nodejs July 2015

nodejs@lists.fedoraproject.org

4 participants
4 discussions

Help needed to update nodejs-mkdirp
by Eduardo A. Mayorga 26 Jul '15

26 Jul '15

Hi, nodejs-mkdirp is out of date and is blocking the import of one of my packages. I would appreciate the help from a provenpackager who pushes an update for this package. This is needed by a dependency of python-frappe, a web framework I proposed as a change for F23. The deadline is on Tuesday. https://bugzilla.redhat.com/show_bug.cgi?id=1090919 Thanks, Eduardo -- http://about.me/mayorgatellez

2 1

package review help for new dependencies
by Parag Nemade 14 Jul '15

14 Jul '15

Hi, I saw since last few days some nodejs packages are having broken dependencies. I checked them and found 2 packages are in need of 2 new dependencies. I have already submitted them in last week for package review. Can someone help with these package reviews so that I can fix the broken dependencies in rawhide? 1) https://bugzilla.redhat.com/show_bug.cgi?id=1241419 2) https://bugzilla.redhat.com/show_bug.cgi?id=1241423 Feel free to ask any package review in return for these :) Regards, Parag.

1 0

Node.js Security Update - Fedora/EPEL not affected
by T.C. Hollingsworth 05 Jul '15

05 Jul '15

Node.js announced a security release this weekend. According to upstream's official release announcment, this vulnerability does not, nor has it ever affected the 0.10.x series as shipped in all current releases of Fedora and EPEL. There is no need to update your systems; they were never vulnerable. Thanks, T.C. ---------- Forwarded message ---------- From: Rod Vagg <rvagg(a)nodesource.com> Date: Fri, Jul 3, 2015 at 8:47 PM Subject: NODE.JS SECURITY: Node.js v0.12.6 and io.js v2.3.3 To: security(a)nodejs.org Bcc: tchollingsworth(a)gmail.com The Node.js Foundation TSC sincerely apologizes for the rushed handling of this security fix. Evening in the USA on the weekend of the 4th of July is not ideal and we would have preferred make a more measured response to this incident. We made the call to push forward because details about the bug and potential exploit has inadvertently made its way to a public forum. We decided that we would rather provide companies and users the tools to protect themselves and mitigate DoS attacks if they become a reality. If you are using Node.js v0.12 or any version if io.js please upgrade. Node.js v0.10 is not affected. * Node.js v0.12.6 is available at http://nodejs.org/dist/latest/ * io.js v2.3.3 is available at https://iojs.org/dist/latest/ * io.js v1.8.3 is available at https://iojs.org/dist/v1.8.3/ for any users still on v1.8. The quick summary of the bug: Kris Reeves and Trevor Norris pinpointed a bug in V8 in the way it decodes UTF strings. This impacts Node at `Buffer` to UTF8 `String` conversions and can cause a process to crash. The security concern comes from the fact that a lot of data from outside of an application is delivered to Node via this mechanism which means that users can potentially deliver specially crafted input data that can cause an application to crash when it goes through this path. We know that most networking and filesystem operations are impacted as would be many user-land uses of `Buffer` to UTF8 `String` conversion. We know that HTTP(S) header parsing is _not_ vulnerable because Node does not convert this data as UTF8. This is a small consolation because it restricts the way HTTP(S) can be exploited but there is more to HTTP(S) than header parsing obviously and we have confirmed that HTTP(S) is vulnerable via body parsing. We also have no information yet on how the various TLS terminators and forward-proxies in use may potentially mitigate against the form of data required for this exploit but it would be safe to assume that these are not a protective layer against a DoS attack. An initial ETA provided was midday PDT on the 3rd, that was based on the information we had available. Unfortunately, the patch was not quite ready and there was an extended test and verification process for V8, io.js and Node.js during the day. The builds also take some time on top of that, hence the delay. Fedor Indutny created the fix, Ben Noordhuis, Trevor Norris, Julien Gilli, Michael Dawson and Jeremiah Senkpiel all worked very hard to make this land successfully. If you have any further questions or concerns please contact us at security(a)nodejs.org or respond to this email. - Node.js Foundation TSC

1 0

Review swap
by Parag Nemade 03 Jul '15

03 Jul '15

Hi, As few my packages are getting updates, I got new dependencies to be packaged in Fedora. I submitted 2 package reviews https://bugzilla.redhat.com/show_bug.cgi?id=1239106 and https://bugzilla.redhat.com/show_bug.cgi?id=1239107. If anyone want to swap the reviews do reply me. Regards, Parag.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

nodejs July 2015