Nodejs/node
1
0
Fork 0
mirror of https://github.com/nodejs/node.git synced 2024-11-21 10:59:27 +00:00
Code Issues Actions 25 Packages Projects Releases Wiki Activity

2020-06-02, Version 14.4.0 (Current)

Browse Source 
This is a security release.

Notable changes:

Vulnerabilities fixed:
CVE-2020-8172: TLS session reuse can lead to host certificate verification bypass (High).
CVE-2020-11080: HTTP/2 Large Settings Frame DoS (Low).
CVE-2020-8174: `napi_get_value_string_*()` allows various kinds of memory corruption (High).

PR-URL: https://github.com/nodejs-private/node-private/pull/212
This commit is contained in:
Michaël Zasso 2020-06-02 08:42:15 +02:00
parent 2e1b41a708
commit 64e33dc952
No known key found for this signature in database
GPG Key ID: 770F7A9A5AE15600
3 changed files with 30 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGELOG.md
View File

@ -31,7 +31,8 @@ release.
</tr>
<tr>
<td valign="top">
<b><a href="doc/changelogs/CHANGELOG_V14.md#14.3.0">14.3.0</a></b><br/>
<b><a href="doc/changelogs/CHANGELOG_V14.md#14.4.0">14.4.0</a></b><br/>
<a href="doc/changelogs/CHANGELOG_V14.md#14.3.0">14.3.0</a><br/>
<a href="doc/changelogs/CHANGELOG_V14.md#14.2.0">14.2.0</a><br/>
<a href="doc/changelogs/CHANGELOG_V14.md#14.1.0">14.1.0</a><br/>
<a href="doc/changelogs/CHANGELOG_V14.md#14.0.0">14.0.0</a><br/>

9
doc/api/http2.md
View File

@ -2001,7 +2001,8 @@ value only affects new connections to the server, not any existing connections.
<!-- YAML
added: v8.4.0
changes:
- version: REPLACEME
- version:
- v14.4.0
pr-url: https://github.com/nodejs-private/node-private/pull/204
description: Added `maxSettings` option with a default of 32.
- version:
@ -2137,7 +2138,8 @@ server.listen(80);
<!-- YAML
added: v8.4.0
changes:
- version: REPLACEME
- version:
- v14.4.0
pr-url: https://github.com/nodejs-private/node-private/pull/204
description: Added `maxSettings` option with a default of 32.
- version:
@ -2260,7 +2262,8 @@ server.listen(80);
<!-- YAML
added: v8.4.0
changes:
- version: REPLACEME
- version:
- v14.4.0
pr-url: https://github.com/nodejs-private/node-private/pull/204
description: Added `maxSettings` option with a default of 32.
- version: v13.0.0

22
doc/changelogs/CHANGELOG_V14.md
View File

@ -10,6 +10,7 @@
</tr>
<tr>
<td>
<a href="#14.4.0">14.4.0</a><br/>
<a href="#14.3.0">14.3.0</a><br/>
<a href="#14.2.0">14.2.0</a><br/>
<a href="#14.1.0">14.1.0</a><br/>
@ -34,6 +35,27 @@
* [io.js](CHANGELOG_IOJS.md)
* [Archive](CHANGELOG_ARCHIVE.md)
<a id="14.4.0"></a>
## 2020-06-02, Version 14.4.0 (Current), @targos
### Notable changes
This is a security release.
Vulnerabilities fixed:
* **CVE-2020-8172**: TLS session reuse can lead to host certificate verification bypass (High).
* **CVE-2020-11080**: HTTP/2 Large Settings Frame DoS (Low).
* **CVE-2020-8174**: `napi_get_value_string_*()` allows various kinds of memory corruption (High).
### Commits
* [[`07a4d5061f`](https://github.com/nodejs/node/commit/07a4d5061f)] - **crypto**: update root certificates (AshCripps) [#33682](https://github.com/nodejs/node/pull/33682)
* [[`0a7bf50fd4`](https://github.com/nodejs/node/commit/0a7bf50fd4)] - **(SEMVER-MINOR)** **deps**: update nghttp2 to 1.41.0 (James M Snell) [nodejs-private/node-private#204](https://github.com/nodejs-private/node-private/pull/204)
* [[`55e4c72af8`](https://github.com/nodejs/node/commit/55e4c72af8)] - **(SEMVER-MINOR)** **http2**: implement support for max settings entries (James M Snell) [nodejs-private/node-private#204](https://github.com/nodejs-private/node-private/pull/204)
* [[`290720d16a`](https://github.com/nodejs/node/commit/290720d16a)] - **napi**: fix memory corruption vulnerability (Tobias Nießen) [nodejs-private/node-private#195](https://github.com/nodejs-private/node-private/pull/195)
* [[`94571c1001`](https://github.com/nodejs/node/commit/94571c1001)] - **tls**: emit `session` after verifying certificate (Fedor Indutny) [nodejs-private/node-private#200](https://github.com/nodejs-private/node-private/pull/200)
* [[`1658cf9ee6`](https://github.com/nodejs/node/commit/1658cf9ee6)] - **tools**: update certdata.txt (AshCripps) [#33682](https://github.com/nodejs/node/pull/33682)
<a id="14.3.0"></a>
## 2020-05-19, Version 14.3.0 (Current), @codebytere