lukechilds/node - node - Gitea: Git with a cup of tea

History

Evan Lucas aae1862385 2016-09-27, Version 6.7.0 (Current) This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/ for details on patched vulnerabilities. Notable Changes Semver Minor: * openssl: - Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 ("OCSP Status Request extension unbounded memory growth", high severity), CVE-2016-2183, CVE-2016-2178, and CVE-2016-6306. (Shigeki Ohtsu) https://github.com/nodejs/node/pull/8714 - Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) https://github.com/nodejs/node/pull/8786 - Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) https://github.com/nodejs/node-private/pull/73 * http: CVE-2016-5325 - Properly validate for allowable characters in the `reason` argument in `ServerResponse#writeHead()`. Fixes a possible response splitting attack vector. This introduces a new case where `throw` may occur when configuring HTTP responses, users should already be adopting try/catch here. Originally reported independently by Evan Lucas and Romain Gaucher. (Evan Lucas) https://github.com/nodejs/node-private/pull/60 Semver Patch: * buffer: Zero-fill excess bytes in new `Buffer` objects created with `Buffer.concat()` while providing a `totalLength` parameter that exceeds the total length of the original `Buffer` objects being concatenated. (Сковорода Никита Андреевич) https://github.com/nodejs/node-private/pull/64 * src: Fix regression where passing an empty password and/or salt to crypto.pbkdf2() would cause a fatal error (Rich Trott) https://github.com/nodejs/node/pull/8572 * tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of `.` in the wildcard string. Originally reported by Alexander Minozhenko and James Bunton (Atlassian). (Ben Noordhuis) https://github.com/nodejs/node-private/pull/75 v8: Fix regression where a regex on a frozen object was broken (Myles Borins) https://github.com/nodejs/node/pull/8673		9 years ago
..
api	doc: fix title level at tls.md	9 years ago
api_assets	doc: make the api doc print-friendly	9 years ago
changelogs	2016-09-27, Version 6.7.0 (Current)	9 years ago
ctc-meetings	tools: enable more remark-lint rules	9 years ago
guides	doc: enable no-file-name-articles remark-lint rule	9 years ago
topics	doc: enable no-file-name-articles remark-lint rule	9 years ago
tsc-meetings	tools: enable more remark-lint rules	9 years ago
full-white-stripe.jpg	build: update Node.js logo on Win installer	9 years ago
node.1	tty: set the handle to blocking mode	9 years ago
onboarding-extras.md	doc: enable first-heading-level remark-lint rule	9 years ago
onboarding.md	doc: update exercise portion of onboarding doc	9 years ago
osx_installer_logo.png	build: update Node.js logo on OSX installer	9 years ago
releases.md	doc: add commit formats for release blog posts	9 years ago
template.html	doctool: improve the title of pages in doc	9 years ago
thin-white-stripe.jpg	build: update Node.js logo on Win installer	9 years ago