Arch Linux

Summary
=======

The package nodejs-lts-fermium is vulnerable to multiple issues including arbitrary code execution, url request injection and certificate verification bypass via CVE-2021-22960, CVE-2021-22959, CVE-2021-22940 and CVE-2021-22939.

Guidance
========
Upgrading to 14.18.1 resolves all the noted issues but requires patches for current versions of c-ares and libnghttp2 applied in PKGBUILD.diff attached.
system-c-ares.patch is from the nodejs package [1] and the libnghttp2 patch is from upstream.


References
==========

https://security.archlinux.org/AVG-2284
https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-request-smuggling-when-parsing-the-body-medium-cve-2021-22960
https://hackerone.com/reports/1238099
https://hackerone.com/reports/1238709
https://github.com/nodejs/node/commit/af488f8dc82d69847992ea1cd2f53dc8082b3b91
https://github.com/nodejs/node/commit/8c254ca7e4693fb778d808fa835b095de6c9fdd4
https://github.com/nodejs/node/commit/21a2e554e3eaa325abbdb28f366928d0ccc0a0f0
https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/#http-request-smuggling-due-to-spaced-in-headers-medium-cve-2021-22959
https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#use-after-free-on-close-http2-on-stream-canceling-high-cve-2021-22940
https://github.com/nodejs/node/pull/39423
https://github.com/nodejs/node/pull/39622
https://github.com/nodejs/node/commit/a3c33d4ce78f74d1cf1765704af5b427aa3840a6
https://github.com/nodejs/node/commit/2008c9722fcf7591e39013691f303934b622df7b
https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/#incomplete-validation-of-rejectunauthorized-parameter-low-cve-2021-22939
https://hackerone.com/reports/1278254
https://github.com/nodejs-private/node-private/pull/276
https://github.com/nodejs/node/commit/6c7fff6f1d53dfb6c2b184ee41809b8d7614cb80
https://github.com/nodejs/node/commit/35b86110e45083a75d7dc8e6be5a930b262494f6
https://github.com/nodejs/node/commit/1780bbc3291357f7c3370892eb311fc7a62afe8d
[1] https://github.com/archlinux/svntogit-community/blob/002d67724aaaddde76d8449721235009def2c115/trunk/system-c-ares.patch