Subject: CVS commit: pkgsrc/lang/nodejs20
From: Adam Ciarcinski
Date: 2024-02-14 22:16:23
Message id: 20240214211623.3F846F9ED@cvs.NetBSD.org

Log Message:
nodejs20: updated to 20.11.1

Version 20.11.1 'Iron' (LTS)

Notable changes

CVE-2024-21892 - Code injection and privilege escalation through Linux \ 
capabilities- (High)
CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk \ 
extension allows DoS attacks- (High)
CVE-2024-21896 - Path traversal by monkey-patching Buffer internals- (High)
CVE-2024-22017 - setuid() does not drop all privileges due to io_uring - (High)
CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of \ 
the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
CVE-2024-21891 - Multiple permission model bypasses due to improper path \ 
traversal sequence sanitization - (Medium)
CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and \ 
--allow-fs-write (Medium)
CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli \ 
decoding - (Medium)
undici version 5.28.3
libuv version 1.48.0
OpenSSL version 3.0.13+quic1

Files:
RevisionActionfile
1.6modifypkgsrc/lang/nodejs20/Makefile
1.5modifypkgsrc/lang/nodejs20/distinfo