diff options
author | Myles Borins <mylesborins@google.com> | 2018-03-28 01:54:40 -0400 |
---|---|---|
committer | Myles Borins <mylesborins@google.com> | 2018-03-28 12:18:57 -0400 |
commit | ebe51d6492c3993020e1859b5269aa783fad0a4a (patch) | |
tree | 58e7c19b02ffeb6b147c81006f9cc366daa6ad39 | |
parent | 4de78219711dcfdc24290520b20dce1fff01e164 (diff) | |
download | android-node-v8-ebe51d6492c3993020e1859b5269aa783fad0a4a.tar.gz android-node-v8-ebe51d6492c3993020e1859b5269aa783fad0a4a.tar.bz2 android-node-v8-ebe51d6492c3993020e1859b5269aa783fad0a4a.zip |
2018-03-28, Version 4.9.0 'Argon' (Maintenance)
This is a security release. All Node.js users should consult the
security release summary at:
https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/
for details on patched vulnerabilities.
Fixes for the following CVEs are included in this release:
* CVE-2018-7158
* CVE-2018-7159
Notable Changes:
* Upgrade to OpenSSL 1.0.2o: Does not contain any security fixes that
are known to impact Node.js.
* **Fix for `'path'` module regular expression denial of service
(CVE-2018-7158)**: A regular expression used for parsing POSIX an
Windows paths could be used to cause a denial of service if an
attacker were able to have a specially crafted path string passed
through one of the impacted `'path'` module functions.
* **Reject spaces in HTTP `Content-Length` header values
(CVE-2018-7159)**: The Node.js HTTP parser allowed for spaces inside
`Content-Length` header values. Such values now lead to rejected
connections in the same way as non-numeric values.
* **Update root certificates**: 5 additional root certificates have
been added to the Node.js binary and 30 have been removed.
PR-URL: https://github.com/nodejs-private/node-private/pull/110
-rw-r--r-- | CHANGELOG.md | 3 | ||||
-rw-r--r-- | doc/changelogs/CHANGELOG_V4.md | 34 |
2 files changed, 36 insertions, 1 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index 0c038e78cc..a1cb757ddb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -106,7 +106,8 @@ release. <a href="doc/changelogs/CHANGELOG_V6.md#6.0.0">6.0.0</a><br/> </td> <td valign="top"> -<b><a href="doc/changelogs/CHANGELOG_V4.md#4.8.7">4.8.7</a></b><br/> +<b><a href="doc/changelogs/CHANGELOG_V4.md#4.9.0">4.9.0</a></b><br/> +<a href="doc/changelogs/CHANGELOG_V4.md#4.8.7">4.8.7</a><br/> <a href="doc/changelogs/CHANGELOG_V4.md#4.8.6">4.8.6</a><br/> <a href="doc/changelogs/CHANGELOG_V4.md#4.8.5">4.8.5</a><br/> <a href="doc/changelogs/CHANGELOG_V4.md#4.8.4">4.8.4</a><br/> diff --git a/doc/changelogs/CHANGELOG_V4.md b/doc/changelogs/CHANGELOG_V4.md index 3257b14dbd..7aaf7fdaad 100644 --- a/doc/changelogs/CHANGELOG_V4.md +++ b/doc/changelogs/CHANGELOG_V4.md @@ -10,6 +10,7 @@ </tr> <tr> <td valign="top"> +<a href="#4.9.0">4.9.0</a><br/> <a href="#4.8.7">4.8.7</a><br/> <a href="#4.8.6">4.8.6</a><br/> <a href="#4.8.5">4.8.5</a><br/> @@ -70,6 +71,39 @@ [Node.js Long Term Support Plan](https://github.com/nodejs/LTS) and will be supported actively until April 2017 and maintained until April 2018. +<a id="4.9.0"></a> +## 2018-03-28, Version 4.9.0 'Argon' (Maintenance), @MylesBorins + +This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/ for details on patched vulnerabilities. + +Fixes for the following CVEs are included in this release: + +* CVE-2018-7158 +* CVE-2018-7159 + +### Notable Changes + +* **Upgrade to OpenSSL 1.0.2o**: Does not contain any security fixes that are known to impact Node.js. +* **Fix for `'path'` module regular expression denial of service (CVE-2018-7158)**: A regular expression used for parsing POSIX an Windows paths could be used to cause a denial of service if an attacker were able to have a specially crafted path string passed through one of the impacted `'path'` module functions. +* **Reject spaces in HTTP `Content-Length` header values (CVE-2018-7159)**: The Node.js HTTP parser allowed for spaces inside `Content-Length` header values. Such values now lead to rejected connections in the same way as non-numeric values. +* **Update root certificates**: 5 additional root certificates have been added to the Node.js binary and 30 have been removed. + +### Commits + +* [[`497ff3cd4f`](https://github.com/nodejs/node/commit/497ff3cd4f)] - **crypto**: update root certificates (Ben Noordhuis) [#19322](https://github.com/nodejs/node/pull/19322) +* [[`514709e41f`](https://github.com/nodejs/node/commit/514709e41f)] - **deps**: add -no\_rand\_screen to openssl s\_client (Shigeki Ohtsu) [nodejs/io.js#1836](https://github.com/nodejs/io.js/pull/1836) +* [[`5108108606`](https://github.com/nodejs/node/commit/5108108606)] - **deps**: fix asm build error of openssl in x86\_win32 (Shigeki Ohtsu) [iojs/io.js#1389](https://github.com/iojs/io.js/pull/1389) +* [[`d67d0a63d9`](https://github.com/nodejs/node/commit/d67d0a63d9)] - **deps**: fix openssl assembly error on ia32 win32 (Fedor Indutny) [iojs/io.js#1389](https://github.com/iojs/io.js/pull/1389) +* [[`6af057ecc8`](https://github.com/nodejs/node/commit/6af057ecc8)] - **deps**: copy all openssl header files to include dir (Shigeki Ohtsu) [#19638](https://github.com/nodejs/node/pull/19638) +* [[`b50cd3359d`](https://github.com/nodejs/node/commit/b50cd3359d)] - **deps**: upgrade openssl sources to 1.0.2o (Shigeki Ohtsu) [#19638](https://github.com/nodejs/node/pull/19638) +* [[`da6e24c8d6`](https://github.com/nodejs/node/commit/da6e24c8d6)] - **deps**: reject interior blanks in Content-Length (Ben Noordhuis) [nodejs-private/http-parser-private#1](https://github.com/nodejs-private/http-parser-private/pull/1) +* [[`7ebc9981e0`](https://github.com/nodejs/node/commit/7ebc9981e0)] - **deps**: upgrade http-parser to v2.8.0 (Ben Noordhuis) [nodejs-private/http-parser-private#1](https://github.com/nodejs-private/http-parser-private/pull/1) +* [[`6fd2cc93a6`](https://github.com/nodejs/node/commit/6fd2cc93a6)] - **openssl**: fix keypress requirement in apps on win32 (Shigeki Ohtsu) [iojs/io.js#1389](https://github.com/iojs/io.js/pull/1389) +* [[`bf00665af6`](https://github.com/nodejs/node/commit/bf00665af6)] - **path**: unwind regular expressions in Windows (Myles Borins) +* [[`4196fcf23e`](https://github.com/nodejs/node/commit/4196fcf23e)] - **path**: unwind regular expressions in POSIX (Myles Borins) +* [[`625986b699`](https://github.com/nodejs/node/commit/625986b699)] - **src**: drop CNNIC+StartCom certificate whitelisting (Ben Noordhuis) [#19322](https://github.com/nodejs/node/pull/19322) +* [[`ebc46448a4`](https://github.com/nodejs/node/commit/ebc46448a4)] - **tools**: update certdata.txt (Ben Noordhuis) [#19322](https://github.com/nodejs/node/pull/19322) + <a id="4.8.7"></a> ## 2017-12-08, Version 4.8.7 'Argon' (Maintenance), @MylesBorins |