Your message dated Thu, 06 May 2021 20:19:14 +0000
with message-id <[email protected]>
and subject line Bug#980272: fixed in nodejs 14.16.1~dfsg-1
has caused the Debian Bug report #980272,
regarding nodejs: '/usr/bin/node' started with executable stack
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
980272: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=980272
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: nodejs
Version: 14.13.0~dfsg-1
Severity: normal
X-Debbugs-Cc: [email protected]
Dear Maintainer,
The /usr/bin/node ELF binary in the nodejs package has an executable stack and
although I'm not certain whether this implies any potential for attack, it
seemed worth reporting. I do not believe that the binary requires an
executable stack.
The following command can be used to read and check the stack headers for the
binary:
$ readelf --program-headers --wide /usr/bin/node | grep -w GNU_STACK
GNU_STACK 0x000000 0x0000000000000000 0x0000000000000000 0x000000
0x000000 RWE 0x10
In particular the flags (RWE above) include the 'E' flag for executable in the
package versions checked, which are: 12.19.0~dfsg-1 (bullseye), 12.20.1~dfsg-3
(sid) and 14.13.0~dfsg-1 (experimental).
This was discovered from observation of the following message in the dmesg
output on a Debian host:
'/usr/bin/node' started with an executable stack
There's some potentially-relevant reading in the Ubuntu and Gentoo security
team documentation below:
- https://wiki.gentoo.org/wiki/Hardened/GNU_stack_quickstart
- https://wiki.ubuntu.com/SecurityTeam/Roadmap/ExecutableStacks
-- System Information:
Debian Release: bullseye/sid
APT prefers testing
APT policy: (500, 'testing'), (1, 'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 5.10.0-1-amd64 (SMP w/2 CPU threads)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8),
LANGUAGE=en_GB:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages nodejs depends on:
ii libc6 2.31-9
ii libnode83 14.13.0~dfsg-1
Versions of packages nodejs recommends:
ii ca-certificates 20200601
pn nodejs-doc <none>
Versions of packages nodejs suggests:
pn npm <none>
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: nodejs
Source-Version: 14.16.1~dfsg-1
Done: Jérémy Lal <[email protected]>
We believe that the bug you reported is fixed in the latest version of
nodejs, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Jérémy Lal <[email protected]> (supplier of updated nodejs package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 06 May 2021 17:02:20 +0200
Source: nodejs
Architecture: source
Version: 14.16.1~dfsg-1
Distribution: experimental
Urgency: medium
Maintainer: Debian Javascript Maintainers
<[email protected]>
Changed-By: Jérémy Lal <[email protected]>
Closes: 980272 987301
Changes:
nodejs (14.16.1~dfsg-1) experimental; urgency=medium
.
[ James Addison ]
* THP ELF assembly: Add .note.GNU-stack section (Closes: #980272)
.
[ Jérémy Lal ]
* New upstream version 14.16.1~dfsg
* Add Breaks: node-babel-runtime (<< 7). Closes:#987301
Checksums-Sha1:
ff4240ce45b89cf3891bd1f17bce8bcaf3057f42 3464 nodejs_14.16.1~dfsg-1.dsc
eac893f14d9c89836e1667cca8d02ab9ec6ef2d3 88456
nodejs_14.16.1~dfsg.orig-types-node.tar.xz
38092c71f2068d78a219c703d3001f23a067aeeb 18877024
nodejs_14.16.1~dfsg.orig.tar.xz
59c9fcc15bde17cc2dd5a1cee439f2f605c0f334 134644
nodejs_14.16.1~dfsg-1.debian.tar.xz
9c077d0b39a18f7d31cdb7b733e6dd1e1ebd9541 8283
nodejs_14.16.1~dfsg-1_source.buildinfo
Checksums-Sha256:
804a77520edf49aedbf63899b5088782268fde8eb364aa26be47b055766c53a0 3464
nodejs_14.16.1~dfsg-1.dsc
4bf7cb6cce0bce0dd75cf3f004154b54e9f3563cf5725b49a43779d9da746946 88456
nodejs_14.16.1~dfsg.orig-types-node.tar.xz
1bf692bc466020dea1456a5fe66bc0b3cce86f53b5c9d4bce9b444fef8f531aa 18877024
nodejs_14.16.1~dfsg.orig.tar.xz
4903bf1700cbb8004d3018128a7a9e212343013c77663954a310c43445665135 134644
nodejs_14.16.1~dfsg-1.debian.tar.xz
fdfec2a0e26599bc0c7073f021694743912d7f4d9ebbc12e91467918058cfe28 8283
nodejs_14.16.1~dfsg-1_source.buildinfo
Files:
ae2a10da84e465e01fc53dd27e256ad3 3464 javascript optional
nodejs_14.16.1~dfsg-1.dsc
df0fa0cc2ffce3170b7e9d0959d90b4f 88456 javascript optional
nodejs_14.16.1~dfsg.orig-types-node.tar.xz
45833fc8720c99e2dc5bfa6b3f5852ce 18877024 javascript optional
nodejs_14.16.1~dfsg.orig.tar.xz
13791878c3122d73592030cad614fbac 134644 javascript optional
nodejs_14.16.1~dfsg-1.debian.tar.xz
af51e75cbaac71223a54ba10afcf39ff 8283 javascript optional
nodejs_14.16.1~dfsg-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJGBAEBCgAwFiEEA8Tnq7iA9SQwbkgVZhHAXt0583QFAmCURjYSHGthcG91ZXJA
bWVsaXgub3JnAAoJEGYRwF7dOfN0TaoP/13r06IoOZpWnSiKSGxZigoxyeDyI6LU
exM3qzT+sqM4DR+k22JovCVIkvMzMmvnnfh+WJ5LZp2eRFmArPz/i+lWqztzIHgu
L7mawoj29CZ8tCc+HidjvkoViQuRSiQy1Yk8h6lYp/WPj4Tc8M4AHq0VH09ikpcM
c5osp+OOm3xo+IvCORAgljkIZXX7X/cSje0qGeFgKxPjBw3HpS/LRgsXETlHx8Rs
AG1vrX+Uu01usGFobvE1wVJPKNLaJ/x8IDG7hWMCEA91ewGwI5H7tLMu1EvHJVVT
z/VemZl0c6YiSK4mVkMuDCVfv0GS9VlV1lZLutuPOz8bfq1+2p8rhjsfI7T8gt1G
N4LELN5ly7KBnsko71Adljh/udhtZ111Zf6DYFI1+Ysg1nDRME7+8u8nltXIcUgh
NP1SiQHIcZoRsgGNBoSxfgcuv2ybpDd4Ywh+MiAs/YWIBx8yKqb7ODWVbzcC2YAi
10/c6/ECxRdRbtOBPtUDFl7pJD7zPaxm8D/TAajaJq0ePfUDQ0ZSpVSkKTVKF28W
9/UYUV+3SVJuQ2enndhqqfpJV/hUz482kQFiGgoD99hPWFdXdSMX62hlZu5szQr4
+lr9ltpgvxhmGpjeyrnFpNLKwnj+yphtXI0iasdYL7qAN4xHtsnAoX0bxh1e6+xl
AoWoGa5fLYiM
=yNav
-----END PGP SIGNATURE-----
--- End Message ---
--
Pkg-javascript-devel mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
