mirror of
https://github.com/zebrajr/node.git
synced 2026-01-15 12:15:26 +00:00
ae25da20fa
This is a security release. Notable changes: * CVE-2023-32002: Policies can be bypassed via Module.\_load (High) * CVE-2023-32558: process.binding() can bypass the permission model through path traversal (High) * CVE-2023-32004: Permission model can be bypassed by specifying a path traversal sequence in a Buffer (High) * CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium) * CVE-2023-32559: Policies can be bypassed via process.binding (Medium) * CVE-2023-32005: fs.statfs can bypass the permission model (Low) * CVE-2023-32003: fs.mkdtemp() and fs.mkdtempSync() can bypass the permission model (Low) * OpenSSL Security Releases * https://mta.openssl.org/pipermail/openssl-announce/2023-July/000264.html * https://mta.openssl.org/pipermail/openssl-announce/2023-July/000265.html * https://mta.openssl.org/pipermail/openssl-announce/2023-July/000267.html PR-URL: https://github.com/nodejs-private/node-private/pull/465