Bug 17305 - nodejs new security issue CVE-2015-8027
Summary: nodejs new security issue CVE-2015-8027
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: Cauldron
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: Joseph Wang
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/666960/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-12-07 17:10 CET by David Walser
Modified: 2016-01-12 18:48 CET (History)
0 users

See Also:
Source RPM: nodejs-0.10.38-1.mga5.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2015-12-07 17:10:23 CET 
Upstream has issued an advisory on December 4:
https://nodejs.org/en/blog/vulnerability/december-2015-security-releases/

The issue is fixed upstream in 0.10.41:
https://nodejs.org/en/blog/release/v0.10.41/

Mageia 5 is also affected.

Reproducible: 

Steps to Reproduce:
David Walser 2015-12-07 17:10:30 CET

Whiteboard: (none) => MGA5TOO

Comment 1 David Walser 2016-01-12 18:48:03 CET 
Joseph updated Cauldron to version 5.3.0.

I just noticed that CVE-2015-8027 doesn't affect 0.10.x.

I'll open a new bug for the 0.10.41 bugfix release.

Status: NEW => RESOLVED
Resolution: (none) => FIXED
Whiteboard: MGA5TOO => (none)
Note You need to log in before you can comment on or make changes to this bug.