Node JS upgrade #13329

Activity

1. MarshallOfSound commented on Jun 20, 2018

   

   MarshallOfSound

   on Jun 20, 2018

   Member

   More actions

   @Anuj16 Upgrading node is not an incredibly simple task but I'll look at backporting the fixes for those two CVE's.

   As far as I can see CVE-2017-15897 was actually fixed in 8.9.3 (so we already have it)

   The other one requires a backport of nodejs/node#17526
2. MarshallOfSound commented on Jun 20, 2018

   

   MarshallOfSound

   on Jun 20, 2018

   Member

   More actions

   Update 8.9.3 includes the fix for CVE-2017-15896 as well
3. MarshallOfSound commented on Jun 20, 2018

   

   MarshallOfSound

   on Jun 20, 2018

   Member

   More actions

   Closing this out as both CVE's are reported as fixed in 8.9.3 which we currently depend on:

   nodejs/node@8a44289
4. MarshallOfSound

   closed this as completedon Jun 20, 2018
5. Anuj16 commented on Jun 20, 2018

   

   Anuj16

   on Jun 20, 2018

   Author

   More actions

   @MarshallOfSound Thanks very much for the quick clarification.
6. MarshallOfSound commented on Jun 20, 2018

   

   MarshallOfSound

   on Jun 20, 2018

   Member

   More actions

   @Anuj16 No problem, also for future reference even though this particular issue is on the line of public knowledge can all future security related things go to security@electronjs.org 👍