Ubuntu
node-url-parse package

node-url-parse 1.2.0-1ubuntu0.1 source package in Ubuntu

Changelog

node-url-parse (1.2.0-1ubuntu0.1) bionic-security; urgency=medium

  * SECURITY UPDATE: Authorization Bypass
    - debian/patches/CVE-2022-0512[1-7].patch: fixed improper input handeling
      in node-url-parse for input containing the at sign.
    - debian/patches/CVE-2022-0639[1-2].patch: fixed improper input handeling
      in node-url-parse in toString function.
    - debian/patches/CVE-2022-0686[1-7].patch: fixed improper input handeling
      in node-url-parse when input contains specified but empty port.
    - debian/patches/CVE-2022-0691[1-4].patch: fixed improper input handeling
      in node-url-parse for input containing URL beginning with control
      characters.
    - CVE-2022-0512
    - CVE-2022-0639
    - CVE-2022-0686
    - CVE-2022-0691
  * SECURITY UPDATE: Open Redirect, SSRF, and DoS
    - debian/patches/CVE-2018-3774[1-4].patch: fixed improper input handeling
      in node-url-parse when cerain carafted hostnames.
    - debian/patches/CVE-2021-27515[1-2].patch: fixed improper input handeling
      in node-url-parse for input containing backslash.
    - debian/patches/CVE-2021-3664[1-5].patch: fixed improper input handeling
      in node-url-parse for input containing backslash.
    - CVE-2018-3774
    - CVE-2021-27515
    - CVE-2021-3664
  * SECURITY UPDATE: Bypass Input Validation
    - debian/patches/CVE-2020-8124.patch: fixed improper input handeling
      in node-url-parse when using in the browser.
    - CVE-2020-8124

 -- Amir Naseredini <email address hidden>  Thu, 23 Mar 2023 14:28:19 +0000

Upload details

Uploaded by:
Amir Naseredini
Uploaded to:
Bionic
Original maintainer:
Ubuntu Developers
Architectures:
all
Section:
javascript
Urgency:
Medium Urgency

See full publishing history Publishing

Series Pocket Published Component Section
Bionic updates universe misc
Bionic security universe misc

Builds

Bionic: [FULLYBUILT] amd64

Downloads

File Size SHA-256 Checksum
node-url-parse_1.2.0.orig.tar.gz 13.0 KiB 64bd52bb140708863daf43751aae91e5b56b67efd08ad156be6b6c3f0ecf4ff2
node-url-parse_1.2.0-1ubuntu0.1.debian.tar.xz 17.9 KiB cc212f916200674722013d73a963c9555d63941eab9d51684fe9e563614010ef
node-url-parse_1.2.0-1ubuntu0.1.dsc 2.1 KiB 607d35984a0864b7f8a2a7bc0fa1222deaeb77bbc7690107f8249926057701e1

View changes file

Binary packages built by this source

node-url-parse: Parse URL in node using the URL module and in the browser using the DOM

 The url-parse method exposes two different API interfaces. The url interface
 that you know from Node.js and the new URL interface that is available in
 the latest browsers.
 .
 Since 0.1 we've moved away from using the DOM's <a> element for URL parsing
 and moving to a full Regular Expression solution. The main reason for this
 change is to make the URL parser available in different JavaScript
 environments as you don't always have access to the DOM like Worker
 environments. This module still have a really small foot print as this
 module's main intention is to be bundled with client-side code. The only
 problem however with a RegExp based solution is that it required a lot of
 lookups causing major problems in FireFox. So the last and the current
 solution was a pure string parsing solution which chops up the URL in
 smaller pieces.
 .
 Node.js is an event-based server-side JavaScript engine.