diff options
| author | Michaël Zasso <targos@protonmail.com> | 2018-03-27 16:24:09 +0200 |
|---|---|---|
| committer | Myles Borins <mylesborins@google.com> | 2018-03-28 12:21:10 -0400 |
| commit | 80310e916aff24dc6b3477ad52a697dff84fc78e (patch) | |
| tree | b12b1c1b9ac1250713c601491016a17d9b9ff117 /CHANGELOG.md | |
| parent | b2a6c9745298c11f05bd8583761439ee701721c9 (diff) | |
| download | android-node-v8-80310e916aff24dc6b3477ad52a697dff84fc78e.tar.gz android-node-v8-80310e916aff24dc6b3477ad52a697dff84fc78e.tar.bz2 android-node-v8-80310e916aff24dc6b3477ad52a697dff84fc78e.zip | |
2018-03-28, Version 9.10.0 (Current)
This is a security release. All Node.js users should consult the
security release summary at:
https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/
for details on patched vulnerabilities.
Fixes for the following CVEs are included in this release:
* CVE-2018-7158
* CVE-2018-7159
* CVE-2018-7160
Notable changes:
* Upgrade to OpenSSL 1.0.2o: Does not contain any security fixes that
are known to impact Node.js.
* **Fix for inspector DNS rebinding vulnerability (CVE-2018-7160)**:
A malicious website could use a DNS rebinding attack to trick a web
browser to bypass same-origin-policy checks and allow HTTP
connections to localhost or to hosts on the local network,
potentially to an open inspector port as a debugger, therefore
gaining full code execution access. The inspector now only allows
connections that have a browser `Host` value of `localhost` or
`localhost6`.
* **Fix for `'path'` module regular expression denial of service
(CVE-2018-7158)**: A regular expression used for parsing POSIX an
Windows paths could be used to cause a denial of service if an
attacker were able to have a specially crafted path string passed
through one of the impacted `'path'` module functions.
* **Reject spaces in HTTP `Content-Length` header values
(CVE-2018-7159)**: The Node.js HTTP parser allowed for spaces inside
`Content-Length` header values. Such values now lead to rejected
connections in the same way as non-numeric values.
* **Update root certificates**: 5 additional root certificates have
been added to the Node.js binary and 30 have been removed.
* cluster:
- Add support for `NODE_OPTIONS="--inspect"` (Sameer Srivastava)
https://github.com/nodejs/node/pull/19165
* crypto:
- Expose the public key of a certificate (Hannes Magnusson)
https://github.com/nodejs/node/pull/17690
* n-api:
- Add `napi_fatal_exception` to trigger an `uncaughtException` in
JavaScript (Mathias Buus)
https://github.com/nodejs/node/pull/19337
* path:
- Fix regression in `posix.normalize` (Michaël Zasso)
https://github.com/nodejs/node/pull/19520
* stream:
- Improve stream creation performance (Brian White)
https://github.com/nodejs/node/pull/19401
* Added new collaborators
- [BethGriggs](https://github.com/BethGriggs) Beth Griggs
PR-URL: https://github.com/nodejs-private/node-private/pull/111
Diffstat (limited to 'CHANGELOG.md')
| -rw-r--r-- | CHANGELOG.md | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index e75aabb50e..e823878ec4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -31,7 +31,8 @@ release. </tr> <tr> <td valign="top"> -<b><a href="doc/changelogs/CHANGELOG_V9.md#9.9.0">9.9.0</a></b><br/> +<b><a href="doc/changelogs/CHANGELOG_V9.md#9.10.0">9.10.0</a></b><br/> +<a href="doc/changelogs/CHANGELOG_V9.md#9.9.0">9.9.0</a><br/> <a href="doc/changelogs/CHANGELOG_V9.md#9.8.0">9.8.0</a><br/> <a href="doc/changelogs/CHANGELOG_V9.md#9.7.1">9.7.1</a><br/> <a href="doc/changelogs/CHANGELOG_V9.md#9.7.0">9.7.0</a><br/> |