Resolves CVE-2021-22883 CVE-2021-22884

Rebase, remove ini patch

Resolves RHBZ#1930775
remove --debug-nghttp2 option
Resolves: RHBZ#1934566, RHBZ#1934599
This commit is contained in:
Zuzana Svetlikova 2021-03-01 14:05:17 +01:00
parent d86a7d7568
commit 8ae1d83ebf
3 changed files with 20 additions and 13 deletions

1
.gitignore vendored
View File

@ -13,3 +13,4 @@
/node-v14.11.0-stripped.tar.gz
/node-v14.15.0-stripped.tar.gz
/node-v14.15.4-stripped.tar.gz
/node-v14.16.0-stripped.tar.gz

View File

@ -26,8 +26,8 @@
# than a Fedora release lifecycle.
%global nodejs_epoch 1
%global nodejs_major 14
%global nodejs_minor 15
%global nodejs_patch 4
%global nodejs_minor 16
%global nodejs_patch 0
%global nodejs_abi %{nodejs_major}.%{nodejs_minor}
%if %{?with_libs} == 1
# nodejs_soversion - from NODE_MODULE_VERSION in src/node_version.h
@ -110,7 +110,7 @@
%global npm_epoch 1
%global npm_major 6
%global npm_minor 14
%global npm_patch 10
%global npm_patch 11
%global npm_version %{npm_major}.%{npm_minor}.%{npm_patch}
# uvwasi - from deps/uvwasi/include/uvwasi.h
@ -171,9 +171,8 @@ Patch3: 0003-yarn-not-installable-on-aarch64.patch
# CVE-2020-7774
Patch4: 0004-CVE-2020-7774-nodejs-y18n-prototype-pollution-vulnerability.patch
# CVE-2020-7788
Patch5: 0005-CVE-2020-7788-ini-do-not-allow-invalid-hazardous-string.patch
BuildRequires: make
BuildRequires: python3-devel
BuildRequires: zlib-devel
BuildRequires: brotli-devel
@ -444,7 +443,6 @@ export LDFLAGS="%{build_ldflags}"
--shared-brotli \
--without-dtrace \
--with-intl=small-icu \
--debug-nghttp2 \
--openssl-use-def-ca-store
%else
%{__python3} configure.py --prefix=%{_prefix} \
@ -458,7 +456,6 @@ export LDFLAGS="%{build_ldflags}"
--with-dtrace \
--with-intl=small-icu \
--with-icu-default-data-dir=%{icudatadir} \
--debug-nghttp2 \
--openssl-use-def-ca-store
%endif
%else
@ -469,7 +466,6 @@ export LDFLAGS="%{build_ldflags}"
--shared-brotli \
--without-dtrace \
--with-intl=small-icu \
--debug-nghttp2 \
--openssl-use-def-ca-store
%else
%{__python3} configure.py --prefix=%{_prefix} \
@ -481,7 +477,6 @@ export LDFLAGS="%{build_ldflags}"
--with-dtrace \
--with-intl=small-icu \
--with-icu-default-data-dir=%{icudatadir} \
--debug-nghttp2 \
--openssl-use-def-ca-store
%endif
%endif
@ -546,6 +541,7 @@ for header in %{buildroot}%{_includedir}/node/libplatform %{buildroot}%{_include
header=$(basename ${header})
ln -s %{_includedir}/node/${header} %{buildroot}%{_includedir}/${header}
done
ln -s ./node/cppgc %{buildroot}%{_includedir}/cppgc
for soname in libv8 libv8_libbase libv8_libplatform; do
ln -s %{_libdir}/libnode.so.%{nodejs_soversion} %{buildroot}%{_libdir}/${soname}.so
ln -s %{_libdir}/libnode.so.%{nodejs_soversion} %{buildroot}%{_libdir}/${soname}.so.%{v8_major}
@ -682,7 +678,7 @@ if st and st.type == "directory" then
end
end
-- Replace the npm HTML docs directory with a symlink
-- Replace the npm docs directory with a symlink
-- Drop this scriptlet when F31 is EOL
path = "%{_prefix}/lib/node_modules/npm/html"
st = posix.stat(path)
@ -698,7 +694,7 @@ if st and st.type == "directory" then
end
end
-- Replace the npm HTML man directory with a symlink
-- Replace the npm man directory with a symlink
-- Drop this scriptlet when F31 is EOL
path = "%{_prefix}/lib/node_modules/npm/man"
st = posix.stat(path)
@ -786,6 +782,7 @@ end
%files -n v8-devel
%{_includedir}/libplatform
%{_includedir}/v8*.h
%{_includedir}/cppgc
%{_libdir}/libv8.so
%{_libdir}/libv8_libbase.so
%{_libdir}/libv8_libplatform.so
@ -828,6 +825,15 @@ end
%changelog
* Mon Mar 01 2021 Zuzana Svetlikova <zsvetlik@redhat.com> - 1:14.16.0-2
- Resolves RHBZ#1930775
- remove --debug-nghttp2 option
* Mon Mar 01 2021 Zuzana Svetlikova <zsvetlik@redhat.com> - 1:14.16.0-1
- Resolves CVE-2021-22883 CVE-2021-22884
- Resolves: RHBZ#1934566, RHBZ#1934599
- Rebase, remove ini patch
* Tue Jan 26 2021 Zuzana Svetlikova <zsvetlik@redhat.com> - 1:14.15.4-2
- Add patch for yarn crash
- Resolves: RHBZ#1915296

View File

@ -1,2 +1,2 @@
488cb27eb0fa484db7bd3b48552113f7 node-v14.15.4-stripped.tar.gz
c4d62b497cbd89ab2a9ca6b543e57b30 icu4c-67_1-src.tgz
SHA512 (node-v14.16.0-stripped.tar.gz) = 57e761f5584f9239aaf6a77426578608fd8ab9a02ed6f676102dbf2aa7c914221800526e98839a5e4eaefe3e24810b24d70392caacb23c307e99208aa61b4663
SHA512 (icu4c-67_1-src.tgz) = 4779f1ce1ca7976f6fad6768853ea8c540da54d11509e3b6cfd864a04b5f2db1c3d4b546387f91ad02fb90804525bc37d2543173f0d705d6ca11dc6f2b7640a8