872692 – (CVE-2022-35255, CVE-2022-35256) <net-libs/nodejs-{14.20.1, 16.17.1, 18.9.1}: multiple vulnerabilities

Bug 872692 (CVE-2022-35255, CVE-2022-35256) - <net-libs/nodejs-{14.20.1, 16.17.1, 18.9.1}: multiple vulnerabilities

Summary: <net-libs/nodejs-{14.20.1, 16.17.1, 18.9.1}: multiple vulnerabilities

Status:	IN_PROGRESS

Alias:	CVE-2022-35255, CVE-2022-35256

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:	https://nodejs.org/en/blog/vulnerabil...
Whiteboard:	B4 [glsa]
Keywords:

Depends on:	872728
Blocks:
	Show dependency tree

Reported:	2022-09-24 19:42 UTC by John Helmert III
Modified:	2023-12-24 10:15 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description John Helmert III archtester

2022-09-24 19:42:57 UTC

Details at URL, fixes are in 14.20.1, 16.17.1, 18.9.1.

Comment 1 John Helmert III archtester

2022-09-24 19:45:10 UTC

Note that CVE-2022-32212 and CVE-2022-32213 from bug 857111 are in this advisory too as incomplete fixes.

Comment 2 Larry the Git Cow gentoo-dev

2022-09-25 03:59:08 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=66f14e514723b54528dee2a0bbcd38a795926a4f

commit 66f14e514723b54528dee2a0bbcd38a795926a4f
Author:     William Hubbs <williamh@gentoo.org>
AuthorDate: 2022-09-25 03:58:21 +0000
Commit:     William Hubbs <williamh@gentoo.org>
CommitDate: 2022-09-25 03:58:59 +0000

    net-libs/nodejs: add 14.20.1, 16.17.1, 18.9.1
    
    Bug: https://bugs.gentoo.org/872692
    Signed-off-by: William Hubbs <williamh@gentoo.org>

 net-libs/nodejs/Manifest              |   3 +
 net-libs/nodejs/nodejs-14.20.1.ebuild | 240 ++++++++++++++++++++++++++++++++
 net-libs/nodejs/nodejs-16.17.1.ebuild | 232 +++++++++++++++++++++++++++++++
 net-libs/nodejs/nodejs-18.9.1.ebuild  | 250 ++++++++++++++++++++++++++++++++++
 4 files changed, 725 insertions(+)

Comment 3 Larry the Git Cow gentoo-dev

2022-09-25 17:21:37 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=73705b2078a9c825efd2fe23bbeb9e6400a1edb4

commit 73705b2078a9c825efd2fe23bbeb9e6400a1edb4
Author:     William Hubbs <williamh@gentoo.org>
AuthorDate: 2022-09-25 17:19:42 +0000
Commit:     William Hubbs <williamh@gentoo.org>
CommitDate: 2022-09-25 17:21:05 +0000

    net-libs/nodejs: drop vulnerable versions
    
    Bug: https://bugs.gentoo.org/872692
    Signed-off-by: William Hubbs <williamh@gentoo.org>

 net-libs/nodejs/Manifest              |   6 -
 net-libs/nodejs/nodejs-14.20.0.ebuild | 240 --------------------------------
 net-libs/nodejs/nodejs-16.16.0.ebuild | 225 ------------------------------
 net-libs/nodejs/nodejs-16.17.0.ebuild | 232 -------------------------------
 net-libs/nodejs/nodejs-18.6.0.ebuild  | 225 ------------------------------
 net-libs/nodejs/nodejs-18.7.0.ebuild  | 243 ---------------------------------
 net-libs/nodejs/nodejs-18.9.0.ebuild  | 250 ----------------------------------
 7 files changed, 1421 deletions(-)

Comment 4 John Helmert III archtester

2022-09-26 17:59:38 UTC

Thanks!