{{ message }}
Repository navigation
CVE-2022-37434 (zlib) found on main #50
Description
Failed run: https://github.com/nodejs/nodejs-dependency-vuln-assessments/actions/runs/2843580697
A new vulnerability for zlib 1.2.11 was found:
Vulnerability ID: CVE-2022-37434
Vulnerability URL: https://nvd.nist.gov/vuln/detail/CVE-2022-37434
Failed run: https://github.com/nodejs/nodejs-dependency-vuln-assessments/actions/runs/3333499796
Activity
DanielRuf commentedon Aug 16, 2022
Link to discussion on the relevant commit for completeness: madler/zlib@eff308a
Needs clarification from maintainer and MITRE.
mhdawson commentedon Aug 19, 2022
@mscdex since you helped us move to the chromium implementation I wonder if you know how/when they would incorporte a fix for this ?
mscdex commentedon Aug 19, 2022
@mhdawson You're probably better off asking the Chrome/Chromium team since they maintain the actual code. All I did was just extract their fork and create the gyp.
RafaelGSS commentedon Aug 29, 2022
@mhdawson could you give permissions to the Security-WG to this repo? I need to add the flag
does-not-affect-nodejsNode.js doesn't use the
inflateGetHeader()method, therefore it's not affected. To follow thezlibupdate, see: nodejs/node#44412mhdawson commentedon Aug 30, 2022
@RafaelGSS you should now have access. I changed core collaborators to read/write. Since the security-wg team has relatively open membership and we don't trim the members very often I'd prefer to give access to non core-collaborators on an individual basis as needed.
mhdawson commentedon Aug 30, 2022
@RafaelGSS thanks for checking. Hopefully you now have access to add that comment to the issues and mark with
does-not-affect-nodejsNeustradamus commentedon Oct 15, 2022
To follow this ticket.
[-]New vulnerability CVE-2022-37434 found on main[/-][+]CVE-2022-37434 (zlib) found on main[/+]RafaelGSS commentedon Nov 21, 2022
Fixed on nodejs/node#45387