diff options
author | Danielle Adams <adamzdanielle@gmail.com> | 2021-10-11 22:43:42 +0300 |
---|---|---|
committer | Danielle Adams <adamzdanielle@gmail.com> | 2021-10-11 22:43:42 +0300 |
commit | 657fb9a77ca36f729da484f55899dad7a13759b0 (patch) | |
tree | a36a0de826000eab7e7608022cf1707ecab1f8a0 | |
parent | 9b92ae2499922c0de254544b210ee0e40c9592f8 (diff) |
2021-10-12, Version 14.18.1 'Fermium' (LTS)v14.18.1
This is a security release.
Notable Changes:
* CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium)
* The http parser accepts requests with a space (SP) right after the
header name before the colon. This can lead to HTTP Request Smuggling
(HRS). More details are available at:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22959
* CVE-2021-22960: HTTP Request Smuggling when parsing the body (Medium)
* The parse ignores chunk extensions when parsing the body of chunked requests.
requests. This leads to HTTP Request Smuggling (HRS) under certain conditions.
More details are available at:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22960
PR-URL: https://github.com/nodejs-private/node-private/pull/294
-rw-r--r-- | CHANGELOG.md | 3 | ||||
-rw-r--r-- | doc/changelogs/CHANGELOG_V14.md | 19 | ||||
-rw-r--r-- | src/node_version.h | 2 |
3 files changed, 22 insertions, 2 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index fd40fceec02..f44881a6e14 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -30,7 +30,8 @@ release. </tr> <tr> <td valign="top"> -<b><a href="doc/changelogs/CHANGELOG_V14.md#14.18.0">14.18.0</a></b><br/> +<b><a href="doc/changelogs/CHANGELOG_V14.md#14.18.1">14.18.1</a></b><br/> +<a href="doc/changelogs/CHANGELOG_V14.md#14.18.0">14.18.0</a><br/> <a href="doc/changelogs/CHANGELOG_V14.md#14.17.6">14.17.6</a><br/> <a href="doc/changelogs/CHANGELOG_V14.md#14.17.5">14.17.5</a><br/> <a href="doc/changelogs/CHANGELOG_V14.md#14.17.4">14.17.4</a><br/> diff --git a/doc/changelogs/CHANGELOG_V14.md b/doc/changelogs/CHANGELOG_V14.md index 3e7afb09d16..95596eb9d48 100644 --- a/doc/changelogs/CHANGELOG_V14.md +++ b/doc/changelogs/CHANGELOG_V14.md @@ -11,6 +11,7 @@ </tr> <tr> <td valign="top"> +<a href="#14.18.1">14.18.1</a><br/> <a href="#14.18.0">14.18.0</a><br/> <a href="#14.17.6">14.17.6</a><br/> <a href="#14.17.5">14.17.5</a><br/> @@ -66,6 +67,24 @@ * [io.js](CHANGELOG_IOJS.md) * [Archive](CHANGELOG_ARCHIVE.md) +<a id="14.18.1"></a> +## 2021-10-12, Version 14.18.1 'Fermium' (LTS), @danielleadams + +This is a security release. + +### Notable changes + +* **CVE-2021-22959**: HTTP Request Smuggling due to spaced in headers (Medium) + * The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). More details will be available at [CVE-2021-22959](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22959) after publication. +* **CVE-2021-22960**: HTTP Request Smuggling when parsing the body (Medium) + * The parse ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. More details will be available at [CVE-2021-22960](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22960) after publication. + +### Commits + +* [[`8c254ca7e4`](https://github.com/nodejs/node/commit/8c254ca7e4)] - **deps**: update llhttp to 2.1.4 (Fedor Indutny) [nodejs-private/node-private#285](https://github.com/nodejs-private/node-private/pull/285) +* [[`9b92ae2499`](https://github.com/nodejs/node/commit/9b92ae2499)] - **http**: add regression test for smuggling content length (Matteo Collina) [nodejs-private/node-private#285](https://github.com/nodejs-private/node-private/pull/285) +* [[`f467539719`](https://github.com/nodejs/node/commit/f467539719)] - **http**: add regression test for chunked smuggling (Matteo Collina) [nodejs-private/node-private#285](https://github.com/nodejs-private/node-private/pull/285) + <a id="14.18.0"></a> ## 2021-09-28, Version 14.18.0 'Fermium' (LTS), @targos diff --git a/src/node_version.h b/src/node_version.h index d081f0c4f0b..46f91e249d3 100644 --- a/src/node_version.h +++ b/src/node_version.h @@ -29,7 +29,7 @@ #define NODE_VERSION_IS_LTS 1 #define NODE_VERSION_LTS_CODENAME "Fermium" -#define NODE_VERSION_IS_RELEASE 0 +#define NODE_VERSION_IS_RELEASE 1 #ifndef NODE_STRINGIFY #define NODE_STRINGIFY(n) NODE_STRINGIFY_HELPER(n) |