Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
2019-02-28, Version 8.15.1 'Carbon' (LTS)
This is a security release. All Node.js users should consult the security release summary at: https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/ for details on patched vulnerabilities. Fixes for the following CVEs are included in this release: * Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737) * OpenSSL: 0-byte record padding oracle (CVE-2019-1559) Notable Changes: * deps: OpenSSL has been upgraded to 1.0.2r which contains a fix for CVE-2019-1559 (https://www.openssl.org/news/secadv/20190226.txt). Under certain circumstances, a TLS server can be forced to respond differently to a client if a zero-byte record is received with an invalid padding compared to a zero-byte record with an invalid MAC. This can be used as the basis of a padding oracle attack to decrypt data. * http: Further prevention of "Slowloris" attacks on HTTP and HTTPS connections by consistently applying the receive timeout set by `server.headersTimeout` to connections in keep-alive mode. Reported by Marco Pracucci (https://voxnest.com). (CVE-2019-5737 / Matteo Collina) PR-URL: nodejs-private/node-private#165
- Loading branch information