- Nov 27, 2018
-
-
Matteo Collina authored
CVE-2018-12122 An attacker can send a char/s within headers and exahust the resources (file descriptors) of a system even with a tight max header length protection. This PR destroys a socket if it has not received the headers in 40s. PR-URL: https://github.com/nodejs-private/node-private/pull/152 Ref: https://github.com/nodejs-private/node-private/pull/144 Reviewed-By:
Sam Roberts <vieuxtech@gmail.com> Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
James M Snell <jasnell@gmail.com>
-
Matteo Collina authored
CVE-2018-12121 PR-URL: https://github.com/nodejs-private/node-private/pull/143 Ref: https://github.com/nodejs-private/security/issues/139 Ref: https://github.com/nodejs-private/http-parser-private/pull/2 Reviewed-By:
Anatoli Papirovski <apapirovski@mac.com> Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Rod Vagg <rod@vagg.org> Reviewed-By:
Anna Henningsen <anna@addaleax.net>
-
- Nov 24, 2018
-
-
Ben Noordhuis authored
CVE-2018-12120 Backport of 8e7cbe25 to v6.x Prepared by Sam Roberts <vieuxtech@gmail.com> Original commit: Commit 22720524 ("net: bind to `::` TCP address by default") from April 2014 seems to have accidentally changed the default listen address from 127.0.0.1 to 0.0.0.0, a.k.a. the "any" address. From a security viewpoint it's undesirable to accept debug agent connections from anywhere so let's change that back. Users can override the default with the `--debug=<host>:<port>` switch. Fixes: https://github.com/nodejs/node/issues/8081 PR-URL: https://github.com/nodejs/node/pull/8106 Reviewed-By:
James M Snell <jasnell@gmail.com> PR-URL: https://github.com/nodejs-private/node-private/pull/148 Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
Sam Roberts <vieuxtech@gmail.com> Reviewed-By:
Matteo Collina <matteo.collina@gmail.com> Reviewed-By:
Rod Vagg <rod@vagg.org>
-
Shigeki Ohtsu authored
In openssl s_client on Windows, RAND_screen() is invoked to initialize random state but it takes several seconds in each connection. This added -no_rand_screen to openssl s_client on Windows to skip RAND_screen() and gets a better performance in the unit test of test-tls-server-verify. Do not enable this except to use in the unit test. Fixes: https://github.com/nodejs/io.js/issues/1461 PR-URL: https://github.com/nodejs/io.js/pull/1836 Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl>
-
Shigeki Ohtsu authored
Reapply b9106137 . Fixes: https://github.com/iojs/io.js/issues/589 PR-URL: https://github.com/iojs/io.js/pull/1389 Reviewed-By:
Fedor Indutny <fedor@indutny.com> Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl>
-
Shigeki Ohtsu authored
See https://mta.openssl.org/pipermail/openssl-dev/2015-February/000651.html iojs needs to stop using masm and move to nasm or yasm on Win32. Fixes: https://github.com/iojs/io.js/issues/589 PR-URL: https://github.com/iojs/io.js/pull/1389 Reviewed-By:
Fedor Indutny <fedor@indutny.com> Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl>
-
Fedor Indutny authored
`x86masm.pl` was mistakenly using .486 instruction set, why `cpuid` (and perhaps others) are requiring .686 . Fixes: https://github.com/iojs/io.js/issues/589 PR-URL: https://github.com/iojs/io.js/pull/1389 Reviewed-By:
Fedor Indutny <fedor@indutny.com> Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
Shigeki Ohtsu <ohtsu@iij.ad.jp>
-
Sam Roberts authored
All symlink files in `deps/openssl/openssl/include/openssl/` are removed and replaced with real header files to avoid issues on Windows. Two files of opensslconf.h in crypto and include dir are replaced to refer config/opensslconf.h. Header files were generated by: $ cd deps/openssl $ mkdir -p openssl/include/openssl $ tar xf .../openssl-1.02q.tar.gz $ cd openssl-1.02q $ ./config $ cd include/openssl $ sed -i '' *.h $ cp *.h ../../../openssl/include/openssl/ PR-URL: https://github.com/nodejs/node/pull/24530 Reviewed-By:
Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By:
Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By:
Rod Vagg <rod@vagg.org>
-
Sam Roberts authored
This updates all sources in deps/openssl/openssl with openssl-1.0.2q. PR-URL: https://github.com/nodejs/node/pull/24530 Reviewed-By:
Shigeki Ohtsu <ohtsu@ohtsu.org> Reviewed-By:
Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By:
Rod Vagg <rod@vagg.org>
-
Rod Vagg authored
-
- Aug 15, 2018
-
-
Rod Vagg authored
This is a security release. All Node.js users should consult the security release summary at: https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/ for details on patched vulnerabilities. Fixes for the following CVEs are included in this release: * CVE-2018-0732 (OpenSSL) * CVE-2018-12115 (Node.js) Notable changes: * buffer: Fix out-of-bounds (OOB) write in `Buffer.write()` for UCS-2 encoding (CVE-2018-12115) * deps: Upgrade to OpenSSL 1.0.2p, fixing: * Client DoS due to large DH parameter (CVE-2018-0732) * ECDSA key extraction via local side-channel (CVE not assigned)
-
Shigeki Ohtsu authored
After upgradeing OpenSSL-1.0.2p, test-tls-passphrase.js was failed due to change of error messages. Ref: https://github.com/openssl/openssl/commit/18026c0215e942f0ad33a6012cb8cad2f51f841b PR-URL: https://github.com/nodejs/node/pull/22320 Reviewed-By:
Rod Vagg <rod@vagg.org>
-
Shigeki Ohtsu authored
In openssl s_client on Windows, RAND_screen() is invoked to initialize random state but it takes several seconds in each connection. This added -no_rand_screen to openssl s_client on Windows to skip RAND_screen() and gets a better performance in the unit test of test-tls-server-verify. Do not enable this except to use in the unit test. Fixes: https://github.com/nodejs/io.js/issues/1461 PR-URL: https://github.com/nodejs/io.js/pull/1836 Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl>
-
Shigeki Ohtsu authored
Reapply b9106137 . Fixes: https://github.com/iojs/io.js/issues/589 PR-URL: https://github.com/iojs/io.js/pull/1389 Reviewed-By:
Fedor Indutny <fedor@indutny.com> Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl>
-
Shigeki Ohtsu authored
See https://mta.openssl.org/pipermail/openssl-dev/2015-February/000651.html iojs needs to stop using masm and move to nasm or yasm on Win32. Fixes: https://github.com/iojs/io.js/issues/589 PR-URL: https://github.com/iojs/io.js/pull/1389 Reviewed-By:
Fedor Indutny <fedor@indutny.com> Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl>
-
Fedor Indutny authored
`x86masm.pl` was mistakenly using .486 instruction set, why `cpuid` (and perhaps others) are requiring .686 . Fixes: https://github.com/iojs/io.js/issues/589 PR-URL: https://github.com/iojs/io.js/pull/1389 Reviewed-By:
Fedor Indutny <fedor@indutny.com> Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
Shigeki Ohtsu <ohtsu@iij.ad.jp>
-
Shigeki Ohtsu authored
All symlink files in `deps/openssl/openssl/include/openssl/` are removed and replaced with real header files to avoid issues on Windows. Two files of opensslconf.h in crypto and include dir are replaced to refer config/opensslconf.h. PR-URL: https://github.com/nodejs/node/pull/22320 Reviewed-By:
Rod Vagg <rod@vagg.org>
-
Shigeki Ohtsu authored
This replaces all sources of openssl-1.0.2p.tar.gz into deps/openssl/openssl PR-URL: https://github.com/nodejs/node/pull/22320 Reviewed-By:
Rod Vagg <rod@vagg.org>
-
Rod Vagg authored
CVE-2018-12115 Discovered by ChALkeR - Сковорода Никита Андреевич Fix by Anna Henningsen Writing to the second-to-last byte with UCS-2 encoding will cause a -1 length to be send to String::Write(), writing all of the provided Buffer from that point and beyond. Fixes: https://github.com/nodejs-private/security/issues/203 PR-URL: https://github.com/nodejs-private/node-private/pull/138
-
- Aug 13, 2018
-
-
Ben Noordhuis authored
Change the bind address from 0.0.0.0 to 127.0.0.1 and start respecting the address part of `--inspect=<address>:<port>` so that the bind address can be overridden by the user. Fixes: https://github.com/nodejs/node/issues/21349 PR-URL: https://github.com/nodejs/node/pull/21376 Reviewed-By:
James M Snell <jasnell@gmail.com>
-
Fedor Indutny authored
The certificates in test fixtures were set to expire in 999 days since they were generated. That time has passed, and they have to be reissued. Bump expiration time to 99999 days for all of them to prevent this from happening again in near future. PR-URL: https://github.com/nodejs/node/pull/22184 Fixes: https://github.com/nodejs/node/issues/22182 Reviewed-By:
Myles Borins <myles.borins@gmail.com> Reviewed-By:
Gus Caplan <me@gus.host> Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Rich Trott <rtrott@gmail.com> Reviewed-By:
Rod Vagg <rod@vagg.org>
-
Daniel Bevenius authored
Currently when running make clean, followed by make not all certificates get genenerated. In addition there are also the following error messages related to the startdate in agent8-cert.pem, and agent9-cert.pem: start date is invalid, it should be YYMMDDHHMMSSZ After this commit it is possible to perform the following commands: $ make clean $ make $ make test PR-URL: https://github.com/nodejs/node/pull/19975 Reviewed-By:
Rich Trott <rtrott@gmail.com> Reviewed-By:
James M Snell <jasnell@gmail.com>
-
- Jun 13, 2018
-
-
Evan Lucas authored
PR-URL: https://github.com/nodejs-private/node-private/pull/134
-
- Jun 12, 2018
-
-
Evan Lucas authored
Notable changes: * **buffer** (CVE-2018-7167): Fixes Denial of Service vulnerability where calling Buffer.fill() could hang PR-URL: https://github.com/nodejs-private/node-private/pull/134 -
Сковорода Никита Андреевич authored
Previously, zero-length Buffers and TypedArrays passed as fillers hanged Buffer#fill and Buffer.from. This changes those cases when it hanged to a zero-fill instead, which should be backwards compatible. This fixes CVE-2018-7167. PR-URL: https://github.com/nodejs-private/node-private/pull/121 Fixes: https://github.com/nodejs-private/security/issues/193 Refs: https://github.com/nodejs-private/node-private/pull/118 Reviewed-By:
Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By:
Tiancheng "Timothy" Gu <timothygu99@gmail.com> Reviewed-By:
Evan Lucas <evanlucas@me.com> Reviewed-By:
Michael Dawson <michael_dawson@ca.ibm.com>
-
- May 01, 2018
-
-
Myles Borins authored
PR-URL: https://github.com/nodejs/node/pull/19996
-
- Apr 30, 2018
-
-
Myles Borins authored
Notable Change: * n-api: - n-api has been backported to v6.x. It is being landed as an experimental interface, and as such is landing in a Semver-Patch release. (Gabriel Schulhof) https://github.com/nodejs/node/pull/19447 PR-URL: https://github.com/nodejs/node/pull/19996
-
- Apr 17, 2018
-
-
Kyle Farnung authored
* Updated tests for `Number` and `int32_t` * Added new tests for `int64_t` * Updated N-API `int64_t` behavior to return zero for all non-finite numbers * Clarified the documentation for these calls. Backport-PR-URL: https://github.com/nodejs/node/pull/19447 PR-URL: https://github.com/nodejs/node/pull/19402 Refs: https://github.com/nodejs/node-chakracore/pull/500 Reviewed-By:
Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By:
James M Snell <jasnell@gmail.com>
-
Gabriel Schulhof authored
Heed the comment to not use fields of a Reference after calling its finalize callback, because such a call may destroy the Reference. Fixes: https://github.com/nodejs/node/issues/19673 Backport-PR-URL: https://github.com/nodejs/node/pull/19447 PR-URL: https://github.com/nodejs/node/pull/19718 Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com>
-
Gabriel Schulhof authored
Whenever we call into an addon, whether it is for a callback, for module init, or for async work-related reasons, we should make sure that * the last error is cleared, * the scopes before the call are the same as after, and * if an exception was thrown and captured inside the module, then it is re-thrown after the call. Therefore we should call into the module in a unified fashion. This change introduces the macro NAPI_CALL_INTO_MODULE() which should be used whenever invoking a callback provided by the module. Fixes: https://github.com/nodejs/node/issues/19437 Backport-PR-URL: https://github.com/nodejs/node/pull/19447 PR-URL: https://github.com/nodejs/node/pull/19537 Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Michael Dawson <michael_dawson@ca.ibm.com>
-
Michael Dawson authored
Bump the version due to additions to the api. Backport-PR-URL: https://github.com/nodejs/node/pull/19447 PR-URL: https://github.com/nodejs/node/pull/19497 Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Ruben Bridgewater <ruben@bridgewater.de>
-
jiangq authored
Backport-PR-URL: https://github.com/nodejs/node/pull/19447 PR-URL: https://github.com/nodejs/node/pull/19555 Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Trivikram Kamat <trivikr.dev@gmail.com>
-
Gabriel Schulhof authored
This re-writes the test in C by dropping std::vector<napi_value> in favour of a C99 variable length array, and by dropping the anonymous namespace in favour of static function declarations. Backport-PR-URL: https://github.com/nodejs/node/pull/19447 PR-URL: https://github.com/nodejs/node/pull/19448 Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Luigi Pinca <luigipinca@gmail.com> Reviewed-By:
Michael Dawson <michael_dawson@ca.ibm.com>
-
Mathias Buus authored
Add function to trigger and uncaught exception. Useful if an async callback throws an exception with no way to recover. Backport-PR-URL: https://github.com/nodejs/node/pull/19447 PR-URL: https://github.com/nodejs/node/pull/19337 Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Anna Henningsen <anna@addaleax.net> Reviewed-By:
Michael Dawson <michael_dawson@ca.ibm.com>
-
Michael Dawson authored
Add checks for a pending exception in napi_make_callback after the callback has been invoked. If there is a pending exception then we need to avoid checking the result as that will not be able to complete properly. Add additional checks to the unit test for napi_make_callback to catch this case. Backport-PR-URL: https://github.com/nodejs/node/pull/19447 PR-URL: https://github.com/nodejs/node/pull/19362 Fixes: https://github.com/nodejs/node-addon-api/issues/235 Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Anna Henningsen <anna@addaleax.net>
-
Kyle Robinson Young authored
Backport-PR-URL: https://github.com/nodejs/node/pull/19447 PR-URL: https://github.com/nodejs/node/pull/19385 Reviewed-By:
Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By:
Franziska Hinkelmann <franziska.hinkelmann@gmail.com> Reviewed-By:
Michaël Zasso <targos@protonmail.com> Reviewed-By:
Richard Lau <riclau@uk.ibm.com> Reviewed-By:
Vse Mozhet Byt <vsemozhetbyt@gmail.com> Reviewed-By:
Tobias Nießen <tniessen@tnie.de> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com>
-
Kyle Farnung authored
Added some simple tests to verify that the int64 API is correctly handling numbers greater than 32-bits. This is a basic test, but verifies that an implementer hasn't truncated back to 32-bits. Refs: https://github.com/nodejs/node-chakracore/pull/496 Backport-PR-URL: https://github.com/nodejs/node/pull/19447 PR-URL: https://github.com/nodejs/node/pull/19309 Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Gabriel Schulhof <gabriel.schulhof@intel.com> Reviewed-By:
James M Snell <jasnell@gmail.com>
-
Michael Dawson authored
Take n-api out of experimental as per: https://github.com/nodejs/TSC/issues/501 Backport-PR-URL: https://github.com/nodejs/node/pull/19447 PR-URL: https://github.com/nodejs/node/pull/19262 Reviewed-By:
Matteo Collina <matteo.collina@gmail.com> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Michaël Zasso <targos@protonmail.com> Reviewed-By:
Gus Caplan <me@gus.host> Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Franziska Hinkelmann <franziska.hinkelmann@gmail.com>
-
Taylor Woll authored
Added a N-API test to verify new.target behavior. Backport-PR-URL: https://github.com/nodejs/node/pull/19447 PR-URL: https://github.com/nodejs/node/pull/19236 Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Michael Dawson <michael_dawson@ca.ibm.com>
-
Gabriel Schulhof authored
The last promise created by the test for the purposes of making sure that its type is indeed a promise needs to be resolved so as to avoid having it left in the pending state at the end of the test. Backport-PR-URL: https://github.com/nodejs/node/pull/19447 PR-URL: https://github.com/nodejs/node/pull/19245 Reviewed-By:
James M Snell <jasnell@gmail.com> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Michael Dawson <michael_dawson@ca.ibm.com>
-