1berry/nodejs
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

2019-02-28, Version 10.15.2 'Dubnium' (LTS)

Browse Source 
This is a security release. All Node.js users should consult the security
release summary at:

  https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/

for details on patched vulnerabilities.

A fix for the following CVE is included in this release:

  * Node.js: Slowloris HTTP Denial of Service with keep-alive
    (CVE-2019-5737)

Notable Changes:

* http: Further prevention of "Slowloris" attacks on HTTP and HTTPS
  connections by consistently applying the receive timeout set by
  `server.headersTimeout` to connections in keep-alive mode. Reported by
  Marco Pracucci (https://voxnest.com). (CVE-2019-5737 / Matteo Collina)

PR-URL: https://github.com/nodejs-private/node-private/pull/164
This commit is contained in:
Rod Vagg 2019-02-28 16:10:16 +11:00
parent f1cefdca80
commit b974d0dd64
2 changed files with 24 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGELOG.md
View File

@ -42,7 +42,8 @@ release.
<a href="doc/changelogs/CHANGELOG_V11.md#11.0.0">11.0.0</a><br/>
</td>
<td valign="top">
<b><a href="doc/changelogs/CHANGELOG_V10.md#10.15.1">10.15.1</a></b><br/>
<b><a href="doc/changelogs/CHANGELOG_V10.md#10.15.2">10.15.2</a></b><br/>
<a href="doc/changelogs/CHANGELOG_V10.md#10.15.1">10.15.1</a><br/>
<a href="doc/changelogs/CHANGELOG_V10.md#10.15.0">10.15.0</a><br/>
<a href="doc/changelogs/CHANGELOG_V10.md#10.14.2">10.14.2</a><br/>
<a href="doc/changelogs/CHANGELOG_V10.md#10.14.1">10.14.1</a><br/>

22
doc/changelogs/CHANGELOG_V10.md
View File

@ -10,6 +10,7 @@
</tr>
<tr>
<td valign="top">
<a href="#10.15.2">10.15.2</a><br/>
<a href="#10.15.1">10.15.1</a><br/>
<a href="#10.15.0">10.15.0</a><br/>
<a href="#10.14.2">10.14.2</a><br/>
@ -50,6 +51,27 @@
* [io.js](CHANGELOG_IOJS.md)
* [Archive](CHANGELOG_ARCHIVE.md)
<a id="10.15.2"></a>
## 2019-02-28, Version 10.15.2 'Dubnium' (LTS), @rvagg
This is a security release. All Node.js users should consult the security release summary at:
https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/
for details on patched vulnerabilities.
A fix for the following CVE is included in this release:
* Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)
### Notable Changes
* **http**: Further prevention of "Slowloris" attacks on HTTP and HTTPS connections by consistently applying the receive timeout set by `server.headersTimeout` to connections in keep-alive mode. Reported by Marco Pracucci ([Voxnest](https://voxnest.com)). (CVE-2019-5737 / Matteo Collina)
### Commits
* [[`1a7302bd48`](https://github.com/nodejs/node/commit/1a7302bd48)] - **http**: prevent slowloris with keepalive connections (Matteo Collina) [nodejs-private/node-private#158](https://github.com/nodejs-private/node-private/pull/158)
<a id="10.15.1"></a>
## 2019-01-29, Version 10.15.1 'Dubnium' (LTS), @codebytere