Node.js v6.7.0 (Current) 发布,多个重要更新

来源:开源中国社区 作者:王练
  

 

Node.js v6.7.0 (Current) 发布了,Node.js 是一套用来编写高性能网络服务器的 JavaScript 工具包,本次更新如下:

Semver Minor:

  • openssl:

    • Upgrade to 1.0.2i, fixes a number of defects impacting Node.js: CVE-2016-6304 ("OCSP Status Request extension unbounded memory growth", high severity), CVE-2016-2183, CVE-2016-2178 and CVE-2016-6306. (Shigeki Ohtsu) #8714

    • Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in a crash when using CRLs, CVE-2016-7052. (Shigeki Ohtsu) #8786

    • Remove support for loading dynamic third-party engine modules. An attacker may be able to hide malicious code to be inserted into Node.js at runtime by masquerading as one of the dynamic engine modules. Originally reported by Ahmed Zaki (Skype). (Ben Noordhuis) nodejs/node-private#73

  • http: CVE-2016-5325 - Properly validate for allowable characters in the reason argument inServerResponse#writeHead(). Fixes a possible response splitting attack vector. This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here. Originally reported independently by Evan Lucas and Romain Gaucher. (Evan Lucas) nodejs/node-private#60

Semver Patch:

  • buffer: Zero-fill excess bytes in new Buffer objects created with Buffer.concat() while providing atotalLength parameter that exceeds the total length of the original Buffer objects being concatenated. (Сковорода Никита Андреевич) nodejs/node-private#64

  • src: Fix regression where passing an empty password and/or salt to crypto.pbkdf2() would cause a fatal error (Rich Trott) #8572

  • tls: CVE-2016-7099 - Fix invalid wildcard certificate validation check whereby a TLS server may be able to serve an invalid wildcard certificate for its hostname due to improper validation of *. in the wildcard string. Originally reported by Alexander Minozhenko and James Bunton (Atlassian). (Ben Noordhuis) nodejs/node-private#75

  • v8: Fix regression where a regex on a frozen object was broken (Myles Borins) #8673

Commits

下载地址:

 


时间:2016-09-28 21:23 来源:开源中国社区 作者:王练 原文链接

好文,顶一下
(0)
0%
文章真差,踩一下
(0)
0%
------分隔线----------------------------


把开源带在你的身边-精美linux小纪念品
无觅相关文章插件,快速提升流量