nodejs (10.19.0~dfsg-3ubuntu1.6) focal-security; urgency=medium

  * SECURITY UPDATE: Incorrect Documentation for Diffie-Hellman APIs
    - debian/patches/CVE-2023-30590.patch: fixed the inconsistency between the
      documents and the function of Diffie-Hellman APIs
    - CVE-2023-30590

 -- Amir Naseredini <amir.naseredini@canonical.com>  Wed, 03 Apr 2024 09:09:55 +0100

nodejs (10.19.0~dfsg-3ubuntu1.5) focal-security; urgency=medium

  * SECURITY UPDATE: Privilege Escalation
    - debian/patches/CVE-2023-23920.patch: added `ICU_NO_USER_DATA_OVERRIDE` to
      fix an issue with insecure loading of ICU data
    - CVE-2023-23920
  * debian/patches/fix-dns-tests.patch: first part of fix of two dns tests 
  * debian/patches/fix-test-net-dns-error.patch: fixed the issue in the test 
  * debian/patches/fix-test-http-dns-error.patch: fixed the issue in the test

 -- Amir Naseredini <amir.naseredini@canonical.com>  Mon, 19 Feb 2024 16:37:59 +0000

nodejs (10.19.0~dfsg-3ubuntu1.3) focal-security; urgency=medium

  * SECURITY UPDATE: Arbitrary Code Execution
    - debian/patches/CVE-2022-32212-1.patch: fixed IPv4 validation in
      inspector_socket
    - debian/patches/CVE-2022-32212-2.patch: fixed IPv4 non routable validation
    - debian/patches/CVE-2022-43548.patch: harden IP address validation again
    - CVE-2022-32212
    - CVE-2022-43548

 -- Amir Naseredini <amir.naseredini@canonical.com>  Fri, 17 Nov 2023 11:11:22 +0000

nodejs (10.19.0~dfsg-3ubuntu1.2) focal-security; urgency=medium

  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2021-22883.patch: fixed a memory exhaustion in http2
      module
    - CVE-2021-22883
  * SECURITY UPDATE: Remote Code Execution
    - debian/patches/CVE-2021-22884.patch: fixed a DNS rebinding in nodejs
    - CVE-2021-22884

 -- Amir Naseredini <amir.naseredini@canonical.com>  Fri, 29 Sep 2023 13:26:08 +0100

nodejs (10.19.0~dfsg-3ubuntu1.1) focal-security; urgency=medium

  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2020-8174.patch: fixed a buffer overflows in nodejs
    - debian/patches/CVE-2020-8265.patch: fixed a use-after-free in TLSWrap
    - debian/patches/CVE-2020-8287.patch: fixed an HTTP Request Smuggling
      issue in Transfer-Encoding
    - CVE-2020-8174
    - CVE-2020-8265
    - CVE-2020-8287
  * debian/patches/test_update_test-tls-passphrase.patch: fixed the error with
    tls-passphrase test

 -- Amir Naseredini <amir.naseredini@canonical.com>  Thu, 07 Sep 2023 12:20:44 +0100

nodejs (10.19.0~dfsg-3ubuntu1) focal; urgency=medium

  * Merge from Debian (LP: #1863463). Remaining changes:
    - debian/control, debian/rules:
      + change node-acorn* build dependencies to node-debbundle-acorn
      + change python build dependency to python2
    - debian/tests/control: change python test dependency to python2
    - debian/patches/python2.patch: explicitly invoke python2 in tests
    - debian/patches/test-lowerseclevel.patch: lower SECLEVEL in the
      openssl.cnf used for testing
    - debian/patches/0001-test-move-foafssl-certs-to-fixtures-keys.patch:
      upstream patch to move FOAF+SSL certs to fixtures/keys/

 -- Olivier Tilloy <olivier.tilloy@canonical.com>  Tue, 31 Mar 2020 16:26:11 +0200

nodejs (10.19.0~dfsg-3) unstable; urgency=medium

  * Upstream fix (backward-compatible) for ssl 1.1.1e

 -- Jérémy Lal <kapouer@melix.org>  Fri, 20 Mar 2020 12:54:37 +0100

nodejs (10.19.0~dfsg-2) unstable; urgency=medium

  * Install acorn, acorn-walk deps
  * Patch to support acorn 6

 -- Jérémy Lal <kapouer@melix.org>  Thu, 19 Mar 2020 15:05:33 +0100

nodejs (10.19.0~dfsg-1) unstable; urgency=medium

  * New upstream version 10.19.0~dfsg
  * Use shared libhttp-parser again
  * b-d acorn and acorn-walk and fix file install

 -- Jérémy Lal <kapouer@melix.org>  Sat, 14 Mar 2020 20:50:35 +0100

nodejs (10.17.0~dfsg-2ubuntu6) focal; urgency=medium

  * Cherrypick updated foafssl test case keys from master, to unbreak
    tests with new openssl.
  * Update vendorized acorn build for 6.*.

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Fri, 06 Mar 2020 00:57:55 +0000

# For older changelog entries, run 'apt-get changelog nodejs'
