* [Buildroot] [PATCH 1/1] package/nodejs: security bump to version 8.11.3
@ 2018-06-16 22:44 Martin Bark
2018-06-17 12:04 ` Thomas Petazzoni
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Martin Bark @ 2018-06-16 22:44 UTC (permalink / raw)
To: buildroot
Fixes the following security issues:
- (CVE-2018-7167): Fixes Denial of Service vulnerability where calling
Buffer.fill() could hang
- (CVE-2018-7161): Fixes Denial of Service vulnerability by updating the
http2 implementation to not crash under certain circumstances during
cleanup
- (CVE-2018-1000168): Fixes Denial of Service vulnerability by upgrading
nghttp2 to 1.32.0
See https://nodejs.org/en/blog/release/v8.11.3/ for more details
Signed-off-by: Martin Bark <martin@barkynet.com>
---
package/nodejs/nodejs.hash | 4 ++--
package/nodejs/nodejs.mk | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/package/nodejs/nodejs.hash b/package/nodejs/nodejs.hash
index 25b035d694..be4c3de4f7 100644
--- a/package/nodejs/nodejs.hash
+++ b/package/nodejs/nodejs.hash
@@ -1,5 +1,5 @@
-# From http://nodejs.org/dist/v8.11.2/SHASUMS256.txt
-sha256 539946c0381809576bed07424a35fc1740d52f4bd56305d6278d9e76c88f4979 node-v8.11.2.tar.xz
+# From http://nodejs.org/dist/v8.11.3/SHASUMS256.txt
+sha256 577c751fdca91c46c60ffd8352e5b465881373bfdde212c17c3a3c1bd2616ee0 node-v8.11.3.tar.xz
# Hash for license file
sha256 b87be6c1479ed977481115869c2dd8b6d59e5ea55aa09939d6c898242121b2f5 LICENSE
diff --git a/package/nodejs/nodejs.mk b/package/nodejs/nodejs.mk
index 0c7db83012..61cd03bb8f 100644
--- a/package/nodejs/nodejs.mk
+++ b/package/nodejs/nodejs.mk
@@ -4,7 +4,7 @@
#
################################################################################
-NODEJS_VERSION = 8.11.2
+NODEJS_VERSION = 8.11.3
NODEJS_SOURCE = node-v$(NODEJS_VERSION).tar.xz
NODEJS_SITE = http://nodejs.org/dist/v$(NODEJS_VERSION)
NODEJS_DEPENDENCIES = host-python host-nodejs c-ares \
--
2.17.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [Buildroot] [PATCH 1/1] package/nodejs: security bump to version 8.11.3
2018-06-16 22:44 [Buildroot] [PATCH 1/1] package/nodejs: security bump to version 8.11.3 Martin Bark
@ 2018-06-17 12:04 ` Thomas Petazzoni
2018-06-17 15:57 ` Peter Korsgaard
2018-07-17 7:29 ` Peter Korsgaard
2 siblings, 0 replies; 4+ messages in thread
From: Thomas Petazzoni @ 2018-06-17 12:04 UTC (permalink / raw)
To: buildroot
Hello,
On Sat, 16 Jun 2018 23:44:08 +0100, Martin Bark wrote:
> Fixes the following security issues:
>
> - (CVE-2018-7167): Fixes Denial of Service vulnerability where calling
> Buffer.fill() could hang
>
> - (CVE-2018-7161): Fixes Denial of Service vulnerability by updating the
> http2 implementation to not crash under certain circumstances during
> cleanup
>
> - (CVE-2018-1000168): Fixes Denial of Service vulnerability by upgrading
> nghttp2 to 1.32.0
>
> See https://nodejs.org/en/blog/release/v8.11.3/ for more details
>
> Signed-off-by: Martin Bark <martin@barkynet.com>
> ---
> package/nodejs/nodejs.hash | 4 ++--
> package/nodejs/nodejs.mk | 2 +-
> 2 files changed, 3 insertions(+), 3 deletions(-)
Applied to master, thanks.
Thomas
--
Thomas Petazzoni, CTO, Bootlin (formerly Free Electrons)
Embedded Linux and Kernel engineering
https://bootlin.com
^ permalink raw reply [flat|nested] 4+ messages in thread
* [Buildroot] [PATCH 1/1] package/nodejs: security bump to version 8.11.3
2018-06-16 22:44 [Buildroot] [PATCH 1/1] package/nodejs: security bump to version 8.11.3 Martin Bark
2018-06-17 12:04 ` Thomas Petazzoni
@ 2018-06-17 15:57 ` Peter Korsgaard
2018-07-17 7:29 ` Peter Korsgaard
2 siblings, 0 replies; 4+ messages in thread
From: Peter Korsgaard @ 2018-06-17 15:57 UTC (permalink / raw)
To: buildroot
>>>>> "Martin" == Martin Bark <martin@barkynet.com> writes:
> Fixes the following security issues:
> - (CVE-2018-7167): Fixes Denial of Service vulnerability where calling
> Buffer.fill() could hang
> - (CVE-2018-7161): Fixes Denial of Service vulnerability by updating the
> http2 implementation to not crash under certain circumstances during
> cleanup
> - (CVE-2018-1000168): Fixes Denial of Service vulnerability by upgrading
> nghttp2 to 1.32.0
> See https://nodejs.org/en/blog/release/v8.11.3/ for more details
> Signed-off-by: Martin Bark <martin@barkynet.com>
Committed to 2018.02.x, thanks.
--
Bye, Peter Korsgaard
^ permalink raw reply [flat|nested] 4+ messages in thread
* [Buildroot] [PATCH 1/1] package/nodejs: security bump to version 8.11.3
2018-06-16 22:44 [Buildroot] [PATCH 1/1] package/nodejs: security bump to version 8.11.3 Martin Bark
2018-06-17 12:04 ` Thomas Petazzoni
2018-06-17 15:57 ` Peter Korsgaard
@ 2018-07-17 7:29 ` Peter Korsgaard
2 siblings, 0 replies; 4+ messages in thread
From: Peter Korsgaard @ 2018-07-17 7:29 UTC (permalink / raw)
To: buildroot
>>>>> "Martin" == Martin Bark <martin@barkynet.com> writes:
> Fixes the following security issues:
> - (CVE-2018-7167): Fixes Denial of Service vulnerability where calling
> Buffer.fill() could hang
> - (CVE-2018-7161): Fixes Denial of Service vulnerability by updating the
> http2 implementation to not crash under certain circumstances during
> cleanup
> - (CVE-2018-1000168): Fixes Denial of Service vulnerability by upgrading
> nghttp2 to 1.32.0
> See https://nodejs.org/en/blog/release/v8.11.3/ for more details
> Signed-off-by: Martin Bark <martin@barkynet.com>
Committed to 2018.05.x, thanks.
--
Bye, Peter Korsgaard
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2018-07-17 7:29 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-06-16 22:44 [Buildroot] [PATCH 1/1] package/nodejs: security bump to version 8.11.3 Martin Bark
2018-06-17 12:04 ` Thomas Petazzoni
2018-06-17 15:57 ` Peter Korsgaard
2018-07-17 7:29 ` Peter Korsgaard
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox