From 14a06990b9ba5106da08168cbd80cae33832501a Mon Sep 17 00:00:00 2001
From: Patrick J Volkerding <volkerdi@slackware.com>
Date: Sat, 17 Feb 2024 21:09:51 +0000
Subject: Sat Feb 17 21:09:51 UTC 2024

l/nodejs-20.11.1-x86_64-1.txz:  Upgraded.
  This update fixes security issues:
  Code injection and privilege escalation through Linux capabilities - (High).
  http: Reading unprocessed HTTP request with unbounded chunk extension allows
  DoS attacks - (High).
  Path traversal by monkey-patching Buffer internals - (High).
  setuid() does not drop all privileges due to io_uring - (High).
  Node.js is vulnerable to the Marvin Attack (timing variant of the
  Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium).
  Multiple permission model bypasses due to improper path traversal sequence
  sanitization - (Medium).
  Improper handling of wildcards in --allow-fs-read and --allow-fs-write -
  (Medium).
  Denial of Service by resource exhaustion in fetch() brotli decoding -
  (Medium).
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21892
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22019
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21896
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22017
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46809
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21891
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21890
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22025
  (* Security fix *)
l/pcre2-10.43-x86_64-1.txz:  Upgraded.
---
 ChangeLog.rss | 40 ++++++++++++++++++++++++++++++++++++++--
 1 file changed, 38 insertions(+), 2 deletions(-)

(limited to 'ChangeLog.rss')

diff --git a/ChangeLog.rss b/ChangeLog.rss
index 8879863e8..fecf7d84f 100644
--- a/ChangeLog.rss
+++ b/ChangeLog.rss
@@ -11,9 +11,45 @@
       <description>Tracking Slackware development in git.</description>
       <language>en-us</language>
       <id xmlns="http://www.w3.org/2005/Atom">urn:uuid:c964f45e-6732-11e8-bbe5-107b4450212f</id>
-      <pubDate>Fri, 16 Feb 2024 20:18:59 GMT</pubDate>
-      <lastBuildDate>Fri, 16 Feb 2024 21:05:03 GMT</lastBuildDate>
+      <pubDate>Sat, 17 Feb 2024 21:09:51 GMT</pubDate>
+      <lastBuildDate>Sat, 17 Feb 2024 22:00:01 GMT</lastBuildDate>
       <generator>maintain_current_git.sh v 1.17</generator>
+      <item>
+         <title>Sat, 17 Feb 2024 21:09:51 GMT</title>
+         <pubDate>Sat, 17 Feb 2024 21:09:51 GMT</pubDate>
+         <link>https://git.slackware.nl/current/tag/?h=20240217210951</link>
+         <guid isPermaLink="false">20240217210951</guid>
+         <description>
+           <![CDATA[<pre>
+l/nodejs-20.11.1-x86_64-1.txz:  Upgraded.
+  This update fixes security issues:
+  Code injection and privilege escalation through Linux capabilities - (High).
+  http: Reading unprocessed HTTP request with unbounded chunk extension allows
+  DoS attacks - (High).
+  Path traversal by monkey-patching Buffer internals - (High).
+  setuid() does not drop all privileges due to io_uring - (High).
+  Node.js is vulnerable to the Marvin Attack (timing variant of the
+  Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium).
+  Multiple permission model bypasses due to improper path traversal sequence
+  sanitization - (Medium).
+  Improper handling of wildcards in --allow-fs-read and --allow-fs-write -
+  (Medium).
+  Denial of Service by resource exhaustion in fetch() brotli decoding -
+  (Medium).
+  For more information, see:
+    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21892
+    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22019
+    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21896
+    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22017
+    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46809
+    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21891
+    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21890
+    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22025
+  (* Security fix *)
+l/pcre2-10.43-x86_64-1.txz:  Upgraded.
+           </pre>]]>
+         </description>
+      </item>
       <item>
          <title>Fri, 16 Feb 2024 20:18:59 GMT</title>
          <pubDate>Fri, 16 Feb 2024 20:18:59 GMT</pubDate>
-- 
cgit v1.2.3-79-gdb01