diff options
| author | Myles Borins <mylesborins@google.com> | 2018-03-28 01:54:40 -0400 |
|---|---|---|
| committer | Myles Borins <mylesborins@google.com> | 2018-03-28 12:18:57 -0400 |
| commit | ebe51d6492c3993020e1859b5269aa783fad0a4a (patch) | |
| tree | 58e7c19b02ffeb6b147c81006f9cc366daa6ad39 /CHANGELOG.md | |
| parent | 4de78219711dcfdc24290520b20dce1fff01e164 (diff) | |
| download | node-new-ebe51d6492c3993020e1859b5269aa783fad0a4a.tar.gz | |
2018-03-28, Version 4.9.0 'Argon' (Maintenance)
This is a security release. All Node.js users should consult the
security release summary at:
https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/
for details on patched vulnerabilities.
Fixes for the following CVEs are included in this release:
* CVE-2018-7158
* CVE-2018-7159
Notable Changes:
* Upgrade to OpenSSL 1.0.2o: Does not contain any security fixes that
are known to impact Node.js.
* **Fix for `'path'` module regular expression denial of service
(CVE-2018-7158)**: A regular expression used for parsing POSIX an
Windows paths could be used to cause a denial of service if an
attacker were able to have a specially crafted path string passed
through one of the impacted `'path'` module functions.
* **Reject spaces in HTTP `Content-Length` header values
(CVE-2018-7159)**: The Node.js HTTP parser allowed for spaces inside
`Content-Length` header values. Such values now lead to rejected
connections in the same way as non-numeric values.
* **Update root certificates**: 5 additional root certificates have
been added to the Node.js binary and 30 have been removed.
PR-URL: https://github.com/nodejs-private/node-private/pull/110
Diffstat (limited to 'CHANGELOG.md')
| -rw-r--r-- | CHANGELOG.md | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index 0c038e78cc..a1cb757ddb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -106,7 +106,8 @@ release. <a href="doc/changelogs/CHANGELOG_V6.md#6.0.0">6.0.0</a><br/> </td> <td valign="top"> -<b><a href="doc/changelogs/CHANGELOG_V4.md#4.8.7">4.8.7</a></b><br/> +<b><a href="doc/changelogs/CHANGELOG_V4.md#4.9.0">4.9.0</a></b><br/> +<a href="doc/changelogs/CHANGELOG_V4.md#4.8.7">4.8.7</a><br/> <a href="doc/changelogs/CHANGELOG_V4.md#4.8.6">4.8.6</a><br/> <a href="doc/changelogs/CHANGELOG_V4.md#4.8.5">4.8.5</a><br/> <a href="doc/changelogs/CHANGELOG_V4.md#4.8.4">4.8.4</a><br/> |