--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2021-9818cabe0d
2021-10-29 22:48:33.393275
--------------------------------------------------------------------------------
Name : nodejs
Product : Fedora 35
Version : 16.11.1
Release : 1.fc35
URL :
http://nodejs.org/
Summary : JavaScript runtime
Description :
Node.js is a platform built on Chrome's JavaScript runtime
for easily building fast, scalable network applications.
Node.js uses an event-driven, non-blocking I/O model that
makes it lightweight and efficient, perfect for data-intensive
real-time applications that run across distributed devices.
--------------------------------------------------------------------------------
Update Information:
## 2021-10-12, Version 16.11.1 (Current), @danielleadams This is a security
release. ### Notable changes * **CVE-2021-22959**: HTTP Request Smuggling due
to spaced in headers (Medium) * The http parser accepts requests with a space
(SP) right after the header name before the colon. This can lead to HTTP Request
Smuggling (HRS). More details will be available at
[
CVE-2021-22959](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2...
after publication. * **CVE-2021-22960**: HTTP Request Smuggling when parsing the
body (Medium) * The parse ignores chunk extensions when parsing the body of
chunked requests. This leads to HTTP Request Smuggling (HRS) under certain
conditions. More details will be available at
[
CVE-2021-22960](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-2...
after publication. ## 2021-10-08, Version 16.11.0 (Current), @danielleadams
### Notable Changes * **crypto** * update root certificates (Richard Lau)
[#40280](https://github.com/nodejs/node/pull/40280) * **deps** * upgrade npm
to 8.0.0 (npm team) [#40369](https://github.com/nodejs/node/pull/40369) *
update `nghttp2` to v1.45.1 (thunder-coding)
[#40206](https://github.com/nodejs/node/pull/40206) * update V8 to 9.4.146.19
(Micha��l Zasso) [#40285](https://github.com/nodejs/node/pull/40285) * **tools**
* update certdata.txt (Richard Lau)
[#40280](https://github.com/nodejs/node/pull/40280)
--------------------------------------------------------------------------------
ChangeLog:
* Wed Oct 13 2021 Stephen Gallagher <sgallagh(a)redhat.com> - 1:16.11.1-1
- Update to 16.11.1
-
https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V16.m...
-
https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V16.m...
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2014057 - CVE-2021-22959 llhttp: HTTP Request Smuggling due to spaced in
headers
https://bugzilla.redhat.com/show_bug.cgi?id=2014057
[ 2 ] Bug #2014059 - CVE-2021-22960 llhttp: HTTP Request Smuggling when parsing the
body
https://bugzilla.redhat.com/show_bug.cgi?id=2014059
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2021-9818cabe0d' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------