Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: nodejs/node
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: 0bf200b
Choose a base ref
...
head repository: nodejs/node
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: a407d1f
Choose a head ref
  • 8 commits
  • 31 files changed
  • 2 contributors

Commits on Jun 20, 2024

  1. Working on v20.15.1 

    PR-URL: #53486
    @marco-ippolito
    marco-ippolito committed Jun 20, 2024
    Configuration menu
    Copy the full SHA
    d162dca View commit details
    Browse the repository at this point in the history

Commits on Jul 3, 2024

  1. lib,permission: disable fchmod/fchown when pm enabled 

    PR-URL: nodejs-private/node-private#584
Refs: https://hackerone.com/reports/2472071
CVE-ID: CVE-2024-36137
    @RafaelGSS
    RafaelGSS committed Jul 3, 2024
    Configuration menu
    Copy the full SHA
    d38ea17 View commit details
    Browse the repository at this point in the history

  2. lib,permission: support fs.lstat 

    PR-URL: nodejs-private/node-private#486
Backport-PR-URL: nodejs-private/node-private#604
CVE-ID: CVE-2024-22018
    @RafaelGSS
    RafaelGSS committed Jul 3, 2024
    Configuration menu
    Copy the full SHA
    025cbd6 View commit details
    Browse the repository at this point in the history

  3. src,permission: resolve path on fs_permission 

    Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com>
PR-URL: #52761
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
    @RafaelGSS
    RafaelGSS committed Jul 3, 2024
    Configuration menu
    Copy the full SHA
    484cb0f View commit details
    Browse the repository at this point in the history

  4. src: handle permissive extension on cmd check 

    PR-URL: nodejs-private/node-private#596
Backport-PR-URL: nodejs-private/node-private#605
CVE-ID: CVE-2024-36138
    @RafaelGSS
    RafaelGSS committed Jul 3, 2024
    Configuration menu
    Copy the full SHA
    1ba624c View commit details
    Browse the repository at this point in the history

  5. lib,esm: handle bypass network-import via data: 

    PR-URL: nodejs-private/node-private#522
CVE-ID: CVE-2024-22020
    @RafaelGSS
    RafaelGSS committed Jul 3, 2024
    Configuration menu
    Copy the full SHA
    60e184a View commit details
    Browse the repository at this point in the history

  6. src,permission: fix UNC path resolution 

    PR-URL: nodejs-private/node-private#581
CVE-ID: CVE-2024-37372
    @RafaelGSS
    RafaelGSS committed Jul 3, 2024
    Configuration menu
    Copy the full SHA
    2524d00 View commit details
    Browse the repository at this point in the history

  7. 2024-07-08, Version 20.15.1 'Iron' (LTS) 

    This is a security release.

Notable changes:

* CVE-2024-36138 - Bypass incomplete fix of CVE-2024-27980 (High)
* CVE-2024-22020 - Bypass network import restriction via data URL (Medium)
* CVE-2024-22018 - fs.lstat bypasses permission model (Low)
* CVE-2024-36137 - fs.fchown/fchmod bypasses permission model (Low)
* CVE-2024-37372 - Permission model improperly processes UNC paths (Low)

PR-URL: nodejs-private/node-private#608
    @RafaelGSS
    RafaelGSS committed Jul 3, 2024
    Configuration menu
    Copy the full SHA
    a407d1f View commit details
    Browse the repository at this point in the history
Loading