From a407d1f0b3669cc82c755700f0d500fb27cc39ea Mon Sep 17 00:00:00 2001 From: RafaelGSS Date: Thu, 27 Jun 2024 10:45:03 -0300 Subject: [PATCH] 2024-07-08, Version 20.15.1 'Iron' (LTS) This is a security release. Notable changes: * CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High) * CVE-2024-22020 - Bypass network import restriction via data URL (Medium) * CVE-2024-22018 - fs.lstat bypasses permission model (Low) * CVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low) * CVE-2024-37372 - Permission model improperly processes UNC paths (Low) PR-URL: https://github.com/nodejs-private/node-private/pull/608 --- CHANGELOG.md | 3 ++- doc/changelogs/CHANGELOG_V20.md | 24 ++++++++++++++++++++++++ src/node_version.h | 2 +- 3 files changed, 27 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e8153c8cafc376..971c0371f0b134 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -35,7 +35,8 @@ release. -20.15.0
+20.15.1
+20.15.0
20.14.0
20.13.1
20.13.0
diff --git a/doc/changelogs/CHANGELOG_V20.md b/doc/changelogs/CHANGELOG_V20.md index dc1e23049418be..2d339f09f0d29c 100644 --- a/doc/changelogs/CHANGELOG_V20.md +++ b/doc/changelogs/CHANGELOG_V20.md @@ -9,6 +9,7 @@ +20.15.1
20.15.0
20.14.0
20.13.1
@@ -61,6 +62,29 @@ * [io.js](CHANGELOG_IOJS.md) * [Archive](CHANGELOG_ARCHIVE.md) + + +## 2024-07-08, Version 20.15.1 'Iron' (LTS), @RafaelGSS + +This is a security release. + +### Notable Changes + +* CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High) +* CVE-2024-22020 - Bypass network import restriction via data URL (Medium) +* CVE-2024-22018 - fs.lstat bypasses permission model (Low) +* CVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low) +* CVE-2024-37372 - Permission model improperly processes UNC paths (Low) + +### Commits + +* \[[`60e184a6e4`](https://github.com/nodejs/node/commit/60e184a6e4)] - **lib,esm**: handle bypass network-import via data: (RafaelGSS) [nodejs-private/node-private#522](https://github.com/nodejs-private/node-private/pull/522) +* \[[`025cbd6936`](https://github.com/nodejs/node/commit/025cbd6936)] - **lib,permission**: support fs.lstat (RafaelGSS) [nodejs-private/node-private#486](https://github.com/nodejs-private/node-private/pull/486) +* \[[`d38ea17341`](https://github.com/nodejs/node/commit/d38ea17341)] - **lib,permission**: disable fchmod/fchown when pm enabled (RafaelGSS) [nodejs-private/node-private#584](https://github.com/nodejs-private/node-private/pull/584) +* \[[`1ba624cd3b`](https://github.com/nodejs/node/commit/1ba624cd3b)] - **src**: handle permissive extension on cmd check (RafaelGSS) [nodejs-private/node-private#596](https://github.com/nodejs-private/node-private/pull/596) +* \[[`2524d00c3d`](https://github.com/nodejs/node/commit/2524d00c3d)] - **src,permission**: fix UNC path resolution (RafaelGSS) [nodejs-private/node-private#581](https://github.com/nodejs-private/node-private/pull/581) +* \[[`484cb0f13c`](https://github.com/nodejs/node/commit/484cb0f13c)] - **src,permission**: resolve path on fs\_permission (Rafael Gonzaga) [#52761](https://github.com/nodejs/node/pull/52761) + ## 2024-06-20, Version 20.15.0 'Iron' (LTS), @marco-ippolito diff --git a/src/node_version.h b/src/node_version.h index 75dea9877ac3c7..30c62f0cbf924b 100644 --- a/src/node_version.h +++ b/src/node_version.h @@ -29,7 +29,7 @@ #define NODE_VERSION_IS_LTS 1 #define NODE_VERSION_LTS_CODENAME "Iron" -#define NODE_VERSION_IS_RELEASE 0 +#define NODE_VERSION_IS_RELEASE 1 #ifndef NODE_STRINGIFY #define NODE_STRINGIFY(n) NODE_STRINGIFY_HELPER(n)