Bug 22106

Summary:	nodejs-brace-expansion new security issue fixed upstream in 1.1.7
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	Joseph Wang <joequant>
Status:	RESOLVED OLD	QA Contact:	Sec team <security>
Severity:	major
Priority:	Normal	CC:	mhrambo3501
Version:	6
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:
Source RPM:	nodejs-brace-expansion-1.1.3-1.mga6.src.rpm, nodejs-balanced-match-0.3.0-1.mga6.src.rpm	CVE:
Status comment:	Fixed upstream in 1.1.7

Description David Walser 2017-12-01 18:27:18 CET

Fedora has issued advisories today (December 1):
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/3VBVLTX62FANCFWMMYPLLMUKVUIZPLMD/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/URTVMJOUT2BSFE753CV2RQTV2DRVLYTV/

The issue is fixed in nodejs-brace-expansion 1.1.7.

I'm not sure what the nodejs-balanced-match is (possibly a rebuild).

David Walser 2018-02-02 18:23:36 CET

Status comment: (none) => Fixed upstream in 1.1.7

Comment 1 Mike Rambo 2019-11-06 13:17:10 CET

Mageia 6 is EOL.

Status: NEW => RESOLVED
Resolution: (none) => OLD
CC: (none) => mrambo