diff --git a/CHANGELOG.md b/CHANGELOG.md index b86e2c77b2e..9b05ba2a3f9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -64,7 +64,8 @@ release. 17.0.0
-16.17.0
+16.17.1
+16.17.0
16.16.0
16.15.1
16.15.0
diff --git a/doc/changelogs/CHANGELOG_V16.md b/doc/changelogs/CHANGELOG_V16.md index 7ee620eef21..bbf50145716 100644 --- a/doc/changelogs/CHANGELOG_V16.md +++ b/doc/changelogs/CHANGELOG_V16.md @@ -9,6 +9,7 @@ +16.17.1
16.17.0
16.16.0
16.15.1
@@ -64,6 +65,27 @@ * [io.js](CHANGELOG_IOJS.md) * [Archive](CHANGELOG_ARCHIVE.md) + + +## 2022-09-23, Version 16.17.1 'Gallium' (LTS), @ruyadorno + +### Notable changes + +The following CVEs are fixed in this release: + +* **[CVE-2022-32212](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212)**: DNS rebinding in --inspect on macOS (High) +* **[CVE-2022-32213](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32213)**: bypass via obs-fold mechanic (Medium) +* **[CVE-2022-35255](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35255)**: Weak randomness in WebCrypto keygen +* **[CVE-2022-35256](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35256)**: HTTP Request Smuggling - Incorrect Parsing of Header Fields (Medium) + +More detailed information on each of the vulnerabilities can be found in [September 22nd 2022 Security Releases](https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/) blog post. + +### Commits + +* \[[`a54283a638`](https://github.com/nodejs/node/commit/a54283a638)] - **crypto**: fix weak randomness in WebCrypto keygen (Ben Noordhuis) [nodejs-private/node-private#346](https://github.com/nodejs-private/node-private/pull/346) +* \[[`0713e21240`](https://github.com/nodejs/node/commit/0713e21240)] - **http**: disable chunked encoding when using OBS fold is used (Paolo Insogna) [nodejs-private/node-private#341](https://github.com/nodejs-private/node-private/pull/341) +* \[[`77fe2f32e4`](https://github.com/nodejs/node/commit/77fe2f32e4)] - **src**: fix IPv4 non routable validation (RafaelGSS) [nodejs-private/node-private#337](https://github.com/nodejs-private/node-private/pull/337) + ## 2022-08-16, Version 16.17.0 'Gallium' (LTS), @targos