From 6558cfc0b075adfffe0d8c87bbe0d3e0b9326ab5 Mon Sep 17 00:00:00 2001 From: Beth Griggs Date: Tue, 4 Feb 2020 17:58:51 +0000 Subject: [PATCH] 2020-02-06, Version 13.8.0 (Current) This is a security release. Vulnerabilities fixed: * **CVE-2019-15606**: HTTP header values do not have trailing OWS trimmed. * **CVE-2019-15605**: HTTP request smuggling using malformed Transfer-Encoding header. * **CVE-2019-15604**: Remotely trigger an assertion on a TLS server with a malformed certificate string. Also, HTTP parsing is more strict to be more secure. Since this may cause problems in interoperability with some non-conformant HTTP implementations, it is possible to disable the strict checks with the `--insecure-http-parser` command line flag, or the `insecureHTTPParser` http option. Using the insecure HTTP parser should be avoided. PR-URL: https://github.com/nodejs-private/node-private/pull/196 --- CHANGELOG.md | 3 ++- doc/api/http.md | 4 ++-- doc/changelogs/CHANGELOG_V13.md | 28 ++++++++++++++++++++++++++++ src/node_version.h | 6 +++--- 4 files changed, 35 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c5c0fd7063cc34..de6e21fed04a4b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -30,7 +30,8 @@ release. -13.7.0
+13.8.0
+13.7.0
13.6.0
13.5.0
13.4.0
diff --git a/doc/api/http.md b/doc/api/http.md index dd90b54d3e11cb..beba834bd72d4f 100644 --- a/doc/api/http.md +++ b/doc/api/http.md @@ -2031,7 +2031,7 @@ Found'`.