From 5166653a1a23d2568e76ad19943e7bb5aa006251 Mon Sep 17 00:00:00 2001 From: Rod Vagg Date: Wed, 28 Nov 2018 09:15:11 +1100 Subject: [PATCH 1/3] Working on v6.15.1 PR-URL: https://github.com/nodejs-private/node-private/pull/153 --- src/node_version.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/node_version.h b/src/node_version.h index ef7767d28bf..f474399fbf6 100644 --- a/src/node_version.h +++ b/src/node_version.h @@ -3,12 +3,12 @@ #define NODE_MAJOR_VERSION 6 #define NODE_MINOR_VERSION 15 -#define NODE_PATCH_VERSION 0 +#define NODE_PATCH_VERSION 1 #define NODE_VERSION_IS_LTS 1 #define NODE_VERSION_LTS_CODENAME "Boron" -#define NODE_VERSION_IS_RELEASE 1 +#define NODE_VERSION_IS_RELEASE 0 #ifndef NODE_STRINGIFY #define NODE_STRINGIFY(n) NODE_STRINGIFY_HELPER(n) From 5d9005c35963c3fefc93b607dff75c1471e819d7 Mon Sep 17 00:00:00 2001 From: Matteo Collina Date: Mon, 3 Dec 2018 10:53:24 +0100 Subject: [PATCH 2/3] http: fix backport of Slowloris headers The backport of https://github.com/nodejs/node/commit/618eebdd17 was not complete, and the starting time to parse the headers was not reset. PR-URL: https://github.com/nodejs/node/pull/24796 Fixes: https://github.com/nodejs/node/issues/24760 Reviewed-By: Rod Vagg Reviewed-By: Richard Lau Reviewed-By: Anna Henningsen --- lib/_http_server.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/lib/_http_server.js b/lib/_http_server.js index 54e080717a7..a224cc795fc 100644 --- a/lib/_http_server.js +++ b/lib/_http_server.js @@ -481,6 +481,9 @@ function connectionListener(socket) { function parserOnIncoming(req, shouldKeepAlive) { incoming.push(req); + // Set to zero to communicate that we have finished parsing. + socket.parser.parsingHeadersStart = 0; + // If the writable end isn't consuming, then stop reading // so that we don't become overwhelmed by a flood of // pipelined requests that may never be resolved. From cde64500277d7697743e772575738c8415c7d6ab Mon Sep 17 00:00:00 2001 From: Rod Vagg Date: Mon, 3 Dec 2018 23:14:18 +1100 Subject: [PATCH 3/3] 2018-12-03, Version 6.15.1 'Boron' (LTS) Notable Changes: This is a patch release to address a bad backport of the fix for "Slowloris HTTP Denial of Service" (CVE-2018-12122). Node.js 6.15.0 misapplies the headers timeout to an entire keep-alive HTTP session, resulting in prematurely disconnected sockets. PR-URL: https://github.com/nodejs/node/pull/24803 Refs: https://github.com/nodejs/node/pull/24796 Refs: https://github.com/nodejs/node/issues/24760 Reviewed-By: Anna Henningsen Reviewed-By: Richard Lau Reviewed-By: Matteo Collina --- CHANGELOG.md | 3 ++- doc/changelogs/CHANGELOG_V6.md | 12 ++++++++++++ src/node_version.h | 2 +- 3 files changed, 15 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a5eb8df1095..adac1878c31 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -26,7 +26,8 @@ release. -6.15.0
+6.15.1
+6.15.0
6.14.4
6.14.3
6.14.2
diff --git a/doc/changelogs/CHANGELOG_V6.md b/doc/changelogs/CHANGELOG_V6.md index 9e5ff731f27..aeaaff1d072 100644 --- a/doc/changelogs/CHANGELOG_V6.md +++ b/doc/changelogs/CHANGELOG_V6.md @@ -7,6 +7,7 @@ +6.15.1
6.15.0
6.14.4
6.14.3
@@ -66,6 +67,17 @@ [Node.js Long Term Support Plan](https://github.com/nodejs/LTS) and will be supported actively until April 2018 and maintained until April 2019. + +## 2018-12-03, Version 6.15.1 'Boron' (LTS), @rvagg + +### Notable Changes + +This is a patch release to address a bad backport of the fix for "Slowloris HTTP Denial of Service" (CVE-2018-12122). Node.js 6.15.0 misapplies the headers timeout to an entire keep-alive HTTP session, resulting in prematurely disconnected sockets. + +### Commits + +* [[`5d9005c359`](https://github.com/nodejs/node/commit/5d9005c359)] - **http**: fix backport of Slowloris headers (Matteo Collina) [#24796](https://github.com/nodejs/node/pull/24796) + ## 2018-11-27, Version 6.15.0 'Boron' (LTS), @rvagg diff --git a/src/node_version.h b/src/node_version.h index f474399fbf6..601cc3711a5 100644 --- a/src/node_version.h +++ b/src/node_version.h @@ -8,7 +8,7 @@ #define NODE_VERSION_IS_LTS 1 #define NODE_VERSION_LTS_CODENAME "Boron" -#define NODE_VERSION_IS_RELEASE 0 +#define NODE_VERSION_IS_RELEASE 1 #ifndef NODE_STRINGIFY #define NODE_STRINGIFY(n) NODE_STRINGIFY_HELPER(n)