Resolves CVE-2021-22883 CVE-2021-22884

Rebase, remove ini patch

Resolves RHBZ#1930775
remove --debug-nghttp2 option
Resolves: RHBZ#1934566, RHBZ#1934599

.gitignore

@@ -13,3 +13,4 @@
 /node-v14.11.0-stripped.tar.gz
 /node-v14.15.0-stripped.tar.gz
 /node-v14.15.4-stripped.tar.gz
+/node-v14.16.0-stripped.tar.gz

nodejs.spec

@@ -26,8 +26,8 @@
 # than a Fedora release lifecycle.
 %global nodejs_epoch 1
 %global nodejs_major 14
-%global nodejs_minor 15
-%global nodejs_patch 4
+%global nodejs_minor 16
+%global nodejs_patch 0
 %global nodejs_abi %{nodejs_major}.%{nodejs_minor}
 %if %{?with_libs} == 1
 # nodejs_soversion - from NODE_MODULE_VERSION in src/node_version.h
@@ -110,7 +110,7 @@
 %global npm_epoch 1
 %global npm_major 6
 %global npm_minor 14
-%global npm_patch 10
+%global npm_patch 11
 %global npm_version %{npm_major}.%{npm_minor}.%{npm_patch}
 
 # uvwasi - from deps/uvwasi/include/uvwasi.h
@@ -171,9 +171,8 @@ Patch3: 0003-yarn-not-installable-on-aarch64.patch
 # CVE-2020-7774
 Patch4: 0004-CVE-2020-7774-nodejs-y18n-prototype-pollution-vulnerability.patch
 
-# CVE-2020-7788
-Patch5: 0005-CVE-2020-7788-ini-do-not-allow-invalid-hazardous-string.patch
 
+BuildRequires: make
 BuildRequires: python3-devel
 BuildRequires: zlib-devel
 BuildRequires: brotli-devel
@@ -444,7 +443,6 @@ export LDFLAGS="%{build_ldflags}"
            --shared-brotli \
            --without-dtrace \
            --with-intl=small-icu \
-           --debug-nghttp2 \
            --openssl-use-def-ca-store
 %else
 %{__python3} configure.py --prefix=%{_prefix} \
@@ -458,7 +456,6 @@ export LDFLAGS="%{build_ldflags}"
            --with-dtrace \
            --with-intl=small-icu \
            --with-icu-default-data-dir=%{icudatadir} \
-           --debug-nghttp2 \
            --openssl-use-def-ca-store
 %endif
 %else
@@ -469,7 +466,6 @@ export LDFLAGS="%{build_ldflags}"
            --shared-brotli \
            --without-dtrace \
            --with-intl=small-icu \
-           --debug-nghttp2 \
            --openssl-use-def-ca-store
 %else
 %{__python3} configure.py --prefix=%{_prefix} \
@@ -481,7 +477,6 @@ export LDFLAGS="%{build_ldflags}"
            --with-dtrace \
            --with-intl=small-icu \
            --with-icu-default-data-dir=%{icudatadir} \
-           --debug-nghttp2 \
            --openssl-use-def-ca-store
 %endif
 %endif
@@ -546,6 +541,7 @@ for header in %{buildroot}%{_includedir}/node/libplatform %{buildroot}%{_include
     header=$(basename ${header})
     ln -s %{_includedir}/node/${header} %{buildroot}%{_includedir}/${header}
 done
+ln -s ./node/cppgc %{buildroot}%{_includedir}/cppgc
 for soname in libv8 libv8_libbase libv8_libplatform; do
     ln -s %{_libdir}/libnode.so.%{nodejs_soversion} %{buildroot}%{_libdir}/${soname}.so
     ln -s %{_libdir}/libnode.so.%{nodejs_soversion} %{buildroot}%{_libdir}/${soname}.so.%{v8_major}
@@ -682,7 +678,7 @@ if st and st.type == "directory" then
   end
 end
 
--- Replace the npm HTML docs directory with a symlink
+-- Replace the npm docs directory with a symlink
 -- Drop this scriptlet when F31 is EOL
 path = "%{_prefix}/lib/node_modules/npm/html"
 st = posix.stat(path)
@@ -698,7 +694,7 @@ if st and st.type == "directory" then
   end
 end
 
--- Replace the npm HTML man directory with a symlink
+-- Replace the npm man directory with a symlink
 -- Drop this scriptlet when F31 is EOL
 path = "%{_prefix}/lib/node_modules/npm/man"
 st = posix.stat(path)
@@ -786,6 +782,7 @@ end
 %files -n v8-devel
 %{_includedir}/libplatform
 %{_includedir}/v8*.h
+%{_includedir}/cppgc
 %{_libdir}/libv8.so
 %{_libdir}/libv8_libbase.so
 %{_libdir}/libv8_libplatform.so
@@ -828,6 +825,15 @@ end
 
 
 %changelog
+* Mon Mar 01 2021 Zuzana Svetlikova <zsvetlik@redhat.com> - 1:14.16.0-2
+- Resolves RHBZ#1930775
+- remove --debug-nghttp2 option
+
+* Mon Mar 01 2021 Zuzana Svetlikova <zsvetlik@redhat.com> - 1:14.16.0-1
+- Resolves CVE-2021-22883 CVE-2021-22884
+- Resolves: RHBZ#1934566, RHBZ#1934599
+- Rebase, remove ini patch
+
 * Tue Jan 26 2021 Zuzana Svetlikova <zsvetlik@redhat.com> - 1:14.15.4-2
 - Add patch for yarn crash
 - Resolves: RHBZ#1915296

sources

@@ -1,2 +1,2 @@
-488cb27eb0fa484db7bd3b48552113f7  node-v14.15.4-stripped.tar.gz
-c4d62b497cbd89ab2a9ca6b543e57b30  icu4c-67_1-src.tgz
+SHA512 (node-v14.16.0-stripped.tar.gz) = 57e761f5584f9239aaf6a77426578608fd8ab9a02ed6f676102dbf2aa7c914221800526e98839a5e4eaefe3e24810b24d70392caacb23c307e99208aa61b4663
+SHA512 (icu4c-67_1-src.tgz) = 4779f1ce1ca7976f6fad6768853ea8c540da54d11509e3b6cfd864a04b5f2db1c3d4b546387f91ad02fb90804525bc37d2543173f0d705d6ca11dc6f2b7640a8