- Mar 28, 2018
-
-
Myles Borins authored
This is a security release. All Node.js users should consult the security release summary at: https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/ for details on patched vulnerabilities. Fixes for the following CVEs are included in this release: * CVE-2018-7158 * CVE-2018-7159 * CVE-2018-7160 Notable changes: * Upgrade to OpenSSL 1.0.2o: Does not contain any security fixes that are known to impact Node.js. * **Fix for inspector DNS rebinding vulnerability (CVE-2018-7160)**: A malicious website could use a DNS rebinding attack to trick a web browser to bypass same-origin-policy checks and allow HTTP connections to localhost or to hosts on the local network, potentially to an open inspector port as a debugger, therefore gaining full code execution access. The inspector now only allows connections that have a browser `Host` value of `localhost` or `localhost6`. * **Fix for `'path'` module regular expression denial of service (CVE-2018-7158)**: A regular expression used for parsing POSIX an Windows paths could be used to cause a denial of service if an attacker were able to have a specially crafted path string passed through one of the impacted `'path'` module functions. * **Reject spaces in HTTP `Content-Length` header values (CVE-2018-7159)**: The Node.js HTTP parser allowed for spaces inside `Content-Length` header values. Such values now lead to rejected connections in the same way as non-numeric values. * **Update root certificates**: 5 additional root certificates have been added to the Node.js binary and 30 have been removed. PR-URL: https://github.com/nodejs-private/node-private/pull/113
-
Eugene Ostroukhov authored
Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/109 PR-URL: https://github.com/nodejs-private/node-private/pull/102/ Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
Сковорода Никита Андреевич <chalkerx@gmail.com> Reviewed-By:
Anna Henningsen <anna@addaleax.net>
-
Ali Ijaz Sheikh authored
Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/109 PR-URL: https://github.com/nodejs-private/node-private/pull/102/ Reviewed-By:
-
Ben Noordhuis authored
Remove the CNNIC certificates again and remove the whitelist from commit 3beb8807 ("crypto: add cert check to CNNIC Whitelist") from June 2015. Backport-PR-URL: https://github.com/nodejs/node/pull/19632 PR-URL: https://github.com/nodejs/node/pull/19322 Reviewed-By:
Fedor Indutny <fedor.indutny@gmail.com> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By:
James M Snell <jasnell@gmail.com>
-
Ben Noordhuis authored
Update the list of root certificates in src/node_root_certs.h with tools/mk-ca-bundle.pl. Certificates added: - GDCA TrustAUTH R5 ROOT - SSL.com EV Root Certification Authority ECC - SSL.com EV Root Certification Authority RSA R2 - SSL.com Root Certification Authority ECC - SSL.com Root Certification Authority RSA - TrustCor ECA-1 - TrustCor RootCert CA-1 - TrustCor RootCert CA-2 Certificates removed: - ACEDICOM Root - AddTrust Low-Value Services Root - AddTrust Public Services Root - AddTrust ualified Certificates Root - CA Disig Root R1 - Camerfirma Chambers of Commerce Root - Camerfirma Global Chambersign Root - CA WoSign ECC Root - Certification Authority of WoSign G2 - Certinomis - Autorité Racine - Certum Root CA - China Internet Network Information Center EV Certificates Root - CNNIC ROOT - Comodo Secure Services root - Comodo Trusted Services root - DST ACES CA X6 - GeoTrust Global CA 2 - PSCProcert - Security Communication EV RootCA1 - StartCom Certification Authority - StartCom Certification Authority - StartCom Certification Authority G2 - Swisscom Root CA 1 - Swisscom Root CA 2 - Swisscom Root EV CA 2 - TUBITAK UEKAE Kok Sertifika Hizmet Saglayicisi - Surum 3 - TURKTRUST Certificate Services Provider Root 2007 - UTN USERFirst Hardware Root CA - WoSign - WoSign China Backport-PR-URL: https://github.com/nodejs/node/pull/19632 PR-URL: https://github.com/nodejs/node/pull/19322 Reviewed-By:
-
Ben Noordhuis authored
This is the certdata.txt[0] from NSS 3.36, released on 2018-03-05. This is the version of NSS that will ship in Firefox 60 on 2018-05-01. [0] https://hg.mozilla.org/projects/nss/raw-file/NSS_3_36_RTM/lib/ckfw/builtins/certdata.txt Backport-PR-URL: https://github.com/nodejs/node/pull/19632 PR-URL: https://github.com/nodejs/node/pull/19322 Reviewed-By:
-
Shigeki Ohtsu authored
In openssl s_client on Windows, RAND_screen() is invoked to initialize random state but it takes several seconds in each connection. This added -no_rand_screen to openssl s_client on Windows to skip RAND_screen() and gets a better performance in the unit test of test-tls-server-verify. Do not enable this except to use in the unit test. Backport-PR-URL: https://github.com/nodejs/node/pull/19638 Fixes: https://github.com/nodejs/io.js/issues/1461 PR-URL: https://github.com/nodejs/io.js/pull/1836 Reviewed-By:
-
Shigeki Ohtsu authored
Reapply b9106137 . Backport-PR-URL: https://github.com/nodejs/node/pull/19638 Fixes: https://github.com/iojs/io.js/issues/589 PR-URL: https://github.com/iojs/io.js/pull/1389 Reviewed-By:
Fedor Indutny <fedor@indutny.com> Reviewed-By:
-
Shigeki Ohtsu authored
See https://mta.openssl.org/pipermail/openssl-dev/2015-February/000651.html iojs needs to stop using masm and move to nasm or yasm on Win32. Backport-PR-URL: https://github.com/nodejs/node/pull/19638 Fixes: https://github.com/iojs/io.js/issues/589 PR-URL: https://github.com/iojs/io.js/pull/1389 Reviewed-By:
-
Fedor Indutny authored
`x86masm.pl` was mistakenly using .486 instruction set, why `cpuid` (and perhaps others) are requiring .686 . Backport-PR-URL: https://github.com/nodejs/node/pull/19638 Fixes: https://github.com/iojs/io.js/issues/589 PR-URL: https://github.com/iojs/io.js/pull/1389 Reviewed-By:
Shigeki Ohtsu <ohtsu@iij.ad.jp>
-
Shigeki Ohtsu authored
All symlink files in `deps/openssl/openssl/include/openssl/` are removed and replaced with real header files to avoid issues on Windows. Two files of opensslconf.h in crypto and include dir are replaced to refer config/opensslconf.h. PR-URL: https://github.com/nodejs/node/pull/19638 Reviewed-By:
Tobias Nießen <tniessen@tnie.de> Reviewed-By:
Rod Vagg <rod@vagg.org>
-
Shigeki Ohtsu authored
This replaces all sources of openssl-1.0.2o.tar.gz into deps/openssl/openssl PR-URL: https://github.com/nodejs/node/pull/19638 Reviewed-By:
-
Ben Noordhuis authored
Original commit message follows: Before this commit `Content-Length: 4 2` was accepted as a valid header and recorded as `parser->content_length = 42`. Now it is a parse error that fails with error `HPE_INVALID_CONTENT_LENGTH`. Downstream users that inspect `parser->content_length` and naively parse the string value using `strtoul()` might get confused by the discrepancy between the two values. Resolve that by simply not letting it happen. Fixes: https://github.com/nodejs-private/security/issues/178 PR-URL: https://github.com/nodejs-private/http-parser-private/pull/1 Reviewed-By:Evan Lucas <evanlucas@me.com> Reviewed-By:
-
Ben Noordhuis authored
PR-URL: https://github.com/nodejs-private/http-parser-private/pull/1 Reviewed-By:
-
- Mar 07, 2018
-
-
Myles Borins authored
PR-URL: https://github.com/nodejs/node/pull/19027
-
Myles Borins authored
Notable Changes: * http, tls: - better support for IPv6 addresses (Mattias Holmlund) https://github.com/nodejs/node/pull/14772 PR-URL: https://github.com/nodejs/node/pull/19027
-
- Feb 27, 2018
-
-
Beth Griggs authored
Allows env vars to be passed through to child processes. This is needed for things like NODE_TEST_DIR or LD_LIBRARY_PATH if testing the shared library. Backport-PR-URL: https://github.com/nodejs/node/pull/18883 PR-URL: https://github.com/nodejs/node/pull/14822 Refs: https://github.com/nodejs/node/pull/13390 Reviewed-By:
Refael Ackermann <refack@gmail.com> Reviewed-By:
Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By:
Luigi Pinca <luigipinca@gmail.com> Reviewed-By:
-
vdeturckheim authored
PR-URL: https://github.com/nodejs/node/pull/18432 Reviewed-By:
Anatoli Papirovski <apapirovski@mac.com> Reviewed-By:
Vse Mozhet Byt <vsemozhetbyt@gmail.com> Reviewed-By:
Tiancheng "Timothy" Gu <timothygu99@gmail.com>
-
ryanmahan authored
assert.strictEqual message argument removed to replace with default assert message to show the expected vs actual values PR-URL: https://github.com/nodejs/node/pull/18259 Refs: https://github.com/nodejs/node/issues/13296 Reviewed-By:
Shingo Inoue <leko.noor@gmail.com> Reviewed-By:
Jon Moss <me@jonathanmoss.me> Reviewed-By:
-
Tobias Nießen authored
Use upper case variant in text in compliance with RFC 2898. PR-URL: https://github.com/nodejs/node/pull/18279 Reviewed-By:
Michaël Zasso <targos@protonmail.com> Reviewed-By:
Vladimir Kurchatkin <vladimir.kurchatkin@gmail.com> Reviewed-By:
Ruben Bridgewater <ruben@bridgewater.de>
-
Mandeep Singh authored
PR-URL: https://github.com/nodejs/node/pull/17326 Refs: https://github.com/nodejs/node/issues/17169 Reviewed-By:
-
Leko authored
PR-URL: https://github.com/nodejs/node/pull/18236 Reviewed-By:
-
Franziska Hinkelmann authored
Add 8.x to the LTS versions that use a V8 branch that is not active anymore. PR-URL: https://github.com/nodejs/node/pull/18155 Reviewed-By:
-
Suixinlei authored
Fixes: https://github.com/nodejs/node/issues/12516 Refs: https://github.com/nodejs/node/pull/2497 PR-URL: https://github.com/nodejs/node/pull/17705 Reviewed-By:
Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By:
-
Matheus Marchini authored
The build breaks if there's a non-ASCII character on the path to the building directory. PR-URL: https://github.com/nodejs/node/pull/16735 Refs: https://github.com/nodejs/node/issues/16278 Refs: https://github.com/nodejs/node/issues/14336 Reviewed-By:
Gibson Fahnestock <gibfahn@gmail.com> Reviewed-By:
-
Rich Trott authored
Change many instances of "x is considered to be y" to "x is y". PR-URL: https://github.com/nodejs/node/pull/18095 Reviewed-By:
Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By:
Richard Lau <riclau@uk.ibm.com> Reviewed-By:
-
陈刚 authored
Fixes: https://github.com/nodejs/node/issues/18116 PR-URL: https://github.com/nodejs/node/pull/18121 Reviewed-By:
Weijia Wang <starkwang@126.com>
-
Tobias Nießen authored
PR-URL: https://github.com/nodejs/node/pull/18103 Reviewed-By:
-
sreepurnajasti authored
PR-URL: https://github.com/nodejs/node/pull/18097 Reviewed-By:
-
Jon Moss authored
PR-URL: https://github.com/nodejs/node/pull/16539 Fixes: https://github.com/nodejs/node/issues/16394 Reviewed-By:
-
Leko authored
PR-URL: https://github.com/nodejs/node/pull/18117 Reviewed-By:
Yuta Hiroto <hello@about-hiroppy.com> Reviewed-By:
Daijiro Wachi <daijiro.wachi@gmail.com> Reviewed-By:
-
Rich Trott authored
In the documentation for the buffer module, change instances of "the result is considered undefined behavior" to "the resulting behavior is undefined". It's less ambiguous in meaning and less awkward stylistically. PR-URL: https://github.com/nodejs/node/pull/18091 Reviewed-By:
Jeremiah Senkpiel <fishrock123@rocketmail.com> Reviewed-By:
Minwoo Jung <minwoo@nodesource.com> Reviewed-By:
Khaidi Chu <i@2333.moe> Reviewed-By:
-
Weijia Wang authored
After slicing, the `lastSegmentLength` should be calculated again, instead of assigning value `j`. PR-URL: https://github.com/nodejs/node/pull/17974 Fixes: https://github.com/nodejs/node/issues/17928 Reviewed-By:
-
Refael Ackermann authored
PR-URL: https://github.com/nodejs/node/pull/17379 Reviewed-By:
-
Rich Trott authored
PR-URL: https://github.com/nodejs/node/pull/17988 Fixes: https://github.com/nodejs/node/issues/17986 Reviewed-By:
-
Anatoli Papirovski authored
PR-URL: https://github.com/nodejs/node/pull/18007 Reviewed-By:
Eugene Ostroukhov <eostroukhov@google.com> Reviewed-By:
Rich Trott <rtrott@gmail.com> Reviewed-By:
Roman Reiss <me@silverwind.io> Reviewed-By:
-
Jon Moss authored
PR-URL: https://github.com/nodejs/node/pull/17556 Reviewed-By:
-
Anna Henningsen authored
Document and test the existing support for generic Duplex streams in the TLS module. PR-URL: https://github.com/nodejs/node/pull/17599 Reviewed-By:
-
Mattias Holmlund authored
- Properly handle IPv6 in Host header when setting servername. - When comparing IP addresses against addresses in the subjectAltName field of a certificate, format the address correctly before doing the string comparison. PR-URL: https://github.com/nodejs/node/pull/14772 Fixes: https://github.com/nodejs/node/issues/14736 Reviewed-By:
-
- Feb 14, 2018
-
-
Myles Borins authored
PR-URL: https://github.com/nodejs/node/pull/18342
-
