Bug 633734 (CVE-2017-14849)

Summary:	net-libs/nodejs-8.5.0 path traversal vulnerability (CVE-2017-14849)
Product:	Gentoo Security	Reporter:	thomasg <thomas>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	trivial	CC:	jstein, patrick
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://nodejs.org/en/blog/vulnerability/september-2017-path-validation/
Whiteboard:	~4 [noglsa cve]
Package list:		Runtime testing required:	---

Description thomasg 2017-10-08 01:59:37 UTC

The nodejs 8.x series before 8.6 is vulnerable to a path traversal attack, as described in CVE-2017-14849.
Upstream has fixed the issue in the 8.6.0 release, which has been available for over a week.

Comment 1 Christopher Díaz Riveros (RETIRED) gentoo-dev

2017-10-08 17:20:01 UTC

@Maintainer could you please verify which versions in tree are vulnerable?

As stated in URL:

4.x NOT vulnerable (stable)
6.x NOT vulnerable (stable)
7.x unknown (non-stable)
8.x unknown (non-stable)
8.5.0 is vulnerable (non-stable)

Thank you,

Gentoo Security Padawan
ChrisADR

Comment 2 Jonas Stein gentoo-dev

2017-10-30 00:18:08 UTC

whoops. Sorry.

Comment 3 Aaron Bauman (RETIRED) gentoo-dev

2017-10-30 00:43:29 UTC

ebuild and cleanup?

Comment 4 Christopher Díaz Riveros (RETIRED) gentoo-dev

2017-10-30 01:04:09 UTC

Now everything is fixed and tree is clean. Closing

Thank you