node-aix-ppc64 14.18.2 → 14.18.3

package/CHANGELOG.md

@@ -11,6 +11,7 @@
 </tr>
 <tr>
 <td valign="top">
+<a href="#14.18.3">14.18.3</a><br/>
 <a href="#14.18.2">14.18.2</a><br/>
 <a href="#14.18.1">14.18.1</a><br/>
 <a href="#14.18.0">14.18.0</a><br/>
@@ -68,6 +69,56 @@
   * [io.js](CHANGELOG_IOJS.md)
   * [Archive](CHANGELOG_ARCHIVE.md)
 
+<a id="14.18.3"></a>
+## 2022-01-10, Version 14.18.3 'Fermium' (LTS), @richardlau
+
+This is a security release.
+
+### Notable changes
+
+#### Improper handling of URI Subject Alternative Names (Medium)(CVE-2021-44531)
+
+Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly.
+
+Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the `--security-revert` command-line option.
+
+More details will be available at [CVE-2021-44531](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44531) after publication.
+
+#### Certificate Verification Bypass via String Injection (Medium)(CVE-2021-44532)
+
+Node.js converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.
+
+Versions of Node.js with the fix for this escape SANs containing the problematic characters in order to prevent the injection. This behavior can be reverted through the `--security-revert` command-line option.
+
+More details will be available at [CVE-2021-44532](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44532) after publication.
+
+#### Incorrect handling of certificate subject and issuer fields (Medium)(CVE-2021-44533)
+
+Node.js did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification.
+
+Affected versions of Node.js do not accept multi-value Relative Distinguished Names and are thus not vulnerable to such attacks themselves. However, third-party code that uses node's ambiguous presentation of certificate subjects may be vulnerable.
+
+More details will be available at [CVE-2021-44533](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44533) after publication.
+
+#### Prototype pollution via `console.table` properties (Low)(CVE-2022-21824)
+
+Due to the formatting logic of the `console.table()` function it was not safe to allow user controlled input to be passed to the `properties` parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be `__proto__`. The prototype pollution has very limited control, in that it only allows an empty string to be assigned numerical keys of the object prototype.
+
+Versions of Node.js with the fix for this use a null protoype for the object these properties are being assigned to.
+
+More details will be available at [CVE-2022-21824](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21824) after publication.
+
+Thanks to Patrik Oldsberg (rugvip) for reporting this vulnerability.
+
+### Commits
+
+* \[[`e2a74f3c99`](https://github.com/nodejs/node/commit/e2a74f3c99)] - **console**: fix prototype pollution via console.table (Tobias Nießen) [nodejs-private/node-private#307](https://github.com/nodejs-private/node-private/pull/307)
+* \[[`df1b2c33f6`](https://github.com/nodejs/node/commit/df1b2c33f6)] - **crypto,tls**: implement safe x509 GeneralName format (Tobias Nießen and Akshay Kumar) [nodejs-private/node-private#300](https://github.com/nodejs-private/node-private/pull/300)
+* \[[`9f2c52617f`](https://github.com/nodejs/node/commit/9f2c52617f)] - **src**: add cve reverts and associated tests (Michael Dawson and Akshay Kumar) [nodejs-private/node-private#300](https://github.com/nodejs-private/node-private/pull/300)
+* \[[`b14be42518`](https://github.com/nodejs/node/commit/b14be42518)] - **src**: remove unused x509 functions (Tobias Nießen and Akshay Kumar) [nodejs-private/node-private#300](https://github.com/nodejs-private/node-private/pull/300)
+* \[[`83d8f880bb`](https://github.com/nodejs/node/commit/83d8f880bb)] - **tls**: fix handling of x509 subject and issuer (Tobias Nießen and Akshay Kumar) [nodejs-private/node-private#300](https://github.com/nodejs-private/node-private/pull/300)
+* \[[`461a0c674b`](https://github.com/nodejs/node/commit/461a0c674b)] - **tls**: drop support for URI alternative names (Tobias Nießen and Akshay Kumar) [nodejs-private/node-private#300](https://github.com/nodejs-private/node-private/pull/300)
+
 <a id="14.18.2"></a>
 ## 2021-11-30, Version 14.18.2 'Fermium' (LTS), @richardlau
 

package/include/node/node.exp

@@ -6440,16 +6440,16 @@ _GLOBAL__F__ZN2v88internal6torque21TypeArgumentInferenceC2ERKSt6vectorINS1_16Gen
 _GLOBAL__F__ZN2v88internal6torque4TypeC2ERKS2_
 _GLOBAL__F__ZN2v88internal6torque5Block13SetInputTypesERKNS1_5StackIPKNS1_4TypeEEE
 _GLOBAL__F__ZNK2v88internal6torque4Rule9RunActionEPKNS1_4ItemERKNS1_11LexerResultE
-_GLOBAL__I_65535_0_.._deps_v8_src_common_assert_scope.cc_DFF67DD7_0xbf334d65641bbd
-_GLOBAL__I_65535_0_.._deps_v8_src_diagnostics_gdb_jit.cc_AE91A18C_0x80b6f4b2673a26
-_GLOBAL__I_65535_0_.._deps_v8_src_diagnostics_objects_debug.cc_AE91A18C_0x7e28350eb34d62
-_GLOBAL__I_65535_0_.._deps_v8_src_execution_simulator_base.cc_DFF67DD7_0x48eceb40eed8dc
-_GLOBAL__I_65535_0_.._deps_v8_src_heap_factory_base.cc_DFF67DD7_0x1782219b848337
-_GLOBAL__I_65535_0_.._deps_v8_src_heap_objects_visiting.cc_AE91A18C_0x2302397b621c15
-_GLOBAL__I_65535_0_.._deps_v8_src_objects_literal_objects.cc_DFF67DD7_0x1ada2688f6aa7b
-_GLOBAL__I_65535_0_.._deps_v8_src_objects_tagged_impl.cc_AE91A18C_0x6954b7a4088f73
-_GLOBAL__I_65535_0_.._deps_v8_src_runtime_runtime_interpreter.cc_AE91A18C_0xe81885cd476ecf
-_GLOBAL__I_65535_0_.._deps_v8_src_strings_string_case.cc_DFF67DD7_0xb8b64150d2361d
+_GLOBAL__I_65535_0_.._deps_v8_src_common_assert_scope.cc_DFF67DD7_0xceb04270b0e7f2
+_GLOBAL__I_65535_0_.._deps_v8_src_diagnostics_gdb_jit.cc_AE91A18C_0x59d619b10f7c93
+_GLOBAL__I_65535_0_.._deps_v8_src_diagnostics_objects_debug.cc_AE91A18C_0xf5731974bb3a81
+_GLOBAL__I_65535_0_.._deps_v8_src_execution_simulator_base.cc_DFF67DD7_0x22a022f8465e53
+_GLOBAL__I_65535_0_.._deps_v8_src_heap_factory_base.cc_DFF67DD7_0x87696f80c6804c
+_GLOBAL__I_65535_0_.._deps_v8_src_heap_objects_visiting.cc_AE91A18C_0xe69ca639f78e95
+_GLOBAL__I_65535_0_.._deps_v8_src_objects_literal_objects.cc_DFF67DD7_0xf43f6e46e476d9
+_GLOBAL__I_65535_0_.._deps_v8_src_objects_tagged_impl.cc_AE91A18C_0x4efdfdb5dd4921
+_GLOBAL__I_65535_0_.._deps_v8_src_runtime_runtime_interpreter.cc_AE91A18C_0xa323f6b4cbfd38
+_GLOBAL__I_65535_0_.._deps_v8_src_strings_string_case.cc_DFF67DD7_0xd146c8d7e058a3
 _GLOBAL__I_65535_0_OPENSSL_ppccap_P
 _GLOBAL__I_65535_0__ZN12v8_inspector11V8Inspector6createEPN2v87IsolateEPNS_17V8InspectorClientE
 _GLOBAL__I_65535_0__ZN12v8_inspector11ValueMirrorD2Ev
@@ -7212,11 +7212,11 @@ _GLOBAL__I_65535_0__ZNK2v88internal8compiler29JSNativeContextSpecialization27sho
 _GLOBAL__I_65535_0__ZNK2v88internal9BitVector5CountEv
 _GLOBAL__I_65535_0__ZNK2v88internal9DebugInfo7IsEmptyEv
 _GLOBAL__I_65535_0__ZNK2v88internal9PreParser13GetIdentifierEv
-_GLOBAL__I_65535_0__home_iojs_build_ws_out_Release_obj_gen_torque_output_root_torque_generated_.._.._deps_v8_src_builtins_proxy_tq_csa.cc_DFF67DD7_0x1145ac463895cd
-_GLOBAL__I_65535_0__home_iojs_build_ws_out_Release_obj_gen_torque_output_root_torque_generated_.._.._deps_v8_src_ic_handler_configuration_tq_csa.cc_DFF67DD7_0x6db75ed67847b7
-_GLOBAL__I_65535_0__home_iojs_build_ws_out_Release_obj_gen_torque_output_root_torque_generated_.._.._deps_v8_src_objects_primitive_heap_object_tq_csa.cc_DFF67DD7_0x1c884ae2aff0f5
-_GLOBAL__I_65535_0__home_iojs_build_ws_out_Release_obj_gen_torque_output_root_torque_generated_class_definitions_tq.cc_AE91A18C_0xa7b4806857196e
-_GLOBAL__I_65535_0__home_iojs_build_ws_out_Release_obj_gen_torque_output_root_torque_generated_enum_verifiers_tq.cc_AE91A18C_0xb58bcfe1f0a5cd
+_GLOBAL__I_65535_0__home_iojs_build_ws_out_Release_obj_gen_torque_output_root_torque_generated_.._.._deps_v8_src_builtins_proxy_tq_csa.cc_DFF67DD7_0xca0ca48ae4bae4
+_GLOBAL__I_65535_0__home_iojs_build_ws_out_Release_obj_gen_torque_output_root_torque_generated_.._.._deps_v8_src_ic_handler_configuration_tq_csa.cc_DFF67DD7_0xd4feda8c253747
+_GLOBAL__I_65535_0__home_iojs_build_ws_out_Release_obj_gen_torque_output_root_torque_generated_.._.._deps_v8_src_objects_primitive_heap_object_tq_csa.cc_DFF67DD7_0xfad584054dc269
+_GLOBAL__I_65535_0__home_iojs_build_ws_out_Release_obj_gen_torque_output_root_torque_generated_class_definitions_tq.cc_AE91A18C_0x39c35aae22d2a5
+_GLOBAL__I_65535_0__home_iojs_build_ws_out_Release_obj_gen_torque_output_root_torque_generated_enum_verifiers_tq.cc_AE91A18C_0x450146331ae6fc
 _GLOBAL__I_65535_0_nodedbg_const_ContextEmbedderIndex__kEnvironment__int
 _GLOBAL__I_65535_0_v8dbg_frametype_EntryFrame
 _HZData_69
@@ -40923,7 +40923,7 @@ _ZN4node6crypto11RandomBytesERKN2v820FunctionCallbackInfoINS1_5ValueEEE
 _ZN4node6crypto11SignOneShotERKN2v820FunctionCallbackInfoINS1_5ValueEEE
 _ZN4node6crypto11VerifySpkacEPKcj
 _ZN4node6crypto11VerifySpkacERKN2v820FunctionCallbackInfoINS1_5ValueEEE
-_ZN4node6crypto12X509ToObjectEPNS_11EnvironmentEP7x509_st
+_ZN4node6crypto12X509ToObjectEPNS_11EnvironmentEP7x509_stb
 _ZN4node6crypto13DiffieHellman10InitializeEPNS_11EnvironmentEN2v85LocalINS4_6ObjectEEE
 _ZN4node6crypto13DiffieHellman12GenerateKeysERKN2v820FunctionCallbackInfoINS2_5ValueEEE
 _ZN4node6crypto13DiffieHellman12GetGeneratorERKN2v820FunctionCallbackInfoINS2_5ValueEEE
@@ -41045,7 +41045,6 @@ _ZN4node6crypto15PublicKeyCipher6CipherILNS1_9OperationE1EXadL_Z21EVP_PKEY_decry
 _ZN4node6crypto15PublicKeyCipher6CipherILNS1_9OperationE1EXadL_Z21EVP_PKEY_decrypt_initEEXadL_Z16EVP_PKEY_decryptEEEEvRKN2v820FunctionCallbackInfoINS4_5ValueEEE
 _ZN4node6crypto15TimingSafeEqualERKN2v820FunctionCallbackInfoINS1_5ValueEEE
 _ZN4node6crypto15UseExtraCaCertsERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
-_ZN4node6crypto16GetCertificateCNB5cxx11EP7x509_st
 _ZN4node6crypto16GetCipherVersionEPNS_11EnvironmentERKSt10unique_ptrI6ssl_stNS_15FunctionDeleterIS4_XadL_Z8SSL_freeEEEEE
 _ZN4node6crypto16ThrowCryptoErrorEPNS_11EnvironmentEmPKc
 _ZN4node6crypto17ClientHelloParser11ParseHeaderEPKhm
@@ -41072,7 +41071,6 @@ _ZN4node6crypto21GenerateKeyPairRSAPSSERKN2v820FunctionCallbackInfoINS1_5ValueEE
 _ZN4node6crypto21GetCipherStandardNameEPNS_11EnvironmentERKSt10unique_ptrI6ssl_stNS_15FunctionDeleterIS4_XadL_Z8SSL_freeEEEEE
 _ZN4node6crypto21GetClientHelloCiphersEPNS_11EnvironmentERKSt10unique_ptrI6ssl_stNS_15FunctionDeleterIS4_XadL_Z8SSL_freeEEEEE
 _ZN4node6crypto21VerifyPeerCertificateERKSt10unique_ptrI6ssl_stNS_15FunctionDeleterIS2_XadL_Z8SSL_freeEEEEEl
-_ZN4node6crypto22GetCertificateAltNamesB5cxx11EP7x509_st
 _ZN4node6crypto22GetValidationErrorCodeEPNS_11EnvironmentEi
 _ZN4node6crypto22StatelessDiffieHellmanEPNS_11EnvironmentENS0_14ManagedEVPPKeyES3_
 _ZN4node6crypto22StatelessDiffieHellmanERKN2v820FunctionCallbackInfoINS1_5ValueEEE
@@ -55096,8 +55094,6 @@ _ZNSt10_HashtableINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESt4pairIKS
 _ZNSt10_HashtableINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESt4pairIKS5_N4node14options_parser13OptionsParserINS8_18EnvironmentOptionsEE10OptionInfoEESaISE_ENSt8__detail10_Select1stESt8equal_toIS5_ESt4hashIS5_ENSG_18_Mod_range_hashingENSG_20_Default_ranged_hashENSG_20_Prime_rehash_policyENSG_17_Hashtable_traitsILb1ELb0ELb1EEEE21_M_insert_unique_nodeEmmPNSG_10_Hash_nodeISE_Lb1EEE
 _ZNSt10_HashtableINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESt4pairIKS5_N4node14options_parser13OptionsParserINS8_18EnvironmentOptionsEE11ImplicationEESaISE_ENSt8__detail10_Select1stESt8equal_toIS5_ESt4hashIS5_ENSG_18_Mod_range_hashingENSG_20_Default_ranged_hashENSG_20_Prime_rehash_policyENSG_17_Hashtable_traitsILb1ELb0ELb0EEEE13_M_rehash_auxEmSt17integral_constantIbLb0EE
 _ZNSt10_HashtableINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESt4pairIKS5_N4node14options_parser13OptionsParserINS8_18EnvironmentOptionsEE11ImplicationEESaISE_ENSt8__detail10_Select1stESt8equal_toIS5_ESt4hashIS5_ENSG_18_Mod_range_hashingENSG_20_Default_ranged_hashENSG_20_Prime_rehash_policyENSG_17_Hashtable_traitsILb1ELb0ELb0EEEE20_M_insert_multi_nodeEPNSG_10_Hash_nodeISE_Lb1EEEmSU_
-_ZNSt10_HashtableINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESt4pairIKS5_S5_ESaIS8_ENSt8__detail10_Select1stESt8equal_toIS5_ESt4hashIS5_ENSA_18_Mod_range_hashingENSA_20_Default_ranged_hashENSA_20_Prime_rehash_policyENSA_17_Hashtable_traitsILb1ELb0ELb0EEEE13_M_rehash_auxEmSt17integral_constantIbLb0EE
-_ZNSt10_HashtableINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESt4pairIKS5_S5_ESaIS8_ENSt8__detail10_Select1stESt8equal_toIS5_ESt4hashIS5_ENSA_18_Mod_range_hashingENSA_20_Default_ranged_hashENSA_20_Prime_rehash_policyENSA_17_Hashtable_traitsILb1ELb0ELb0EEEE20_M_insert_multi_nodeEPNSA_10_Hash_nodeIS8_Lb1EEEmSO_
 _ZNSt10_HashtableINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESt4pairIKS5_S5_ESaIS8_ENSt8__detail10_Select1stESt8equal_toIS5_ESt4hashIS5_ENSA_18_Mod_range_hashingENSA_20_Default_ranged_hashENSA_20_Prime_rehash_policyENSA_17_Hashtable_traitsILb1ELb0ELb1EEEE21_M_insert_unique_nodeEmmPNSA_10_Hash_nodeIS8_Lb1EEE
 _ZNSt10_HashtableINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESt4pairIKS5_St10unique_ptrIN2v814ScriptCompiler10CachedDataESt14default_deleteISB_EEESaISF_ENSt8__detail10_Select1stESt8equal_toIS5_ESt4hashIS5_ENSH_18_Mod_range_hashingENSH_20_Default_ranged_hashENSH_20_Prime_rehash_policyENSH_17_Hashtable_traitsILb1ELb0ELb1EEEE21_M_insert_unique_nodeEmmPNSH_10_Hash_nodeISF_Lb1EEE
 _ZNSt10_HashtableINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESt4pairIKS5_St10unique_ptrIN2v814ScriptCompiler10CachedDataESt14default_deleteISB_EEESaISF_ENSt8__detail10_Select1stESt8equal_toIS5_ESt4hashIS5_ENSH_18_Mod_range_hashingENSH_20_Default_ranged_hashENSH_20_Prime_rehash_policyENSH_17_Hashtable_traitsILb1ELb0ELb1EEEE5eraseENSH_20_Node_const_iteratorISF_Lb0ELb1EEE

package/include/node/node_version.h

@@ -24,7 +24,7 @@
 
 #define NODE_MAJOR_VERSION 14
 #define NODE_MINOR_VERSION 18
-#define NODE_PATCH_VERSION 2
+#define NODE_PATCH_VERSION 3
 
 #define NODE_VERSION_IS_LTS 1
 #define NODE_VERSION_LTS_CODENAME "Fermium"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-aix-ppc64",
-  "version": "v14.18.2",
+  "version": "v14.18.3",
   "description": "node",
   "bin": {
     "node": "bin/node"