nodejs - Debian Package Tracker

general

source: nodejs (main)
version: 18.7.0+dfsg-5
maintainer: Debian Javascript Maintainers (archive) (DMD)
uploaders: Jonas Smedegaard [DMD] – Jérémy Lal [DMD]
arch: all amd64 arm64 armel armhf i386 kfreebsd-amd64 kfreebsd-i386 mips mips64el mipsel powerpc ppc64 ppc64el s390x
std-ver: 4.6.1.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 4.8.2~dfsg-1
o-o-bpo: 8.11.1~dfsg-2~bpo9+1
oldstable: 10.24.0~dfsg-1~deb10u1
old-sec: 10.24.0~dfsg-1~deb10u1
stable: 12.22.5~dfsg-2~11u1
stable-sec: 12.22.12~dfsg-1~deb11u1
testing: 18.7.0+dfsg-5
unstable: 18.7.0+dfsg-5
exp: 18.8.0+dfsg-1

versioned links

4.8.2~dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
8.11.1~dfsg-2~bpo9+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
10.24.0~dfsg-1~deb10u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
12.22.5~dfsg-2~11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
12.22.12~dfsg-1~deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
18.7.0+dfsg-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
18.8.0+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libnode-dev (1 bugs: 0, 1, 0, 0)
libnode108
nodejs (15 bugs: 0, 14, 1, 0)
nodejs-doc (1 bugs: 0, 1, 0, 0)

action needed

Debci reports failed tests high

unstable: fail (log)
The tests ran in 0:04:44
Last run: 2022-09-24T06:45:29.000Z
Previous status: tmpfail

testing: pass (log)
The tests ran in 0:24:25
Last run: 2022-09-27T12:35:56.000Z
Previous status: tmpfail

stable: pass (log)
The tests ran in 0:14:29
Last run: 2022-09-26T02:29:58.000Z
Previous status: pass

Created: 2022-09-24 Last update: 2022-09-29 14:38

Problems while searching for a new upstream version high

uscan had problems while searching for a new upstream version:

unknown ctype nodejs

Created: 2021-02-12 Last update: 2022-09-29 10:08

A new upstream version is available: 18.10.0 high

A new upstream version 18.10.0 is available, you should consider packaging it.

Created: 2022-08-28 Last update: 2022-09-29 10:08

The VCS repository is not up to date, push the missing commits. high

vcswatch reports that the current version of the package is not in its VCS.
Either you need to push your commits and/or your tags, or the information about the package's VCS are out of date. A common cause of the latter issue when using the Git VCS is not specifying the correct branch when the packaging is not in the default one (remote HEAD branch), which is usually "master" but can be modified in salsa.debian.org in the project's general settings with the "Default Branch" field). Alternatively the Vcs-Git field in debian/control can contain a "-b <branch-name>" suffix to indicate what branch is used for the Debian packaging.

Created: 2022-06-15 Last update: 2022-09-24 23:43

9 security issues in buster high

There are 9 open security issues in buster.

9 important issues:

CVE-2021-22930: Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior.
CVE-2021-22939: If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted.
CVE-2021-44531: Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.
CVE-2021-44532: Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the --security-revert command-line option.
CVE-2021-44533: Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.Affected versions of Node.js that do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.
CVE-2022-21824: Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.
CVE-2022-32212: A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.16.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.
CVE-2022-35255:
CVE-2022-35256:

Created: 2022-07-04 Last update: 2022-09-23 23:00

6 security issues in bullseye high

There are 6 open security issues in bullseye.

6 important issues:

CVE-2022-32212: A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.16.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks.
CVE-2022-32213: The llhttp parser in the http module in Node.js v17.x does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
CVE-2022-32214: The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
CVE-2022-32215: The llhttp parser in the http module in Node v17.6.0 does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
CVE-2022-35255:
CVE-2022-35256:

Created: 2022-07-11 Last update: 2022-09-23 23:00

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2022-35255:
CVE-2022-35256:

Created: 2022-09-23 Last update: 2022-09-23 23:00

2 security issues in bookworm high

There are 2 open security issues in bookworm.

2 important issues:

CVE-2022-35255:
CVE-2022-35256:

Created: 2022-09-23 Last update: 2022-09-23 23:00

2 bugs tagged patch in the BTS normal

The BTS contains patches fixing 2 bugs, consider including or untagging them.

Created: 2022-07-27 Last update: 2022-09-29 15:32

Fails to build during reproducibility testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2022-04-04 Last update: 2022-09-29 14:32

lintian reports 3 warnings normal

Lintian reports 3 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2022-09-02 Last update: 2022-09-02 09:05

Build log checks report 2 warnings low

Build log checks report 2 warnings

Created: 2022-05-16 Last update: 2022-09-02 08:37

testing migrations

This package will soon be part of the auto-icu transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2022-09-29] Accepted nodejs 18.10.0+dfsg-1 (source) into unstable (Jérémy Lal)
[2022-09-06] nodejs 18.7.0+dfsg-5 MIGRATED to testing (Debian testing watch)
[2022-09-04] Accepted nodejs 18.8.0+dfsg-1 (source) into experimental (Jérémy Lal)
[2022-09-04] Accepted nodejs 18.7.0+dfsg-5 (source) into unstable (Jérémy Lal)
[2022-08-30] Accepted nodejs 18.7.0+dfsg-4 (source armel all) into unstable (J=C3=A9r=C3=A9my Lal) (signed by: Jérémy Lal)
[2022-08-20] nodejs 18.7.0+dfsg-1 MIGRATED to testing (Debian testing watch)
[2022-08-12] Accepted nodejs 18.7.0+dfsg-1 (source) into unstable (Jérémy Lal)
[2022-08-10] nodejs 18.6.0+dfsg-5 MIGRATED to testing (Debian testing watch)
[2022-08-04] Accepted nodejs 18.6.0+dfsg-5 (source) into unstable (Jérémy Lal)
[2022-08-01] Accepted nodejs 18.6.0+dfsg-4 (source) into unstable (Jérémy Lal)
[2022-07-23] Accepted nodejs 18.6.0+dfsg-3 (source) into unstable (Jérémy Lal) (signed by: Xavier Guimard)
[2022-07-16] Accepted nodejs 18.6.0+dfsg-2 (source) into experimental (Jérémy Lal)
[2022-07-16] Accepted nodejs 18.6.0+dfsg-1 (source) into experimental (Jérémy Lal)
[2022-07-04] Accepted nodejs 18.4.0+dfsg-2 (source) into experimental (Jérémy Lal)
[2022-06-27] Accepted nodejs 12.22.12~dfsg-1~deb11u1 (source) into stable-security->embargoed, stable-security (Debian FTP Masters) (signed by: Jérémy Lal)
[2022-06-21] Accepted nodejs 18.4.0+dfsg-1 (source) into experimental (Jérémy Lal)
[2022-06-20] nodejs 16.15.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2022-06-14] Accepted nodejs 18.3.0+dfsg-1 (source amd64 all) into experimental, experimental (Debian FTP Masters) (signed by: Jérémy Lal)
[2022-06-13] Accepted nodejs 16.15.1+dfsg-1 (source) into unstable (Jérémy Lal)
[2022-05-27] Accepted nodejs 16.15.0+dfsg-1 (source) into unstable (Jérémy Lal)
[2022-05-13] nodejs 16.14.2+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2022-05-11] Accepted nodejs 16.14.2+dfsg1-1 (source) into unstable (Jérémy Lal)
[2022-05-03] Accepted nodejs 16.14.2+dfsg-5 (source) into unstable (Jérémy Lal)
[2022-05-02] Accepted nodejs 16.14.2+dfsg-4 (source) into unstable (Jérémy Lal)
[2022-04-02] nodejs 16.13.2+really14.19.1~dfsg-6 MIGRATED to testing (Debian testing watch)
[2022-03-29] Accepted nodejs 16.14.2+dfsg-3 (source) into experimental (Jérémy Lal)
[2022-03-29] Accepted nodejs 16.14.2+dfsg-2 (source) into experimental (Jérémy Lal)
[2022-03-26] Accepted nodejs 16.13.2+really14.19.1~dfsg-6 (source) into unstable (Jérémy Lal)
[2022-03-25] Accepted nodejs 16.14.2+dfsg-1 (source ppc64el all) into experimental, experimental (Debian FTP Masters) (signed by: Jérémy Lal)
[2022-03-22] Accepted nodejs 16.13.2+really14.19.1~dfsg-5 (source) into unstable (Jérémy Lal)

bugs [bug history graph]

all: 22 23
RC: 0
I&N: 20 21
M&W: 1
F&P: 1
patch: 2

links

homepage
lintian (0, 3)
buildd: logs, exp, checks, clang, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
screenshots
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 18.7.0+dfsg-5ubuntu1
34 bugs
patches for 18.7.0+dfsg-5ubuntu1