build: update node.js to v14.17.3
This MR contains the following updates:
Package | Type | Update | Change |
---|---|---|---|
node | stage | patch |
14.17.1-alpine -> 14.17.3-alpine
|
Release Notes
nodejs/node
v14.17.3
Notable Changes
Node.js 14.17.2 introduced a regression in the Windows installer on non-English locales that is being fixed in this release. There is no need to download this release if you are not using the Windows installer.
Commits
- [
0f00104a2c
] - win,msi: use localized "Authenticated Users" name (Richard Lau) #39241
v14.17.2
This is a security release.
Notable Changes
Vulnerabilities fixed:
-
CVE-2021-22918: libuv upgrade - Out of bounds read (Medium)
- Node.js is vulnerable to out-of-bounds read in libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22918
-
CVE-2021-22921: Windows installer - Node Installer Local Privilege Escalation (Medium)
- Node.js is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22921
Commits
- [
a7496aba0a
] - deps: uv: cherry-pick99c29c9
(Ben Noordhuis) nodejs-private/node-private#267 - [
d0b449da1d
] - win,msi: set install directory permission (AkshayK) nodejs-private/node-private#269
Configuration
-
If you want to rebase/retry this MR, check this box.
This MR has been generated by Renovate Bot.
Edited by Common Ground Bot