——————————————————————————–
Fedora Update Notification
FEDORA-2014-11399
2014-09-25 09:27:02
——————————————————————————–

Name : nodejs-qs
Product : Fedora 19
Version : 0.6.6
Release : 3.fc19
URL : https://github.com/visionmedia/node-querystring
Summary : Query string parser for Node.js
Description :
This is a query string parser for node and the browser supporting nesting,
as it was removed from 0.3.x, so this library provides the previous and
commonly desired behavior (and twice as fast). Used by express, connect
and others.

——————————————————————————–
Update Information:

The qs module has the ability to create sparse arrays during parsing. By specifying a high index it is possible to create a large array that will eventually take up all the allocated memory of the running process, resulting in a crash.

More information: https://github.com/visionmedia/node-querystring/issues/104

——————————————————————————–
ChangeLog:

* Wed Sep 24 2014 T.C. Hollingsworth <tchollingsworth@gmail.com> – 0.6.6-3
– backport security fix for memory exhaustion denial-of-service (RHBZ#1146054)
* Sat Jun 7 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> – 0.6.6-2
– Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
* Mon Mar 10 2014 Jamie Nguyen <jamielinux@fedoraproject.org> – 0.6.6-1
– update to upstream release 0.6.6
* Sun Jul 28 2013 Jamie Nguyen <jamielinux@fedoraproject.org> – 0.6.5-3
– add ExclusiveArch logic
* Sat Jun 22 2013 T.C. Hollingsworth <tchollingsworth@gmail.com> – 0.6.5-2
– restrict to compatible arches
——————————————————————————–
References:

[ 1 ] Bug #1146054 – CVE-2014-7191 nodejs-qs: Denial-of-Service Memory Exhaustion
https://bugzilla.redhat.com/show_bug.cgi?id=1146054
——————————————————————————–

This update can be installed with the “yum” update program. Use
su -c ‘yum update nodejs-qs’ at the command line.
For more information, refer to “Managing Software with yum”,
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
——————————————————————————–
_______________________________________________
package-announce mailing list
package-announce@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/package-announce

——————————————————————————–
Fedora Update Notification
FEDORA-2014-11376
2014-09-25 09:26:08
——————————————————————————–

Name : nodejs-qs
Product : Fedora 20
Version : 0.6.6
Release : 3.fc20
URL : https://github.com/visionmedia/node-querystring
Summary : Query string parser for Node.js
Description :
This is a query string parser for node and the browser supporting nesting,
as it was removed from 0.3.x, so this library provides the previous and
commonly desired behavior (and twice as fast). Used by express, connect
and others.

——————————————————————————–
Update Information:

The qs module has the ability to create sparse arrays during parsing. By specifying a high index it is possible to create a large array that will eventually take up all the allocated memory of the running process, resulting in a crash.

More information: https://github.com/visionmedia/node-querystring/issues/104

——————————————————————————–
ChangeLog:

* Wed Sep 24 2014 T.C. Hollingsworth <tchollingsworth@gmail.com> – 0.6.6-3
– backport security fix for memory exhaustion denial-of-service (RHBZ#1146054)
* Sat Jun 7 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> – 0.6.6-2
– Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
* Mon Mar 10 2014 Jamie Nguyen <jamielinux@fedoraproject.org> – 0.6.6-1
– update to upstream release 0.6.6
——————————————————————————–
References:

[ 1 ] Bug #1146054 – CVE-2014-7191 nodejs-qs: Denial-of-Service Memory Exhaustion
https://bugzilla.redhat.com/show_bug.cgi?id=1146054
——————————————————————————–

This update can be installed with the “yum” update program. Use
su -c ‘yum update nodejs-qs’ at the command line.
For more information, refer to “Managing Software with yum”,
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
——————————————————————————–
_______________________________________________
package-announce mailing list
package-announce@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/package-announce