node-linux-ppc64le 18.9.0 → 18.9.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +38 -0
- package/bin/node +0 -0
- package/include/node/config.gypi +31 -31
- package/include/node/node_version.h +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -8,6 +8,7 @@
|
|
|
8
8
|
</tr>
|
|
9
9
|
<tr>
|
|
10
10
|
<td>
|
|
11
|
+
<a href="#18.9.1">18.9.1</a><br/>
|
|
11
12
|
<a href="#18.9.0">18.9.0</a><br/>
|
|
12
13
|
<a href="#18.8.0">18.8.0</a><br/>
|
|
13
14
|
<a href="#18.7.0">18.7.0</a><br/>
|
|
@@ -42,6 +43,43 @@
|
|
|
42
43
|
* [io.js](CHANGELOG_IOJS.md)
|
|
43
44
|
* [Archive](CHANGELOG_ARCHIVE.md)
|
|
44
45
|
|
|
46
|
+
<a id="18.9.1"></a>
|
|
47
|
+
|
|
48
|
+
## 2022-09-23, Version 18.9.1 (Current), @RafaelGSS
|
|
49
|
+
|
|
50
|
+
This is a security release.
|
|
51
|
+
|
|
52
|
+
### Notable changes
|
|
53
|
+
|
|
54
|
+
The following CVEs are fixed in this release:
|
|
55
|
+
|
|
56
|
+
* **[CVE-2022-32212](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212)**: DNS rebinding in --inspect on macOS (High)
|
|
57
|
+
* Insufficient fix for macOS devices on v18.5.0
|
|
58
|
+
* **[CVE-2022-32222](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32222)**: Node 18 reads openssl.cnf from /home/iojs/build/ upon startup on MacOS (Medium)
|
|
59
|
+
* **[CVE-2022-32213](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32213)**: HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium)
|
|
60
|
+
* Insufficient fix on v18.5.0
|
|
61
|
+
* **[CVE-2022-32215](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32215)**: HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)
|
|
62
|
+
* Insufficient fix on v18.5.0
|
|
63
|
+
* **[CVE-2022-35256](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35256)**: HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)
|
|
64
|
+
* **[CVE-2022-35255](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35255)**: Weak randomness in WebCrypto keygen
|
|
65
|
+
|
|
66
|
+
More detailed information on each of the vulnerabilities can be found in [September 22nd 2022 Security Releases](https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/) blog post.
|
|
67
|
+
|
|
68
|
+
#### llhttp updated to 6.0.10
|
|
69
|
+
|
|
70
|
+
`llhttp` is updated to 6.0.10 which includes fixes for the following vulnerabilities.
|
|
71
|
+
|
|
72
|
+
* **HTTP Request Smuggling - CVE-2022-32213 bypass via obs-fold mechanic (Medium)([CVE-2022-32213](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32213) )**: The `llhttp` parser in the `http` module does not correctly parse and validate Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
|
|
73
|
+
* **HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)([CVE-2022-32215](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32215))**: The `llhttp` parser in the `http` module does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
|
|
74
|
+
* **HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)([CVE-35256](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35256))**: The llhttp parser in the `http` does not correctly handle header fields that are not terminated with CLRF. This can lead to HTTP Request Smuggling (HRS).
|
|
75
|
+
|
|
76
|
+
### Commits
|
|
77
|
+
|
|
78
|
+
* \[[`0c2a5723be`](https://github.com/nodejs/node/commit/0c2a5723be)] - **crypto**: fix weak randomness in WebCrypto keygen (Ben Noordhuis) [nodejs-private/node-private#](https://github.com/nodejs-private/node-private/pull/346)
|
|
79
|
+
* \[[`ffb6f4d51d`](https://github.com/nodejs/node/commit/ffb6f4d51d)] - **deps**: MacOS - fix location of OpenSSL config file (Michael Dawson) [nodejs-private/node-private#345](https://github.com/nodejs-private/node-private/pull/345)
|
|
80
|
+
* \[[`01bffcdd93`](https://github.com/nodejs/node/commit/01bffcdd93)] - **http**: disable chunked encoding when OBS fold is used (Paolo Insogna) [nodejs-private/node-private#341](https://github.com/nodejs-private/node-private/pull/341)
|
|
81
|
+
* \[[`2c379d341d`](https://github.com/nodejs/node/commit/2c379d341d)] - **src**: fix IPv4 non routable validation (RafaelGSS) [nodejs-private/node-private#337](https://github.com/nodejs-private/node-private/pull/337)
|
|
82
|
+
|
|
45
83
|
<a id="18.9.0"></a>
|
|
46
84
|
|
|
47
85
|
## 2022-09-08, Version 18.9.0 (Current), @RafaelGSS
|
package/bin/node
CHANGED
|
Binary file
|
package/include/node/config.gypi
CHANGED
|
@@ -30,7 +30,6 @@
|
|
|
30
30
|
'node_install_npm': 'true',
|
|
31
31
|
'node_library_files': [ 'lib/_tls_wrap.js',
|
|
32
32
|
'lib/tty.js',
|
|
33
|
-
'lib/dns.js',
|
|
34
33
|
'lib/_stream_duplex.js',
|
|
35
34
|
'lib/_stream_passthrough.js',
|
|
36
35
|
'lib/_stream_readable.js',
|
|
@@ -38,12 +37,13 @@
|
|
|
38
37
|
'lib/_stream_wrap.js',
|
|
39
38
|
'lib/_stream_writable.js',
|
|
40
39
|
'lib/_http_outgoing.js',
|
|
41
|
-
'lib/
|
|
40
|
+
'lib/net.js',
|
|
42
41
|
'lib/cluster.js',
|
|
43
42
|
'lib/console.js',
|
|
44
43
|
'lib/constants.js',
|
|
45
44
|
'lib/diagnostics_channel.js',
|
|
46
45
|
'lib/util.js',
|
|
46
|
+
'lib/_http_agent.js',
|
|
47
47
|
'lib/http2.js',
|
|
48
48
|
'lib/module.js',
|
|
49
49
|
'lib/path.js',
|
|
@@ -52,15 +52,14 @@
|
|
|
52
52
|
'lib/sys.js',
|
|
53
53
|
'lib/trace_events.js',
|
|
54
54
|
'lib/url.js',
|
|
55
|
-
'lib/
|
|
55
|
+
'lib/v8.js',
|
|
56
56
|
'lib/worker_threads.js',
|
|
57
57
|
'lib/tls.js',
|
|
58
58
|
'lib/child_process.js',
|
|
59
|
-
'lib/
|
|
59
|
+
'lib/fs.js',
|
|
60
60
|
'lib/os.js',
|
|
61
61
|
'lib/repl.js',
|
|
62
62
|
'lib/test.js',
|
|
63
|
-
'lib/net.js',
|
|
64
63
|
'lib/_http_incoming.js',
|
|
65
64
|
'lib/wasi.js',
|
|
66
65
|
'lib/events.js',
|
|
@@ -69,8 +68,8 @@
|
|
|
69
68
|
'lib/domain.js',
|
|
70
69
|
'lib/http.js',
|
|
71
70
|
'lib/perf_hooks.js',
|
|
72
|
-
'lib/
|
|
73
|
-
'lib/
|
|
71
|
+
'lib/crypto.js',
|
|
72
|
+
'lib/dns.js',
|
|
74
73
|
'lib/stream.js',
|
|
75
74
|
'lib/string_decoder.js',
|
|
76
75
|
'lib/timers.js',
|
|
@@ -81,10 +80,11 @@
|
|
|
81
80
|
'lib/assert.js',
|
|
82
81
|
'lib/async_hooks.js',
|
|
83
82
|
'lib/vm.js',
|
|
84
|
-
'lib/
|
|
83
|
+
'lib/_http_client.js',
|
|
85
84
|
'lib/_tls_common.js',
|
|
86
|
-
'lib/v8.js',
|
|
87
85
|
'lib/https.js',
|
|
86
|
+
'lib/inspector.js',
|
|
87
|
+
'lib/readline.js',
|
|
88
88
|
'lib/assert/strict.js',
|
|
89
89
|
'lib/dns/promises.js',
|
|
90
90
|
'lib/fs/promises.js',
|
|
@@ -94,9 +94,8 @@
|
|
|
94
94
|
'lib/internal/cli_table.js',
|
|
95
95
|
'lib/internal/constants.js',
|
|
96
96
|
'lib/internal/dgram.js',
|
|
97
|
-
'lib/internal/dtrace.js',
|
|
98
|
-
'lib/internal/validators.js',
|
|
99
97
|
'lib/internal/fixed_queue.js',
|
|
98
|
+
'lib/internal/socketaddress.js',
|
|
100
99
|
'lib/internal/freelist.js',
|
|
101
100
|
'lib/internal/heap_utils.js',
|
|
102
101
|
'lib/internal/idna.js',
|
|
@@ -107,7 +106,6 @@
|
|
|
107
106
|
'lib/internal/querystring.js',
|
|
108
107
|
'lib/internal/repl.js',
|
|
109
108
|
'lib/internal/socket_list.js',
|
|
110
|
-
'lib/internal/socketaddress.js',
|
|
111
109
|
'lib/internal/stream_base_commons.js',
|
|
112
110
|
'lib/internal/structured_clone.js',
|
|
113
111
|
'lib/internal/timers.js',
|
|
@@ -116,30 +114,32 @@
|
|
|
116
114
|
'lib/internal/v8_prof_processor.js',
|
|
117
115
|
'lib/internal/watchdog.js',
|
|
118
116
|
'lib/internal/http.js',
|
|
119
|
-
'lib/internal/
|
|
120
|
-
'lib/internal/worker.js',
|
|
117
|
+
'lib/internal/util.js',
|
|
121
118
|
'lib/internal/async_hooks.js',
|
|
122
119
|
'lib/internal/error_serdes.js',
|
|
120
|
+
'lib/internal/child_process.js',
|
|
121
|
+
'lib/internal/dtrace.js',
|
|
123
122
|
'lib/internal/errors.js',
|
|
124
|
-
'lib/internal/url.js',
|
|
125
123
|
'lib/internal/encoding.js',
|
|
126
124
|
'lib/internal/histogram.js',
|
|
127
125
|
'lib/internal/promise_hooks.js',
|
|
126
|
+
'lib/internal/abort_controller.js',
|
|
128
127
|
'lib/internal/blob.js',
|
|
129
128
|
'lib/internal/freeze_intrinsics.js',
|
|
130
129
|
'lib/internal/tty.js',
|
|
131
130
|
'lib/internal/wasm_web_api.js',
|
|
132
131
|
'lib/internal/event_target.js',
|
|
133
|
-
'lib/internal/
|
|
132
|
+
'lib/internal/url.js',
|
|
133
|
+
'lib/internal/worker.js',
|
|
134
134
|
'lib/internal/priority_queue.js',
|
|
135
135
|
'lib/internal/net.js',
|
|
136
|
-
'lib/internal/
|
|
136
|
+
'lib/internal/validators.js',
|
|
137
137
|
'lib/internal/assert/calltracker.js',
|
|
138
138
|
'lib/internal/assert/snapshot.js',
|
|
139
139
|
'lib/internal/assert/assertion_error.js',
|
|
140
140
|
'lib/internal/bootstrap/loaders.js',
|
|
141
|
-
'lib/internal/bootstrap/node.js',
|
|
142
141
|
'lib/internal/bootstrap/browser.js',
|
|
142
|
+
'lib/internal/bootstrap/node.js',
|
|
143
143
|
'lib/internal/bootstrap/switches/does_not_own_process_state.js',
|
|
144
144
|
'lib/internal/bootstrap/switches/does_own_process_state.js',
|
|
145
145
|
'lib/internal/bootstrap/switches/is_not_main_thread.js',
|
|
@@ -148,9 +148,9 @@
|
|
|
148
148
|
'lib/internal/cluster/shared_handle.js',
|
|
149
149
|
'lib/internal/cluster/utils.js',
|
|
150
150
|
'lib/internal/cluster/worker.js',
|
|
151
|
-
'lib/internal/cluster/primary.js',
|
|
152
151
|
'lib/internal/cluster/child.js',
|
|
153
152
|
'lib/internal/cluster/round_robin_handle.js',
|
|
153
|
+
'lib/internal/cluster/primary.js',
|
|
154
154
|
'lib/internal/console/global.js',
|
|
155
155
|
'lib/internal/console/constructor.js',
|
|
156
156
|
'lib/internal/crypto/certificate.js',
|
|
@@ -167,24 +167,24 @@
|
|
|
167
167
|
'lib/internal/crypto/ec.js',
|
|
168
168
|
'lib/internal/crypto/hkdf.js',
|
|
169
169
|
'lib/internal/crypto/mac.js',
|
|
170
|
-
'lib/internal/crypto/pbkdf2.js',
|
|
171
170
|
'lib/internal/crypto/rsa.js',
|
|
172
171
|
'lib/internal/crypto/util.js',
|
|
173
|
-
'lib/internal/crypto/webcrypto.js',
|
|
174
172
|
'lib/internal/crypto/keygen.js',
|
|
175
173
|
'lib/internal/crypto/keys.js',
|
|
174
|
+
'lib/internal/crypto/pbkdf2.js',
|
|
175
|
+
'lib/internal/crypto/webcrypto.js',
|
|
176
176
|
'lib/internal/debugger/inspect_client.js',
|
|
177
177
|
'lib/internal/debugger/inspect.js',
|
|
178
178
|
'lib/internal/debugger/inspect_repl.js',
|
|
179
|
-
'lib/internal/dns/utils.js',
|
|
180
179
|
'lib/internal/dns/promises.js',
|
|
180
|
+
'lib/internal/dns/utils.js',
|
|
181
181
|
'lib/internal/fs/read_file_context.js',
|
|
182
182
|
'lib/internal/fs/rimraf.js',
|
|
183
183
|
'lib/internal/fs/dir.js',
|
|
184
184
|
'lib/internal/fs/watchers.js',
|
|
185
|
-
'lib/internal/fs/promises.js',
|
|
186
185
|
'lib/internal/fs/streams.js',
|
|
187
186
|
'lib/internal/fs/sync_write_stream.js',
|
|
187
|
+
'lib/internal/fs/promises.js',
|
|
188
188
|
'lib/internal/fs/utils.js',
|
|
189
189
|
'lib/internal/fs/cp/cp-sync.js',
|
|
190
190
|
'lib/internal/fs/cp/cp.js',
|
|
@@ -197,12 +197,12 @@
|
|
|
197
197
|
'lib/internal/main/print_help.js',
|
|
198
198
|
'lib/internal/main/prof_process.js',
|
|
199
199
|
'lib/internal/main/repl.js',
|
|
200
|
-
'lib/internal/main/test_runner.js',
|
|
201
200
|
'lib/internal/main/check_syntax.js',
|
|
202
201
|
'lib/internal/main/eval_stdin.js',
|
|
203
202
|
'lib/internal/main/eval_string.js',
|
|
204
203
|
'lib/internal/main/mksnapshot.js',
|
|
205
204
|
'lib/internal/main/run_main_module.js',
|
|
205
|
+
'lib/internal/main/test_runner.js',
|
|
206
206
|
'lib/internal/main/worker_thread.js',
|
|
207
207
|
'lib/internal/modules/package_json_reader.js',
|
|
208
208
|
'lib/internal/modules/run_main.js',
|
|
@@ -210,7 +210,6 @@
|
|
|
210
210
|
'lib/internal/modules/cjs/loader.js',
|
|
211
211
|
'lib/internal/modules/esm/assert.js',
|
|
212
212
|
'lib/internal/modules/esm/create_dynamic_module.js',
|
|
213
|
-
'lib/internal/modules/esm/get_format.js',
|
|
214
213
|
'lib/internal/modules/esm/handle_process_exit.js',
|
|
215
214
|
'lib/internal/modules/esm/module_map.js',
|
|
216
215
|
'lib/internal/modules/esm/formats.js',
|
|
@@ -219,8 +218,9 @@
|
|
|
219
218
|
'lib/internal/modules/esm/fetch_module.js',
|
|
220
219
|
'lib/internal/modules/esm/module_job.js',
|
|
221
220
|
'lib/internal/modules/esm/package_config.js',
|
|
222
|
-
'lib/internal/modules/esm/
|
|
221
|
+
'lib/internal/modules/esm/get_format.js',
|
|
223
222
|
'lib/internal/modules/esm/loader.js',
|
|
223
|
+
'lib/internal/modules/esm/resolve.js',
|
|
224
224
|
'lib/internal/modules/esm/translators.js',
|
|
225
225
|
'lib/internal/per_context/messageport.js',
|
|
226
226
|
'lib/internal/per_context/domexception.js',
|
|
@@ -245,14 +245,14 @@
|
|
|
245
245
|
'lib/internal/process/promises.js',
|
|
246
246
|
'lib/internal/process/per_thread.js',
|
|
247
247
|
'lib/internal/process/warning.js',
|
|
248
|
-
'lib/internal/process/pre_execution.js',
|
|
249
248
|
'lib/internal/process/esm_loader.js',
|
|
250
249
|
'lib/internal/process/execution.js',
|
|
250
|
+
'lib/internal/process/pre_execution.js',
|
|
251
251
|
'lib/internal/readline/callbacks.js',
|
|
252
252
|
'lib/internal/readline/emitKeypressEvents.js',
|
|
253
253
|
'lib/internal/readline/promises.js',
|
|
254
|
-
'lib/internal/readline/interface.js',
|
|
255
254
|
'lib/internal/readline/utils.js',
|
|
255
|
+
'lib/internal/readline/interface.js',
|
|
256
256
|
'lib/internal/repl/history.js',
|
|
257
257
|
'lib/internal/repl/utils.js',
|
|
258
258
|
'lib/internal/repl/await.js',
|
|
@@ -271,11 +271,11 @@
|
|
|
271
271
|
'lib/internal/streams/duplex.js',
|
|
272
272
|
'lib/internal/streams/lazy_transform.js',
|
|
273
273
|
'lib/internal/streams/end-of-stream.js',
|
|
274
|
-
'lib/internal/streams/destroy.js',
|
|
275
274
|
'lib/internal/streams/pipeline.js',
|
|
276
275
|
'lib/internal/streams/readable.js',
|
|
277
276
|
'lib/internal/streams/transform.js',
|
|
278
277
|
'lib/internal/streams/operators.js',
|
|
278
|
+
'lib/internal/streams/destroy.js',
|
|
279
279
|
'lib/internal/streams/writable.js',
|
|
280
280
|
'lib/internal/test/binding.js',
|
|
281
281
|
'lib/internal/test/transfer.js',
|
|
@@ -289,9 +289,9 @@
|
|
|
289
289
|
'lib/internal/util/comparisons.js',
|
|
290
290
|
'lib/internal/util/iterable_weak_map.js',
|
|
291
291
|
'lib/internal/util/debuglog.js',
|
|
292
|
-
'lib/internal/util/inspector.js',
|
|
293
292
|
'lib/internal/util/types.js',
|
|
294
293
|
'lib/internal/util/inspect.js',
|
|
294
|
+
'lib/internal/util/inspector.js',
|
|
295
295
|
'lib/internal/util/parse_args/utils.js',
|
|
296
296
|
'lib/internal/util/parse_args/parse_args.js',
|
|
297
297
|
'lib/internal/vm/module.js',
|
|
@@ -299,10 +299,10 @@
|
|
|
299
299
|
'lib/internal/webstreams/queuingstrategies.js',
|
|
300
300
|
'lib/internal/webstreams/transfer.js',
|
|
301
301
|
'lib/internal/webstreams/encoding.js',
|
|
302
|
-
'lib/internal/webstreams/util.js',
|
|
303
302
|
'lib/internal/webstreams/adapters.js',
|
|
304
303
|
'lib/internal/webstreams/transformstream.js',
|
|
305
304
|
'lib/internal/webstreams/readablestream.js',
|
|
305
|
+
'lib/internal/webstreams/util.js',
|
|
306
306
|
'lib/internal/webstreams/writablestream.js',
|
|
307
307
|
'lib/internal/worker/io.js',
|
|
308
308
|
'lib/internal/worker/js_transferable.js',
|