, scalable network applications.
Node.js uses an event-driven, non-blocking I/O model that
makes it lightweight and efficient, perfect for data-intensive
real-time applications that run across distributed devices.

-------------------------------------------------------------------------------
-
Update Information:

## 2021-10-12, Version 14.18.1 'Fermium' (LTS), @danielleadams  This is
 a
security release.  ### Notable changes  * **CVE-2021-22959**: HTTP Request
Smuggling due to spaced in headers (Medium)     * The http parser accepts
requests with a space (SP) right after the header name before the colon. This
can lead to HTTP Request Smuggling (HRS). More details will be available at
[CVE-2021-22959](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22959)
after publication. * **CVE-2021-22960**: HTTP Request Smuggling when parsing
 the
body (Medium)      * The parse ignores chunk extensions when parsing the body
 of
chunked requests. This leads to HTTP Request Smuggling (HRS) under certain
conditions. More details will be available at
[CVE-2021-22960](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22960)
after publication.
-------------------------------------------------------------------------------
-
ChangeLog:

* Thu Oct 14 2021 Stephen Gallagher <sgallagh@redhat.com> - 1:14.18.1-1
- Update to security release 14.18.1
- https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V14.md#14.18.1
-------------------------------------------------------------------------------
-
References:

  [ 1 ] Bug #2014059 - CVE-2021-22960 llhttp: HTTP Request Smuggling when parsing the body
        https://bugzilla.redhat.com/show_bug.cgi?id=2014059
-------------------------------------------------------------------------------
-

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2021-cbad295a90' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
-------------------------------------------------------------------------------
-
_______________________________________________
package-announce mailing list -- package-announce@lists.fedoraproject.org
To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure