From 657fb9a77ca36f729da484f55899dad7a13759b0 Mon Sep 17 00:00:00 2001 From: Danielle Adams Date: Mon, 11 Oct 2021 15:43:42 -0400 Subject: [PATCH] 2021-10-12, Version 14.18.1 'Fermium' (LTS) This is a security release. Notable Changes: * CVE-2021-22959: HTTP Request Smuggling due to spaced in headers (Medium) * The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). More details are available at: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22959 * CVE-2021-22960: HTTP Request Smuggling when parsing the body (Medium) * The parse ignores chunk extensions when parsing the body of chunked requests. requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. More details are available at: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22960 PR-URL: https://github.com/nodejs-private/node-private/pull/294 --- CHANGELOG.md | 3 ++- doc/changelogs/CHANGELOG_V14.md | 19 +++++++++++++++++++ src/node_version.h | 2 +- 3 files changed, 22 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index fd40fceec02a5e..f44881a6e14843 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -30,7 +30,8 @@ release. -14.18.0
+14.18.1
+14.18.0
14.17.6
14.17.5
14.17.4
diff --git a/doc/changelogs/CHANGELOG_V14.md b/doc/changelogs/CHANGELOG_V14.md index 3e7afb09d16933..95596eb9d484fb 100644 --- a/doc/changelogs/CHANGELOG_V14.md +++ b/doc/changelogs/CHANGELOG_V14.md @@ -11,6 +11,7 @@ +14.18.1
14.18.0
14.17.6
14.17.5
@@ -66,6 +67,24 @@ * [io.js](CHANGELOG_IOJS.md) * [Archive](CHANGELOG_ARCHIVE.md) + +## 2021-10-12, Version 14.18.1 'Fermium' (LTS), @danielleadams + +This is a security release. + +### Notable changes + +* **CVE-2021-22959**: HTTP Request Smuggling due to spaced in headers (Medium) + * The http parser accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS). More details will be available at [CVE-2021-22959](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22959) after publication. +* **CVE-2021-22960**: HTTP Request Smuggling when parsing the body (Medium) + * The parse ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions. More details will be available at [CVE-2021-22960](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22960) after publication. + +### Commits + +* [[`8c254ca7e4`](https://github.com/nodejs/node/commit/8c254ca7e4)] - **deps**: update llhttp to 2.1.4 (Fedor Indutny) [nodejs-private/node-private#285](https://github.com/nodejs-private/node-private/pull/285) +* [[`9b92ae2499`](https://github.com/nodejs/node/commit/9b92ae2499)] - **http**: add regression test for smuggling content length (Matteo Collina) [nodejs-private/node-private#285](https://github.com/nodejs-private/node-private/pull/285) +* [[`f467539719`](https://github.com/nodejs/node/commit/f467539719)] - **http**: add regression test for chunked smuggling (Matteo Collina) [nodejs-private/node-private#285](https://github.com/nodejs-private/node-private/pull/285) + ## 2021-09-28, Version 14.18.0 'Fermium' (LTS), @targos diff --git a/src/node_version.h b/src/node_version.h index d081f0c4f0b821..46f91e249d3ec0 100644 --- a/src/node_version.h +++ b/src/node_version.h @@ -29,7 +29,7 @@ #define NODE_VERSION_IS_LTS 1 #define NODE_VERSION_LTS_CODENAME "Fermium" -#define NODE_VERSION_IS_RELEASE 0 +#define NODE_VERSION_IS_RELEASE 1 #ifndef NODE_STRINGIFY #define NODE_STRINGIFY(n) NODE_STRINGIFY_HELPER(n)