Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 12 Jun 2020 04:47:06 +0000 (UTC)
From:      "Bradley T. Hughes" <bhughes@FreeBSD.org>
To:        ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org
Subject:   svn commit: r538562 - head/security/vuxml
Message-ID:  <202006120447.05C4l6io051630@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: bhughes
Date: Fri Jun 12 04:47:06 2020
New Revision: 538562
URL: https://svnweb.freebsd.org/changeset/ports/538562

Log:
  security/vuxml: document Node.js June 2020 Security Releases
  
  https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/
  
  Sponsored by:	Miles AS

Modified:
  head/security/vuxml/vuln.xml

Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml	Fri Jun 12 04:17:12 2020	(r538561)
+++ head/security/vuxml/vuln.xml	Fri Jun 12 04:47:06 2020	(r538562)
@@ -58,6 +58,72 @@ Notes:
   * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">;
+  <vuln vid="11fcfa8f-ac64-11ea-9dab-000d3ab229d6">
+    <topic>Node.js -- June 2020 Security Releases</topic>
+    <affects>
+      <package>
+	<name>node</name>
+	<range><lt>14.4.0</lt></range>
+      </package>
+      <package>
+	<name>node12</name>
+	<range><lt>12.18.0</lt></range>
+      </package>
+      <package>
+	<name>node10</name>
+	<range><lt>10.21.0</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">;
+	<p>Node.js reports:</p>
+	<blockquote cite="https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/">;
+	  <p>Updates are now available for all supported Node.js release lines for the following issues.</p>
+    <h1>TLS session reuse can lead to host certificate verification bypass (High) (CVE-2020-8172)</h1>
+    <p>The 'session' event could be emitted before the 'secureConnect' event. It should not be, because the
+      connection may fail to be authorized. If it was saved an authorized connection could be established
+      later with the session ticket. Note that the https agent caches sessions, so is vulnerable to this.</p>
+    <p>The 'session' event will now only be emitted after the 'secureConnect' event, and only for authorized
+      connections.</p>
+    <h1>HTTP/2 Large Settings Frame DoS (Low) (CVE-2020-11080)</h1>
+    <p>Receiving unreasonably large HTTP/2 SETTINGS frames can consume 100% CPU to process all the settings,
+      blocking all other activities until complete.</p>
+    <p>The HTTP/2 session frame is limited to 32 settings by default. This can be configured if necessary
+      using the maxSettings option.</p>
+    <h1>napi_get_value_string_*() allows various kinds of memory corruption (High) (CVE-2020-8174)</h1>
+    <p>Calling napi_get_value_string_latin1(), napi_get_value_string_utf8(), or napi_get_value_string_utf16()
+      with a non-NULL buf, and a bufsize of 0 will cause the entire string value to be written to buf,
+      probably overrunning the length of the buffer.</p>
+    <p>A exploit has not been reported and it may be difficult but the following is suggested:</p>
+    <ul>
+      <li>All users of LTS Node.js versions should update to the versions announced in this security post.
+	This will address the issue for any non pre-built add-on.</li>
+      <li>Maintainers who support EOL Node.js versions and/or build against a version of Node.js that did not
+	support N-API internally should update to use the new versions of node-addon-api 1.x and 2.x that
+	will be released soon after this announcement.</li>
+    </ul>
+    <h1>ICU-20958 Prevent SEGV_MAPERR in append (High) (CVE-2020-10531)</h1>
+    <p>An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An
+      integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend()
+      function in common/unistr.cpp.</p>
+    <p>Fix was applied to 10.x in an abundance of caution, even though there is no known way to trigger the
+      overflow in 10.x.</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <url>https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/</url>;
+      <cvename>CVE-2020-8174</cvename>
+      <cvename>CVE-2020-8172</cvename>
+      <cvename>CVE-2020-10531</cvename>
+      <cvename>CVE-2020-11080</cvename>
+    </references>
+    <dates>
+      <discovery>2020-06-02</discovery>
+      <entry>2020-06-12</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="045e46e8-abe6-11ea-99cb-10bf48e1088e">
     <topic>tcpreplay -- Multiple vulnerabilities</topic>
     <affects>



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202006120447.05C4l6io051630>