CVE-2022-37434 (zlib) found on main

[github-actions]

Failed run: https://github.com/nodejs/nodejs-dependency-vuln-assessments/actions/runs/2843580697
A new vulnerability for zlib 1.2.11 was found:
Vulnerability ID: CVE-2022-37434
Vulnerability URL: https://nvd.nist.gov/vuln/detail/CVE-2022-37434
Failed run: https://github.com/nodejs/nodejs-dependency-vuln-assessments/actions/runs/3333499796

[DanielRuf]

Link to discussion on the relevant commit for completeness: madler/zlib@eff308a

Needs clarification from maintainer and MITRE.

[mhdawson]

@mscdex since you helped us move to the chromium implementation I wonder if you know how/when they would incorporte a fix for this ?

[mscdex]

@mhdawson You're probably better off asking the Chrome/Chromium team since they maintain the actual code. All I did was just extract their fork and create the gyp.

[RafaelGSS]

@mhdawson could you give permissions to the Security-WG to this repo? I need to add the flag does-not-affect-nodejs

Node.js doesn't use the inflateGetHeader() method, therefore it's not affected. To follow the zlib update, see: nodejs/node#44412

[mhdawson]

@RafaelGSS you should now have access. I changed core collaborators to read/write. Since the security-wg team has relatively open membership and we don't trim the members very often I'd prefer to give access to non core-collaborators on an individual basis as needed.

[mhdawson]

@RafaelGSS thanks for checking. Hopefully you now have access to add that comment to the issues and mark with does-not-affect-nodejs

[Neustradamus]

To follow this ticket.

[RafaelGSS]

Fixed on nodejs/node#45387