Your message dated Fri, 19 Mar 2021 13:19:10 +0000
with message-id <[email protected]>
and subject line Bug#980272: fixed in nodejs 12.21.0~dfsg-2
has caused the Debian Bug report #980272,
regarding nodejs: '/usr/bin/node' started with executable stack
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
980272: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=980272
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: nodejs
Version: 14.13.0~dfsg-1
Severity: normal
X-Debbugs-Cc: [email protected]
Dear Maintainer,
The /usr/bin/node ELF binary in the nodejs package has an executable stack and
although I'm not certain whether this implies any potential for attack, it
seemed worth reporting. I do not believe that the binary requires an
executable stack.
The following command can be used to read and check the stack headers for the
binary:
$ readelf --program-headers --wide /usr/bin/node | grep -w GNU_STACK
GNU_STACK 0x000000 0x0000000000000000 0x0000000000000000 0x000000
0x000000 RWE 0x10
In particular the flags (RWE above) include the 'E' flag for executable in the
package versions checked, which are: 12.19.0~dfsg-1 (bullseye), 12.20.1~dfsg-3
(sid) and 14.13.0~dfsg-1 (experimental).
This was discovered from observation of the following message in the dmesg
output on a Debian host:
'/usr/bin/node' started with an executable stack
There's some potentially-relevant reading in the Ubuntu and Gentoo security
team documentation below:
- https://wiki.gentoo.org/wiki/Hardened/GNU_stack_quickstart
- https://wiki.ubuntu.com/SecurityTeam/Roadmap/ExecutableStacks
-- System Information:
Debian Release: bullseye/sid
APT prefers testing
APT policy: (500, 'testing'), (1, 'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 5.10.0-1-amd64 (SMP w/2 CPU threads)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8),
LANGUAGE=en_GB:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages nodejs depends on:
ii libc6 2.31-9
ii libnode83 14.13.0~dfsg-1
Versions of packages nodejs recommends:
ii ca-certificates 20200601
pn nodejs-doc <none>
Versions of packages nodejs suggests:
pn npm <none>
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: nodejs
Source-Version: 12.21.0~dfsg-2
Done: Jérémy Lal <[email protected]>
We believe that the bug you reported is fixed in the latest version of
nodejs, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Jérémy Lal <[email protected]> (supplier of updated nodejs package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 19 Mar 2021 11:15:57 +0100
Source: nodejs
Architecture: source
Version: 12.21.0~dfsg-2
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers
<[email protected]>
Changed-By: Jérémy Lal <[email protected]>
Closes: 980272
Changes:
nodejs (12.21.0~dfsg-2) unstable; urgency=medium
.
[ James Addison ]
* THP ELF assembly: Add .note.GNU-stack section (Closes: #980272)
Checksums-Sha1:
e29c9f1562a5c941a7f7eb53ddceb170c9dbb2c6 3455 nodejs_12.21.0~dfsg-2.dsc
06175a7aa335cd9f3c0669329e6024d2b95228ee 134968
nodejs_12.21.0~dfsg-2.debian.tar.xz
a0a321c4c6d4c67a601131044bbd5d7276f5b8b2 9239
nodejs_12.21.0~dfsg-2_source.buildinfo
Checksums-Sha256:
e092417e7566e664304ee03fbe298263a30655f1eb52afa6945a022f346ce69b 3455
nodejs_12.21.0~dfsg-2.dsc
6c8a8e5fe5db76b53c18d4ef827a5a728d07b8db85bfbc0d1f0f4682b0a1b513 134968
nodejs_12.21.0~dfsg-2.debian.tar.xz
024fbb58897c17c9150d236539566cee555583ce7a92b2d19fcafa5e0e889ab1 9239
nodejs_12.21.0~dfsg-2_source.buildinfo
Files:
3e827ee0f8c75552d4c5392c5eacea8f 3455 javascript optional
nodejs_12.21.0~dfsg-2.dsc
c9ae34e5e43770e0f292bb887c6756fd 134968 javascript optional
nodejs_12.21.0~dfsg-2.debian.tar.xz
c40e25b9bab4d0e3d3ebff4642e12621 9239 javascript optional
nodejs_12.21.0~dfsg-2_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJGBAEBCgAwFiEEA8Tnq7iA9SQwbkgVZhHAXt0583QFAmBUoMcSHGthcG91ZXJA
bWVsaXgub3JnAAoJEGYRwF7dOfN0p20P/R20p2J7MXwgtERrSsUj1GJM+w5s4ktp
o2qh74jHesVQlfcA0/ksk9cSAqS6WcPwNq/PZyQO+XFfZjswUMs27LJo/b3+DwAn
ZmIqmmQeHS4XYvhjAoMsWOAalmGEeHsD7IzsKIrrx1WRcjM4HkyfWOi11vijeVrr
530gCY/ysL7Hyc3CV0Rr8biy2j0L5VR63v2V6ABRhkDU+c36+AMza0uSdTwf+TDb
g9lsbfYx9ONZhFOm3RfuzvQvZsPxhJEWpPKT+TygL4DTsA609c9CpFkObDnaAGgD
rIOOppYsPmv4CpAVkyJ3iKjheWYbnBMv78gFN8H6QhFlVa8NwPjPBUIqI1RdC6GP
bev18OJKa2ECXdrTptsriPD8NMCJfYxtBz6xIPmBNXvIfh/SLK3D14e6p7gUuf7I
mvKxz+lqqYW4kufOzANaVjk8tvYaMsFi3QD/N0P8ksCBlzUCVJSRzLVtzq7TNPER
7TYV5RINgtKk2LiVHu+1GEgCMmJ8hDYz1TiEsOU4TtJfDdIH+35SgD3nr73UjfCH
Oq/7kP8NCBTyg516KAonWhVh4D6gjjbs6rjGlYmECF5Ewb4CN4sKpQjuzKe96V01
gWX5bAIaJyYD9Q8YtpmzlXFBxbY1ZkUGLndCuhDCXGTIqg+qCvyf9I6sfcV1umY8
yekcYcRFSZqC
=i4w5
-----END PGP SIGNATURE-----
--- End Message ---
--
Pkg-javascript-devel mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
