Skip to content

Commit f19f5b3

Browse files
targostargos
committed
2020-06-02, Version 12.18.0 'Erbium' (LTS)
This is a security release. Notable changes: Vulnerabilities fixed: CVE-2020-8172: TLS session reuse can lead to host certificate verification bypass (High). CVE-2020-11080: HTTP/2 Large Settings Frame DoS (Low). CVE-2020-8174: `napi_get_value_string_*()` allows various kinds of memory corruption (High). PR-URL: nodejs-private/node-private#213
1 parent 0932309 commit f19f5b3

4 files changed

Lines changed: 36 additions & 10 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,8 @@ release.
2828
</tr>
2929
<tr>
3030
<td valign="top">
31-
<b><a href="doc/changelogs/CHANGELOG_V12.md#12.17.0">12.17.0</a></b><br/>
31+
<b><a href="doc/changelogs/CHANGELOG_V12.md#12.18.0">12.18.0</a></b><br/>
32+
<a href="doc/changelogs/CHANGELOG_V12.md#12.17.0">12.17.0</a><br/>
3233
<a href="doc/changelogs/CHANGELOG_V12.md#12.16.3">12.16.3</a><br/>
3334
<a href="doc/changelogs/CHANGELOG_V12.md#12.16.2">12.16.2</a><br/>
3435
<a href="doc/changelogs/CHANGELOG_V12.md#12.16.1">12.16.1</a><br/>

‎doc/api/http2.md‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1948,8 +1948,9 @@ error will be thrown.
19481948
<!-- YAML
19491949
added: v8.4.0
19501950
changes:
1951-
- version: REPLACEME
1952-
pr-url: https://github.com/nodejs-private/node-private/pull/204
1951+
- version:
1952+
- v12.18.0
1953+
pr-url: https://github.com/nodejs-private/node-private/pull/206
19531954
description: Added `maxSettings` option with a default of 32.
19541955
- version: v12.16.0
19551956
pr-url: https://github.com/nodejs/node/pull/30534
@@ -2083,8 +2084,9 @@ server.listen(80);
20832084
<!-- YAML
20842085
added: v8.4.0
20852086
changes:
2086-
- version: REPLACEME
2087-
pr-url: https://github.com/nodejs-private/node-private/pull/204
2087+
- version:
2088+
- v12.18.0
2089+
pr-url: https://github.com/nodejs-private/node-private/pull/206
20882090
description: Added `maxSettings` option with a default of 32.
20892091
- version: v12.16.0
20902092
pr-url: https://github.com/nodejs/node/pull/30534
@@ -2205,8 +2207,9 @@ server.listen(80);
22052207
<!-- YAML
22062208
added: v8.4.0
22072209
changes:
2208-
- version: REPLACEME
2209-
pr-url: https://github.com/nodejs-private/node-private/pull/204
2210+
- version:
2211+
- v12.18.0
2212+
pr-url: https://github.com/nodejs-private/node-private/pull/206
22102213
description: Added `maxSettings` option with a default of 32.
22112214
- version: v8.9.3
22122215
pr-url: https://github.com/nodejs/node/pull/17105

‎doc/changelogs/CHANGELOG_V12.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
</tr>
1212
<tr>
1313
<td valign="top">
14+
<a href="#12.18.0">12.18.0</a><br/>
1415
<a href="#12.17.0">12.17.0</a><br/>
1516
<a href="#12.16.3">12.16.3</a><br/>
1617
<a href="#12.16.2">12.16.2</a><br/>
@@ -58,6 +59,27 @@
5859
* [io.js](CHANGELOG_IOJS.md)
5960
* [Archive](CHANGELOG_ARCHIVE.md)
6061

62+
<a id="12.18.0"></a>
63+
## 2020-06-02, Version 12.18.0 'Erbium' (LTS), @targos
64+
65+
### Notable changes
66+
67+
This is a security release.
68+
69+
Vulnerabilities fixed:
70+
* **CVE-2020-8172**: TLS session reuse can lead to host certificate verification bypass (High).
71+
* **CVE-2020-11080**: HTTP/2 Large Settings Frame DoS (Low).
72+
* **CVE-2020-8174**: `napi_get_value_string_*()` allows various kinds of memory corruption (High).
73+
74+
### Commits
75+
76+
* [[`c6d0bdacc4`](https://github.com/nodejs/node/commit/c6d0bdacc4)] - **crypto**: update root certificates (AshCripps) [#33682](https://github.com/nodejs/node/pull/33682)
77+
* [[`916b2824d1`](https://github.com/nodejs/node/commit/916b2824d1)] - **(SEMVER-MINOR)** **deps**: update nghttp2 to 1.41.0 (James M Snell) [nodejs-private/node-private#206](https://github.com/nodejs-private/node-private/pull/206)
78+
* [[`d381426377`](https://github.com/nodejs/node/commit/d381426377)] - **(SEMVER-MINOR)** **http2**: implement support for max settings entries (James M Snell) [nodejs-private/node-private#206](https://github.com/nodejs-private/node-private/pull/206)
79+
* [[`7dd8982570`](https://github.com/nodejs/node/commit/7dd8982570)] - **napi**: fix memory corruption vulnerability (Tobias Nießen) [nodejs-private/node-private#195](https://github.com/nodejs-private/node-private/pull/195)
80+
* [[`0932309af2`](https://github.com/nodejs/node/commit/0932309af2)] - **tls**: emit `session` after verifying certificate (Fedor Indutny) [nodejs-private/node-private#200](https://github.com/nodejs-private/node-private/pull/200)
81+
* [[`c392d3923f`](https://github.com/nodejs/node/commit/c392d3923f)] - **tools**: update certdata.txt (AshCripps) [#33682](https://github.com/nodejs/node/pull/33682)
82+
6183
<a id="12.17.0"></a>
6284
## 2020-05-26, Version 12.17.0 'Erbium' (LTS), @targos
6385

‎src/node_version.h‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,13 @@
2323
#define SRC_NODE_VERSION_H_
2424

2525
#define NODE_MAJOR_VERSION 12
26-
#define NODE_MINOR_VERSION 17
27-
#define NODE_PATCH_VERSION 1
26+
#define NODE_MINOR_VERSION 18
27+
#define NODE_PATCH_VERSION 0
2828

2929
#define NODE_VERSION_IS_LTS 1
3030
#define NODE_VERSION_LTS_CODENAME "Erbium"
3131

32-
#define NODE_VERSION_IS_RELEASE 0
32+
#define NODE_VERSION_IS_RELEASE 1
3333

3434
#ifndef NODE_STRINGIFY
3535
#define NODE_STRINGIFY(n) NODE_STRINGIFY_HELPER(n)

0 commit comments

Comments
 (0)