已开启
fix CVE-2025-47279 #207
AtomGit-Bot创建于 2025年8月15日
fix CVE-2025-47279 #207
已开启
从refs/pull/207/head合入到openEuler-24.03-LTS
共 2 个文件变更+47-1
| @@ -0,0 +1,39 @@ | |||
| 1 | +From f317618ec28753a4218beccea048bcf89c36db25 Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: Matteo Collina <hello@matteocollina.com> | ||
| 3 | +Date: Wed, 12 Mar 2025 17:07:10 +0100 | ||
| 4 | +Subject: [PATCH] Removed clients with unrecoverable errors from the Pool | ||
| 5 | + (#4088) | ||
| 6 | + | ||
| 7 | +--- | ||
| 8 | + lib/dispatcher/pool.js | 14 ++ | ||
| 9 | + test/pool-connection-error-memory-leak.js | 158 ++++++++++++++++ | ||
| 10 | + test/tls-cert-leak.js | 209 ++++++++++++++++++++++ | ||
| 11 | + 3 files changed, 381 insertions(+) | ||
| 12 | + create mode 100644 test/pool-connection-error-memory-leak.js | ||
| 13 | + create mode 100644 test/tls-cert-leak.js | ||
| 14 | + | ||
| 15 | +diff --git a/deps/undici/src/lib/dispatcher/pool.js b/deps/undici/src/lib/dispatcher/pool.js | ||
| 16 | +index d80cf1274f9..14175cf4a18 100644 | ||
| 17 | +--- a/deps/undici/src/lib/dispatcher/pool.js | ||
| 18 | ++++ b/deps/undici/src/lib/dispatcher/pool.js | ||
| 19 | +@@ -70,6 +70,20 @@ class Pool extends PoolBase { | ||
| 20 | + ? { ...options.interceptors } | ||
| 21 | + : undefined | ||
| 22 | + this[kFactory] = factory | ||
| 23 | ++ | ||
| 24 | ++ this.on('connectionError', (origin, targets, error) => { | ||
| 25 | ++ // If a connection error occurs, we remove the client from the pool, | ||
| 26 | ++ // and emit a connectionError event. They will not be re-used. | ||
| 27 | ++ // Fixes https://github.com/nodejs/undici/issues/3895 | ||
| 28 | ++ for (const target of targets) { | ||
| 29 | ++ // Do not use kRemoveClient here, as it will close the client, | ||
| 30 | ++ // but the client cannot be closed in this state. | ||
| 31 | ++ const idx = this[kClients].indexOf(target) | ||
| 32 | ++ if (idx !== -1) { | ||
| 33 | ++ this[kClients].splice(idx, 1) | ||
| 34 | ++ } | ||
| 35 | ++ } | ||
| 36 | ++ }) | ||
| 37 | + } | ||
| 38 | + | ||
| 39 | + [kGetDispatcher] () { | ||
| @@ -1,4 +1,4 @@ | |||
| 1 | -%global baserelease 4 | 1 | +%global baserelease 5 |
| 2 | %{?!_pkgdocdir:%global _pkgdocdir %{_docdir}/%{name}-%{version}} | 2 | %{?!_pkgdocdir:%global _pkgdocdir %{_docdir}/%{name}-%{version}} |
| 3 | %global nodejs_epoch 1 | 3 | %global nodejs_epoch 1 |
| 4 | %global nodejs_major 20 | 4 | %global nodejs_major 20 |
| @@ -81,6 +81,9 @@ Patch5: CVE-2025-23165.patch | |||
| 81 | Patch6: CVE-2025-23166.patch | 81 | Patch6: CVE-2025-23166.patch |
| 82 | Patch7: add-sw64-support-20.18.2.patch | 82 | Patch7: add-sw64-support-20.18.2.patch |
| 83 | 83 | ||
| 84 | +# Reference:https://github.com/nodejs/undici/commit/f317618ec28753a4218beccea048bcf89c36db25 | ||
| 85 | +Patch8: CVE-2025-47279.patch | ||
| 86 | + | ||
| 84 | BuildRequires: python3-devel python3-setuptools make | 87 | BuildRequires: python3-devel python3-setuptools make |
| 85 | BuildRequires: zlib-devel python3-jinja2 | 88 | BuildRequires: zlib-devel python3-jinja2 |
| 86 | BuildRequires: brotli-devel python3-unversioned-command | 89 | BuildRequires: brotli-devel python3-unversioned-command |
| @@ -217,6 +220,7 @@ The API documentation for the Node.js JavaScript runtime. | |||
| 217 | %ifarch sw_64 | 220 | %ifarch sw_64 |
| 218 | %patch -P7 -p1 | 221 | %patch -P7 -p1 |
| 219 | %endif | 222 | %endif |
| 223 | +%patch -P8 -p1 | ||
| 220 | 224 | ||
| 221 | rm -rf deps/zlib | 225 | rm -rf deps/zlib |
| 222 | rm -rf deps/brotli | 226 | rm -rf deps/brotli |
| @@ -421,6 +425,9 @@ NODE_PATH=%{buildroot}%{_prefix}/lib/node_modules:%{buildroot}%{_prefix}/lib/nod | |||
| 421 | %{_pkgdocdir}/npm/docs | 425 | %{_pkgdocdir}/npm/docs |
| 422 | 426 | ||
| 423 | %changelog | 427 | %changelog |
| 428 | +* Fri Aug 15 2025 Zhang Yi <yizhang@cqsoftware.com.cn> - 1:20.18.2-5 | ||
| 429 | +- fix CVE-2025-47279 | ||
| 430 | + | ||
| 424 | * Tue Jul 22 2025 swcompiler <lc@wxiat.com> - 1:20.18.2-4 | 431 | * Tue Jul 22 2025 swcompiler <lc@wxiat.com> - 1:20.18.2-4 |
| 425 | - add sw64 support of node-v20.18.2 in openEuler-24.03-LTS-SP2 | 432 | - add sw64 support of node-v20.18.2 in openEuler-24.03-LTS-SP2 |
| 426 | 433 | ||