diff options
author | Danielle Adams <adamzdanielle@gmail.com> | 2021-10-11 22:44:55 +0300 |
---|---|---|
committer | Danielle Adams <adamzdanielle@gmail.com> | 2021-10-11 22:44:55 +0300 |
commit | 360a294f1f19cb8ccc9505d44a2e9efff414a5c7 (patch) | |
tree | d314c259f51796ec305d7c249d5f0b53fdf51c81 | |
parent | d5d3a03246c7297aab97e6b79bc8d057114a4978 (diff) |
2021-10-12, Version 12.22.7 'Erbium' (LTS)v12.22.7
This is a security release.
Notable changes:
* CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium)
* The http parser accepts requests with a space (SP) right after the
header name before the colon. This can lead to HTTP Request Smuggling
(HRS). More details are available at:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22959
* CVE-2021-22960: HTTP Request Smuggling when parsing the body (Medium)
* The parse ignores chunk extensions when parsing the body of chunked
requests. This leads to HTTP Request Smuggling (HRS) under certain
conditions. More details are available at:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22960
PR-URL: https://github.com/nodejs-private/node-private/pull/295
-rw-r--r-- | CHANGELOG.md | 3 | ||||
-rw-r--r-- | doc/changelogs/CHANGELOG_V12.md | 19 | ||||
-rw-r--r-- | src/node_version.h | 2 |
3 files changed, 22 insertions, 2 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index 4c00a9bb635..7cb8c234c20 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -28,7 +28,8 @@ release. </tr> <tr> <td valign="top"> -<b><a href="doc/changelogs/CHANGELOG_V12.md#12.22.6">12.22.6</a></b><br/> +<b><a href="doc/changelogs/CHANGELOG_V12.md#12.22.7">12.22.7</a></b><br/> +<a href="doc/changelogs/CHANGELOG_V12.md#12.22.6">12.22.6</a><br/> <a href="doc/changelogs/CHANGELOG_V12.md#12.22.5">12.22.5</a><br/> <a href="doc/changelogs/CHANGELOG_V12.md#12.22.4">12.22.4</a><br/> <a href="doc/changelogs/CHANGELOG_V12.md#12.22.3">12.22.3</a><br/> diff --git a/doc/changelogs/CHANGELOG_V12.md b/doc/changelogs/CHANGELOG_V12.md index 1eaca3fb5d5..58153dce082 100644 --- a/doc/changelogs/CHANGELOG_V12.md +++ b/doc/changelogs/CHANGELOG_V12.md @@ -11,6 +11,7 @@ </tr> <tr> <td valign="top"> +<a href="#12.22.7">12.22.7</a><br/> <a href="#12.22.6">12.22.6</a><br/> <a href="#12.22.5">12.22.5</a><br/> <a href="#12.22.4">12.22.4</a><br/> @@ -76,6 +77,24 @@ * [io.js](CHANGELOG_IOJS.md) * [Archive](CHANGELOG_ARCHIVE.md) +<a id="12.22.7"></a> +## 2021-10-12, Version 12.22.7 'Erbium' (LTS), @danielleadams + +This is a security release. + +### Notable changes + +* **CVE-2021-22959**: HTTP Request Smuggling due to spaced in headers (Medium) + * The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). More details will be available at [CVE-2021-22959](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22959) after publication. +* **CVE-2021-22960**: HTTP Request Smuggling when parsing the body (Medium) + * The parse ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. More details will be available at [CVE-2021-22960](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22960) after publication. + +### Commits + +* [[`21a2e554e3`](https://github.com/nodejs/node/commit/21a2e554e3)] - **deps**: update llhttp to 2.1.4 (Fedor Indutny) [nodejs-private/node-private#286](https://github.com/nodejs-private/node-private/pull/286) +* [[`d5d3a03246`](https://github.com/nodejs/node/commit/d5d3a03246)] - **http**: add regression test for smuggling content length (Matteo Collina) [nodejs-private/node-private#286](https://github.com/nodejs-private/node-private/pull/286) +* [[`0858587f21`](https://github.com/nodejs/node/commit/0858587f21)] - **http**: add regression test for chunked smuggling (Matteo Collina) [nodejs-private/node-private#286](https://github.com/nodejs-private/node-private/pull/286) + <a id="12.22.6"></a> ## 2021-08-31, Version 12.22.6 'Erbium' (LTS), @MylesBorins diff --git a/src/node_version.h b/src/node_version.h index 68f839ee846..89368822e55 100644 --- a/src/node_version.h +++ b/src/node_version.h @@ -29,7 +29,7 @@ #define NODE_VERSION_IS_LTS 1 #define NODE_VERSION_LTS_CODENAME "Erbium" -#define NODE_VERSION_IS_RELEASE 0 +#define NODE_VERSION_IS_RELEASE 1 #ifndef NODE_STRINGIFY #define NODE_STRINGIFY(n) NODE_STRINGIFY_HELPER(n) |