diff options
author | Rod Vagg <rod@vagg.org> | 2019-02-28 16:57:34 +1100 |
---|---|---|
committer | Rod Vagg <rod@vagg.org> | 2019-02-28 22:31:14 +1100 |
commit | 980cce6d29e39bd6d2f86d4f7d25360a4dc2ccc3 (patch) | |
tree | 8eb38b68b53b8e737f23dbac467f87320cb3c0f2 | |
parent | b974d0dd646785a6b96ea1a525c203d2a583687b (diff) | |
download | android-node-v8-980cce6d29e39bd6d2f86d4f7d25360a4dc2ccc3.tar.gz android-node-v8-980cce6d29e39bd6d2f86d4f7d25360a4dc2ccc3.tar.bz2 android-node-v8-980cce6d29e39bd6d2f86d4f7d25360a4dc2ccc3.zip |
2019-02-28, Version 8.15.1 'Carbon' (LTS)
This is a security release. All Node.js users should consult the security
release summary at:
https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/
for details on patched vulnerabilities.
Fixes for the following CVEs are included in this release:
* Node.js: Slowloris HTTP Denial of Service with keep-alive
(CVE-2019-5737)
* OpenSSL: 0-byte record padding oracle (CVE-2019-1559)
Notable Changes:
* deps: OpenSSL has been upgraded to 1.0.2r which contains a fix for
CVE-2019-1559 (https://www.openssl.org/news/secadv/20190226.txt). Under
certain circumstances, a TLS server can be forced to respond differently to
a client if a zero-byte record is received with an invalid padding
compared to a zero-byte record with an invalid MAC. This can be used as the
basis of a padding oracle attack to decrypt data.
* http: Further prevention of "Slowloris" attacks on HTTP and HTTPS
connections by consistently applying the receive timeout set by
`server.headersTimeout` to connections in keep-alive mode. Reported by
Marco Pracucci (https://voxnest.com). (CVE-2019-5737 / Matteo Collina)
PR-URL: https://github.com/nodejs-private/node-private/pull/165
-rw-r--r-- | CHANGELOG.md | 3 | ||||
-rw-r--r-- | doc/changelogs/CHANGELOG_V8.md | 30 |
2 files changed, 32 insertions, 1 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index bc4b4382b3..a4bd64452d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -66,7 +66,8 @@ release. <a href="doc/changelogs/CHANGELOG_V10.md#10.0.0">10.0.0</a><br/> </td> <td valign="top"> -<b><a href="doc/changelogs/CHANGELOG_V8.md#8.15.0">8.15.0</a></b><br/> +<b><a href="doc/changelogs/CHANGELOG_V8.md#8.15.1">8.15.1</a></b><br/> +<a href="doc/changelogs/CHANGELOG_V8.md#8.15.0">8.15.0</a><br/> <a href="doc/changelogs/CHANGELOG_V8.md#8.14.1">8.14.1</a><br/> <a href="doc/changelogs/CHANGELOG_V8.md#8.14.0">8.14.0</a><br/> <a href="doc/changelogs/CHANGELOG_V8.md#8.13.0">8.13.0</a><br/> diff --git a/doc/changelogs/CHANGELOG_V8.md b/doc/changelogs/CHANGELOG_V8.md index 3bb67c27ce..b6228ce862 100644 --- a/doc/changelogs/CHANGELOG_V8.md +++ b/doc/changelogs/CHANGELOG_V8.md @@ -11,6 +11,7 @@ </tr> <tr> <td valign="top"> +<a href="#8.15.1">8.15.1</a><br/> <a href="#8.15.0">8.15.0</a><br/> <a href="#8.14.1">8.14.1</a><br/> <a href="#8.14.0">8.14.0</a><br/> @@ -65,6 +66,35 @@ [Node.js Long Term Support Plan](https://github.com/nodejs/LTS) and will be supported actively until April 2019 and maintained until December 2019. +<a id="8.15.1"></a> +## 2019-02-28, Version 8.15.1 'Carbon' (LTS), @rvagg + +This is a security release. All Node.js users should consult the security release summary at: + + https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/ + +for details on patched vulnerabilities. + +Fixes for the following CVEs are included in this release: + + * Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737) + * OpenSSL: 0-byte record padding oracle (CVE-2019-1559) + +### Notable Changes + +* **deps**: OpenSSL has been upgraded to 1.0.2r which contains a fix for [CVE-2019-1559](https://www.openssl.org/news/secadv/20190226.txt). Under certain circumstances, a TLS server can be forced to respond differently to a client if a zero-byte record is received with an invalid _padding_ compared to a zero-byte record with an invalid _MAC_. This can be used as the basis of a padding oracle attack to decrypt data. +* **http**: Further prevention of "Slowloris" attacks on HTTP and HTTPS connections by consistently applying the receive timeout set by `server.headersTimeout` to connections in keep-alive mode. Reported by Marco Pracucci ([Voxnest](https://voxnest.com)). (CVE-2019-5737 / Matteo Collina) + +### Commits + +* [[`61980dcbf9`](https://github.com/nodejs/node/commit/61980dcbf9)] - **deps**: add -no\_rand\_screen to openssl s\_client (Shigeki Ohtsu) [nodejs/io.js#1836](https://github.com/nodejs/io.js/pull/1836) +* [[`bf287faf21`](https://github.com/nodejs/node/commit/bf287faf21)] - **deps**: fix asm build error of openssl in x86\_win32 (Shigeki Ohtsu) [iojs/io.js#1389](https://github.com/iojs/io.js/pull/1389) +* [[`22ec5feff0`](https://github.com/nodejs/node/commit/22ec5feff0)] - **deps**: fix openssl assembly error on ia32 win32 (Fedor Indutny) [iojs/io.js#1389](https://github.com/iojs/io.js/pull/1389) +* [[`2cc5e7f534`](https://github.com/nodejs/node/commit/2cc5e7f534)] - **deps**: copy all openssl header files to include dir (Shigeki Ohtsu) +* [[`d71517fd43`](https://github.com/nodejs/node/commit/d71517fd43)] - **deps**: upgrade openssl sources to 1.0.2r (Shigeki Ohtsu) +* [[`76d52c508a`](https://github.com/nodejs/node/commit/76d52c508a)] - **http**: prevent slowloris with keepalive connections (Matteo Collina) [nodejs-private/node-private#162](https://github.com/nodejs-private/node-private/pull/162) +* [[`6969fad7d6`](https://github.com/nodejs/node/commit/6969fad7d6)] - **openssl**: fix keypress requirement in apps on win32 (Shigeki Ohtsu) [iojs/io.js#1389](https://github.com/iojs/io.js/pull/1389) + <a id="8.15.0"></a> ## 2018-12-26, Version 8.15.0 'Carbon' (LTS), @MylesBorins |