mirror of
https://github.com/nodejs/node.git
synced 2024-12-01 16:10:02 +01:00
9910cc29bc
This is a security release. All Node.js users should consult the security release summary at: https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/ for details on patched vulnerabilities. Fixes for the following CVEs are included in this release: * Node.js: Denial of Service with large HTTP headers (CVE-2018-12121) * Node.js: Slowloris HTTP Denial of Service (CVE-2018-12122 / Node.js) * Node.js: Hostname spoofing in URL parser for javascript protocol (CVE-2018-12123) * OpenSSL: Timing vulnerability in DSA signature generation (CVE-2018-0734) * OpenSSL: Timing vulnerability in ECDSA signature generation (CVE-2019-0735) Notable Changes: * deps: Upgrade to OpenSSL 1.1.0j, fixing CVE-2018-0734 and CVE-2019-0735 * http: * Headers received by HTTP servers must not exceed 8192 bytes in total to prevent possible Denial of Service attacks. Reported by Trevor Norris. (CVE-2018-12121 / Matteo Collina) * A timeout of 40 seconds now applies to servers receiving HTTP headers. This value can be adjusted with `server.headersTimeout`. Where headers are not completely received within this period, the socket is destroyed on the next received chunk. In conjunction with `server.setTimeout()`, this aids in protecting against excessive resource retention and possible Denial of Service. Reported by Jan Maybach (liebdich.com). * url: Fix a bug that would allow a hostname being spoofed when parsing URLs with `url.parse()` with the `'javascript:'` protocol. Reported by Martin Bajanik (kenticocloud.com). (CVE-2018-12123 / Matteo Collina) PR-URL: https://github.com/nodejs-private/node-private/pull/155/ |
||
|---|---|---|
| .. | ||
| addons.md | ||
| assert.md | ||
| async_hooks.md | ||
| buffer.md | ||
| child_process.md | ||
| cli.md | ||
| cluster.md | ||
| console.md | ||
| crypto.md | ||
| debugger.md | ||
| deprecations.md | ||
| dgram.md | ||
| dns.md | ||
| documentation.md | ||
| domain.md | ||
| errors.md | ||
| esm.md | ||
| events.md | ||
| fs.md | ||
| globals.md | ||
| http2.md | ||
| http.md | ||
| https.md | ||
| index.md | ||
| inspector.md | ||
| intl.md | ||
| modules.md | ||
| n-api.md | ||
| net.md | ||
| os.md | ||
| path.md | ||
| perf_hooks.md | ||
| process.md | ||
| punycode.md | ||
| querystring.md | ||
| readline.md | ||
| repl.md | ||
| stream.md | ||
| string_decoder.md | ||
| synopsis.md | ||
| timers.md | ||
| tls.md | ||
| tracing.md | ||
| tty.md | ||
| url.md | ||
| util.md | ||
| v8.md | ||
| vm.md | ||
| worker_threads.md | ||
| zlib.md | ||