node-linux-s390x 18.9.0 → 18.9.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +38 -0
- package/bin/node +0 -0
- package/include/node/node_version.h +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -8,6 +8,7 @@
|
|
|
8
8
|
</tr>
|
|
9
9
|
<tr>
|
|
10
10
|
<td>
|
|
11
|
+
<a href="#18.9.1">18.9.1</a><br/>
|
|
11
12
|
<a href="#18.9.0">18.9.0</a><br/>
|
|
12
13
|
<a href="#18.8.0">18.8.0</a><br/>
|
|
13
14
|
<a href="#18.7.0">18.7.0</a><br/>
|
|
@@ -42,6 +43,43 @@
|
|
|
42
43
|
* [io.js](CHANGELOG_IOJS.md)
|
|
43
44
|
* [Archive](CHANGELOG_ARCHIVE.md)
|
|
44
45
|
|
|
46
|
+
<a id="18.9.1"></a>
|
|
47
|
+
|
|
48
|
+
## 2022-09-23, Version 18.9.1 (Current), @RafaelGSS
|
|
49
|
+
|
|
50
|
+
This is a security release.
|
|
51
|
+
|
|
52
|
+
### Notable changes
|
|
53
|
+
|
|
54
|
+
The following CVEs are fixed in this release:
|
|
55
|
+
|
|
56
|
+
* **[CVE-2022-32212](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212)**: DNS rebinding in --inspect on macOS (High)
|
|
57
|
+
* Insufficient fix for macOS devices on v18.5.0
|
|
58
|
+
* **[CVE-2022-32222](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32222)**: Node 18 reads openssl.cnf from /home/iojs/build/ upon startup on MacOS (Medium)
|
|
59
|
+
* **[CVE-2022-32213](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32213)**: HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding (Medium)
|
|
60
|
+
* Insufficient fix on v18.5.0
|
|
61
|
+
* **[CVE-2022-32215](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32215)**: HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)
|
|
62
|
+
* Insufficient fix on v18.5.0
|
|
63
|
+
* **[CVE-2022-35256](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35256)**: HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)
|
|
64
|
+
* **[CVE-2022-35255](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35255)**: Weak randomness in WebCrypto keygen
|
|
65
|
+
|
|
66
|
+
More detailed information on each of the vulnerabilities can be found in [September 22nd 2022 Security Releases](https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/) blog post.
|
|
67
|
+
|
|
68
|
+
#### llhttp updated to 6.0.10
|
|
69
|
+
|
|
70
|
+
`llhttp` is updated to 6.0.10 which includes fixes for the following vulnerabilities.
|
|
71
|
+
|
|
72
|
+
* **HTTP Request Smuggling - CVE-2022-32213 bypass via obs-fold mechanic (Medium)([CVE-2022-32213](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32213) )**: The `llhttp` parser in the `http` module does not correctly parse and validate Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
|
|
73
|
+
* **HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding (Medium)([CVE-2022-32215](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32215))**: The `llhttp` parser in the `http` module does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
|
|
74
|
+
* **HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium)([CVE-35256](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35256))**: The llhttp parser in the `http` does not correctly handle header fields that are not terminated with CLRF. This can lead to HTTP Request Smuggling (HRS).
|
|
75
|
+
|
|
76
|
+
### Commits
|
|
77
|
+
|
|
78
|
+
* \[[`0c2a5723be`](https://github.com/nodejs/node/commit/0c2a5723be)] - **crypto**: fix weak randomness in WebCrypto keygen (Ben Noordhuis) [nodejs-private/node-private#](https://github.com/nodejs-private/node-private/pull/346)
|
|
79
|
+
* \[[`ffb6f4d51d`](https://github.com/nodejs/node/commit/ffb6f4d51d)] - **deps**: MacOS - fix location of OpenSSL config file (Michael Dawson) [nodejs-private/node-private#345](https://github.com/nodejs-private/node-private/pull/345)
|
|
80
|
+
* \[[`01bffcdd93`](https://github.com/nodejs/node/commit/01bffcdd93)] - **http**: disable chunked encoding when OBS fold is used (Paolo Insogna) [nodejs-private/node-private#341](https://github.com/nodejs-private/node-private/pull/341)
|
|
81
|
+
* \[[`2c379d341d`](https://github.com/nodejs/node/commit/2c379d341d)] - **src**: fix IPv4 non routable validation (RafaelGSS) [nodejs-private/node-private#337](https://github.com/nodejs-private/node-private/pull/337)
|
|
82
|
+
|
|
45
83
|
<a id="18.9.0"></a>
|
|
46
84
|
|
|
47
85
|
## 2022-09-08, Version 18.9.0 (Current), @RafaelGSS
|
package/bin/node
CHANGED
|
Binary file
|