Bug 1161900

Summary: nodejs: CVE-2014-3566 fixed upstream in new stable release v0.10.33
Product: [Fedora] Fedora Reporter: Andreas Marschke <andreas.marschke>
Component: nodejsAssignee: T.C. Hollingsworth <tchollingsworth>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: unspecified    
Version: rawhideCC: jamielinux, mrunge, sgallagh, tchollingsworth, thrcka
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: nodejs-0.10.33-1.fc19 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-12-14 22:05:43 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1152789    

Description Andreas Marschke 2014-11-09 02:48:14 UTC
Hi!

A new stable version of nodejs (v0.10.33) has been released upstream
fixing POODLE security vulnerabillity in SSLv3, see CVE-2014-3566:

 - Redhat Announcement:
   https://access.redhat.com/articles/1232123

 - CVE-2014-3566 on National Vulnerabillity Database: 
   http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3566

The nodejs relevant changelog/release notes can be reviewed here: 

  http://blog.nodejs.org/2014/10/23/node-v0-10-33-stable/

It would be very nice if the package could be updated in the near future.


Thanks in advance!

Comment 1 Andreas Marschke 2014-11-09 13:52:22 UTC
It should be pointed out, that this bug is also valid for epel7.

Comment 2 Fedora Update System 2014-11-19 02:00:44 UTC
nodejs-0.10.33-1.fc20,libuv-0.10.29-1.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/nodejs-0.10.33-1.fc20,libuv-0.10.29-1.fc20

Comment 3 Fedora Update System 2014-11-19 02:02:36 UTC
nodejs-0.10.33-1.fc21,libuv-0.10.29-1.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/nodejs-0.10.33-1.fc21,libuv-0.10.29-1.fc21

Comment 4 Fedora Update System 2014-11-19 02:03:11 UTC
nodejs-0.10.33-1.fc19,libuv-0.10.29-1.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/nodejs-0.10.33-1.fc19,libuv-0.10.29-1.fc19

Comment 5 Fedora Update System 2014-11-19 02:04:05 UTC
nodejs-0.10.33-1.el7,libuv-0.10.29-1.el7 has been submitted as an update for Fedora EPEL 7.
https://admin.fedoraproject.org/updates/nodejs-0.10.33-1.el7,libuv-0.10.29-1.el7

Comment 6 Fedora Update System 2014-11-19 02:06:57 UTC
nodejs-0.10.33-1.el6,libuv-0.10.29-1.el6 has been submitted as an update for Fedora EPEL 6.
https://admin.fedoraproject.org/updates/nodejs-0.10.33-1.el6,libuv-0.10.29-1.el6

Comment 7 Fedora Update System 2014-11-19 07:50:53 UTC
Package nodejs-0.10.33-1.el6, libuv-0.10.29-1.el6:
* should fix your issue,
* was pushed to the Fedora EPEL 6 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=epel-testing nodejs-0.10.33-1.el6 libuv-0.10.29-1.el6'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2014-4144/nodejs-0.10.33-1.el6,libuv-0.10.29-1.el6
then log in and leave karma (feedback).

Comment 8 Fedora Update System 2014-12-14 22:05:43 UTC
nodejs-0.10.33-1.el7, libuv-0.10.29-1.el7 has been pushed to the Fedora EPEL 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2014-12-14 22:06:54 UTC
nodejs-0.10.33-1.el6, libuv-0.10.29-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2014-12-15 04:31:50 UTC
nodejs-0.10.33-1.fc21, libuv-0.10.29-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2014-12-15 04:34:08 UTC
nodejs-0.10.33-1.fc20, libuv-0.10.29-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 12 Fedora Update System 2014-12-15 04:35:25 UTC
nodejs-0.10.33-1.fc19, libuv-0.10.29-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.