v15.14.0 proposal #38084

MylesBorins · 2021-04-04T20:05:26Z

2021-04-06, Version 15.14.0 (Current), @MylesBorins

This is a security release.

Notable Changes

Vulnerabilties Fixed:

CVE-2021-3450: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (High)
- This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt
- Impacts:
  - All versions of the 15.x, 14.x, 12.x and 10.x releases lines
CVE-2021-3449: OpenSSL - NULL pointer deref in signature_algorithms processing (High)
- This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt
- Impacts:
  - All versions of the 15.x, 14.x, 12.x and 10.x releases lines
CVE-2020-7774: npm upgrade - Update y18n to fix Prototype-Pollution (High)
- This is a vulnerability in the y18n NPM module which may be exploited by prototype pollution. You can read more about it in GHSA-c4w7-xm78-47vh
- Impacts:
  - All versions of the 14.x, 12.x and 10.x releases lines

Other Notable Changes:

[b6f4901221] - (SEMVER-MINOR) fs: add support for async iterators to fsPromises.writeFile (HiroyukiYagihashi) #37490
[0709cbb7fe] - (SEMVER-MINOR) net: allow net.BlockList to use net.SocketAddress objects (James M Snell) #37917
[daa8a7bbcf] - (SEMVER-MINOR) net: add SocketAddress class (James M Snell) #37917
[a4169ce519] - (SEMVER-MINOR) net: make net.BlockList cloneable (James M Snell) #37917
[669b81c68b] - (SEMVER-MINOR) net,tls: add abort signal support to connect (Nitzan Uziely) #37735
[a1123f0a29] - (SEMVER-MINOR) readline: add AbortSignal support to interface (Nitzan Uziely) #37932

Commits

[ac69b95e47] - crypto: use correct webcrypto RSASSA-PKCS1-v1_5 algorithm name (Filip Skokan) #38029
[960c6be229] - crypto: add buffering to randomInt (Tobias Nießen) #35110
[4ef102d34e] - deps: update to [email protected] (Guy Bedford) #37992
[f0e77149a4] - deps: update archs files for OpenSSL-1.1.1k (Hassaan Pasha) #37916
[bbdcdad2c6] - deps: upgrade openssl sources to 1.1.1k+quic (Hassaan Pasha) #37916
[913ec56798] - deps: cjs-module-lexer: cherry-pick 22093e765f (pezhmanparsaee) #37895
[afc6ab2122] - doc: fix asyncLocalStorage.run() description (Darkripper214) #38023
[b40d35d649] - doc: document how to unref stdin when using readline.Interface (Anu Pasumarthy) #38019
[ce14080473] - doc: move psmarshall to collaborators emeriti (Peter Marshall) #37994
[ae70aa3c63] - doc: add distinctive color for code elements inside links (Antoine du Hamel) #37950
[8792c7c96b] - doc: add missing events.on metadata (Anna Henningsen) #37965
[a57dc06adf] - doc: improve Buffer's encoding documentation (Michaël Zasso) #37945
[f3fabb57cf] - doc: add missing cleanup step in OpenSSL upgrade (Tobias Nießen) #37927
[13c3924af8] - doc: add Windows-specific info to subprocess.kill() (João Lucas Lucchetta) #34867
[b6f4901221] - (SEMVER-MINOR) fs: add support for async iterators to fsPromises.writeFile (HiroyukiYagihashi) #37490
[ad7e34446c] - fs: fix chown abort (Darshan Sen) #38004
[d86aca9a77] - http: optimize debug function correctly (Michaël Zasso) #37966
[062541aae5] - http2: add specific error code for custom frames (Anna Henningsen) #37936
[8525231902] - lib: change wording in lib/domain.js comment (Akhil Marsonya) #37933
[21e399be4c] - lib: change wording in lib/internal/child_process comment (Akhil Marsonya) #37903
[3ab9619e56] - module: improve error message for invalid data URL (Antoine du Hamel) #37701
[0709cbb7fe] - (SEMVER-MINOR) net: allow net.BlockList to use net.SocketAddress objects (James M Snell) #37917
[daa8a7bbcf] - (SEMVER-MINOR) net: add SocketAddress class (James M Snell) #37917
[a4169ce519] - (SEMVER-MINOR) net: make net.BlockList cloneable (James M Snell) #37917
[669b81c68b] - (SEMVER-MINOR) net,tls: add abort signal support to connect (Nitzan Uziely) #37735
[a94cc27cbe] - path: refactor to use more primordials (Akhil Marsonya) #37893
[6cc1e15669] - readline: fix pre-aborted signal question handling (Nitzan Uziely) #37929
[a1123f0a29] - (SEMVER-MINOR) readline: add AbortSignal support to interface (Nitzan Uziely) #37932
[629e72e9f4] - src: fix typo in node_mutex (Tobias Nießen) #38011
[e61cc0bfb0] - src: fix typos in crypto comments (Tobias Nießen) #38024
[6ad0b6f0f5] - src: fix error handling for CryptoJob::ToResult (Tobias Nießen) #37076
[3175559bed] - test: add extra space in test failure output (Qingyu Deng) #37957
[0243376cfc] - test: use faster variant for rss (Pooja D P) #36839
[b02c352ad6] - test: fix test-tls-no-sslv3 for OpenSSL 3 (Richard Lau) #38027
[0db1a1eacf] - test: deflake test-fs-read-optional-params (Luigi Pinca) #37991
[4d50975cd7] - test: improve clarity of ALS-enable-disable.js (Darkripper214) #38008
[5e15ae05d0] - test: add DataView test case for v8 serdes (Rich Trott) #37955
[6d28a24f1c] - tools: update ESLint to 7.23.0 (Luigi Pinca) #37979
[51e7a33d54] - tools,doc: add "legacy" badge in the TOC (Antoine du Hamel) #37949
[570fbcef93] - url: forbid pipe in URL host (Darshan Sen) #37877

Original commit message: fix "the the" typo in README.md file Refs: nodejs/cjs-module-lexer@22093e7 PR-URL: #37895 Reviewed-By: Pooja D P <[email protected]> Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Harshitha K P <[email protected]>

This completes code coverage for v8.js. Refs: https://coverage.nodejs.org/coverage-290c158018ac0277/lib/v8.js.html#L240 PR-URL: #37955 Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: Michaël Zasso <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Luigi Pinca <[email protected]>

Fixes: #37862 PR-URL: #37877 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Rich Trott <[email protected]>

Clarify the inner workings of .kill on Windows, since termination signals are not available there. Fixes: #34858 PR-URL: #34867 Reviewed-By: Juan José Arboleda <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Rich Trott <[email protected]>

This updates all sources in deps/openssl/openssl by: $ git clone https://github.com/quictls/openssl $ cd openssl $ git checkout OpenSSL_1_1_1k+quic $ cd ../node/deps/openssl $ rm -rf openssl $ cp -R ../openssl openssl $ cd openssl && rm -rf .gitattributes .github/ .gitmodules .travis-apt-pin.preferences .travis-create-release.sh $ cd .. $ git add --all openssl $ git commit openssl PR-URL: #37916 Fixes: #37913 Reviewed-By: Tobias Nießen <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Matteo Collina <[email protected]>

After an OpenSSL source update, all the config files need to be regenerated and committed by: $ make -C deps/openssl/config $ git add deps/openssl/config/archs $ git add deps/openssl/openssl/include/crypto/bn_conf.h $ git add deps/openssl/openssl/include/crypto/dso_conf.h $ git add deps/openssl/openssl/include/openssl/opensslconf.h $ git commit PR-URL: #37916 Fixes: #37913 Reviewed-By: Tobias Nießen <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Matteo Collina <[email protected]>

Refs: #37916 PR-URL: #37927 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Jiawen Geng <[email protected]>

- Add a paragraph about case-insensitivity of encoding options. - Document "utf-8", "utf-16le" and "ucs-2" aliases. - Always use "utf8" in documentation for defaults and examples. PR-URL: #37945 Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Luigi Pinca <[email protected]>

Exporting a variable that will be mutated later doesn't work. Refs: #37937 PR-URL: #37966 Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Gerhard Stöbich <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Luigi Pinca <[email protected]>

PR-URL: #37893 Reviewed-By: Pooja D P <[email protected]> Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Darshan Sen <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Trivikram Kamat <[email protected]> Reviewed-By: Zijian Liu <[email protected]>

PR-URL: #37992 Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Jiawen Geng <[email protected]>

PR-URL: #37949 Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: James M Snell <[email protected]>

As suggested in #37849 (comment) improve the error presented when encountering a large number of invalid frames by giving this situation a specific error code (which we should have had from the beginning). PR-URL: #37936 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Yongsheng Zhang <[email protected]>

This was missed in the original PR. Refs: #34912 PR-URL: #37965 Reviewed-By: Michaël Zasso <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Darshan Sen <[email protected]> Reviewed-By: Anto Aravinth <[email protected]> Reviewed-By: James M Snell <[email protected]>

Add documentation for net.connect AbortSignal, and add the support to tls.connect as well PR-URL: #37735 Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: James M Snell <[email protected]>

Add abort signal support to Interface PR-URL: #37932 Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: James M Snell <[email protected]>

fix pre-aborted question handling PR-URL: #37929 Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: James M Snell <[email protected]>

Change the wording to make the language more Inclusive. PR-URL: #37903 Reviewed-By: Rich Trott <[email protected]> Reviewed-By: Pooja D P <[email protected]> Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Darshan Sen <[email protected]> Reviewed-By: James M Snell <[email protected]>

Change the wording to make the language more Inclusive. PR-URL: #37933 Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Rich Trott <[email protected]> Reviewed-By: Beth Griggs <[email protected]> Reviewed-By: Darshan Sen <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Ruben Bridgewater <[email protected]>

PR-URL: #37950 Reviewed-By: Pooja D P <[email protected]> Reviewed-By: Harshitha K P <[email protected]> Reviewed-By: Rich Trott <[email protected]>

Signed-off-by: James M Snell <[email protected]> PR-URL: #37917 Reviewed-By: Matteo Collina <[email protected]>

The last als.run() will reactivate the als, hence the test should test for getting the object, not undefined PR-URL: #38008 Reviewed-By: Gerhard Stöbich <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Colin Ihrig <[email protected]>

PR-URL: #38029 Refs: https://www.w3.org/TR/WebCryptoAPI/#rsassa-pkcs1 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Tobias Nießen <[email protected]>

PR-URL: #38024 Reviewed-By: Darshan Sen <[email protected]> Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Juan José Arboleda <[email protected]>

Fixes: #37391 PR-URL: #37490 Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: James M Snell <[email protected]>

PR-URL: #38011 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: Michael Dawson <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Darshan Sen <[email protected]> Reviewed-By: Rich Trott <[email protected]>

Vulnerabilities fixed: - **CVE-2021-3450**: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (High) - **CVE-2021-3449**: OpenSSL - NULL pointer deref in signature_algorithms processing (High) - **CVE-2020-7774**: npm upgrade - Update y18n to fix Prototype-Pollution (High) Other Notable changes: fs: * (SEMVER-MINOR) add support for async iterators to `fsPromises.writeFile` (HiroyukiYagihashi) #37490 net: * (SEMVER-MINOR) allow net.BlockList to use net.SocketAddress objects (James M Snell) #37917 * (SEMVER-MINOR) add SocketAddress class (James M Snell) #37917 * (SEMVER-MINOR) make net.BlockList cloneable (James M Snell) #37917 net,tls: * (SEMVER-MINOR) add abort signal support to connect (Nitzan Uziely) #37735 readline: * (SEMVER-MINOR) add AbortSignal support to interface (Nitzan Uziely) #37932 PR-URL: #38084

MylesBorins · 2021-04-05T17:11:59Z

updated with vulnerability notes

@Trott I've removed de67952 and it can be brought back in the next release with the perf fix.

nodejs-github-bot · 2021-04-05T17:12:27Z

CI: https://ci.nodejs.org/job/node-test-pull-request/37166/ ✅
CITGM: https://ci.nodejs.org/view/Node.js-citgm/job/citgm-smoker/2668/
CITGM nobuild v15: https://ci.nodejs.org/view/Node.js-citgm/job/citgm-smoker-nobuild/1072/

bricss · 2021-04-06T11:11:13Z

Looks like #37747 ready to be pulled back in together with #38064 😀

Notable Changes: This is a security release. Vulnerabilities fixed: - **CVE-2021-3450**: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (High) - **CVE-2021-3449**: OpenSSL - NULL pointer deref in signature_algorithms processing (High) - **CVE-2020-7774**: npm upgrade - Update y18n to fix Prototype-Pollution (High) Other Notable changes: fs: * (SEMVER-MINOR) add support for async iterators to `fsPromises.writeFile` (HiroyukiYagihashi) #37490 net: * (SEMVER-MINOR) allow net.BlockList to use net.SocketAddress objects (James M Snell) #37917 * (SEMVER-MINOR) add SocketAddress class (James M Snell) #37917 * (SEMVER-MINOR) make net.BlockList cloneable (James M Snell) #37917 net,tls: * (SEMVER-MINOR) add abort signal support to connect (Nitzan Uziely) #37735 readline: * (SEMVER-MINOR) add AbortSignal support to interface (Nitzan Uziely) #37932 PR-URL: #38084

MylesBorins · 2021-04-06T13:29:48Z

@bricss I unfortunately don't have time to add them back and re run all the testing. it will have to wait for the next release

PR-URL: #38084

Notable Changes: This is a security release. Vulnerabilities fixed: - **CVE-2021-3450**: OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (High) - **CVE-2021-3449**: OpenSSL - NULL pointer deref in signature_algorithms processing (High) - **CVE-2020-7774**: npm upgrade - Update y18n to fix Prototype-Pollution (High) Other Notable changes: fs: * (SEMVER-MINOR) add support for async iterators to `fsPromises.writeFile` (HiroyukiYagihashi) #37490 net: * (SEMVER-MINOR) allow net.BlockList to use net.SocketAddress objects (James M Snell) #37917 * (SEMVER-MINOR) add SocketAddress class (James M Snell) #37917 * (SEMVER-MINOR) make net.BlockList cloneable (James M Snell) #37917 net,tls: * (SEMVER-MINOR) add abort signal support to connect (Nitzan Uziely) #37735 readline: * (SEMVER-MINOR) add AbortSignal support to interface (Nitzan Uziely) #37932 PR-URL: #38084

Refs: nodejs/node#38084

Add links for Windows 64-bit Installer and Source Code. Refs: nodejs/node#38084

peZhmanParsaee and others added 24 commits April 4, 2021 15:22

url: forbid pipe in URL host

570fbce

Fixes: #37862 PR-URL: #37877 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Rich Trott <[email protected]>

doc: add missing cleanup step in OpenSSL upgrade

f3fabb5

Refs: #37916 PR-URL: #37927 Reviewed-By: Richard Lau <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: Jiawen Geng <[email protected]>

deps: update to [email protected]

4ef102d

PR-URL: #37992 Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Jiawen Geng <[email protected]>

tools,doc: add "legacy" badge in the TOC

51e7a33

PR-URL: #37949 Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: James M Snell <[email protected]>

net,tls: add abort signal support to connect

669b81c

Add documentation for net.connect AbortSignal, and add the support to tls.connect as well PR-URL: #37735 Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: James M Snell <[email protected]>

readline: add AbortSignal support to interface

a1123f0

Add abort signal support to Interface PR-URL: #37932 Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: James M Snell <[email protected]>

readline: fix pre-aborted signal question handling

6cc1e15

fix pre-aborted question handling PR-URL: #37929 Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: James M Snell <[email protected]>

doc: add distinctive color for code elements inside links

ae70aa3

PR-URL: #37950 Reviewed-By: Pooja D P <[email protected]> Reviewed-By: Harshitha K P <[email protected]> Reviewed-By: Rich Trott <[email protected]>

net: make net.BlockList cloneable

a4169ce

Signed-off-by: James M Snell <[email protected]> PR-URL: #37917 Reviewed-By: Matteo Collina <[email protected]>

net: add SocketAddress class

daa8a7b

Signed-off-by: James M Snell <[email protected]> PR-URL: #37917 Reviewed-By: Matteo Collina <[email protected]>

net: allow net.BlockList to use net.SocketAddress objects

0709cbb

Signed-off-by: James M Snell <[email protected]> PR-URL: #37917 Reviewed-By: Matteo Collina <[email protected]>

nodejs-github-bot added doc Issues and PRs related to the documentations. meta Issues and PRs related to the general management of the project. needs-ci PRs that need a full CI run. openssl Issues and PRs related to the OpenSSL dependency. v15.x labels Apr 4, 2021

MylesBorins changed the title ~~V15.14.0 proposal~~ v15.14.0 proposal Apr 4, 2021

panva and others added 4 commits April 5, 2021 12:57

crypto: use correct webcrypto RSASSA-PKCS1-v1_5 algorithm name

ac69b95

PR-URL: #38029 Refs: https://www.w3.org/TR/WebCryptoAPI/#rsassa-pkcs1 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Tobias Nießen <[email protected]>

src: fix typos in crypto comments

e61cc0b

PR-URL: #38024 Reviewed-By: Darshan Sen <[email protected]> Reviewed-By: Filip Skokan <[email protected]> Reviewed-By: Colin Ihrig <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Juan José Arboleda <[email protected]>

fs: add support for async iterators to fsPromises.writeFile

b6f4901

Fixes: #37391 PR-URL: #37490 Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: James M Snell <[email protected]>

MylesBorins force-pushed the v15.14.0-proposal branch from 28cf81b to 02160fd Compare April 5, 2021 17:11

MylesBorins force-pushed the v15.14.0-proposal branch from 02160fd to 7f4f37c Compare April 6, 2021 13:26

MylesBorins force-pushed the v15.14.0-proposal branch from 7f4f37c to 1a34e9c Compare April 6, 2021 13:28

MylesBorins merged commit 1a34e9c into v15.x Apr 6, 2021

MylesBorins added a commit that referenced this pull request Apr 6, 2021

Working on v15.14.1

236f958

PR-URL: #38084

MylesBorins deleted the v15.14.0-proposal branch April 6, 2021 20:11

MylesBorins added a commit to nodejs/nodejs.org that referenced this pull request Apr 6, 2021

blog: v15.14.0

0b8be3e

Refs: nodejs/node#38084

MylesBorins mentioned this pull request Apr 6, 2021

blog: v15.14.0 nodejs/nodejs.org#3793

Merged

MylesBorins added a commit to nodejs/nodejs.org that referenced this pull request Apr 6, 2021

blog: v15.14.0 (#3793)

55f43c6

Refs: nodejs/node#38084

tniessen mentioned this pull request Apr 8, 2021

doc: add quictls/openssl info in OpenSSL strategy nodejs/TSC#1010

Closed

targos added the release Issues and PRs related to Node.js releases. label Apr 11, 2021

richardlau added a commit to richardlau/nodejs.org that referenced this pull request Apr 12, 2021

blog: update v15.14.0 release post

fcd38d3

Add links for Windows 64-bit Installer and Source Code. Refs: nodejs/node#38084

richardlau mentioned this pull request Apr 12, 2021

blog: update v15.14.0 release post nodejs/nodejs.org#3800

Merged

richardlau added a commit to nodejs/nodejs.org that referenced this pull request Apr 12, 2021

blog: update v15.14.0 release post (#3800)

d2042c8

Add links for Windows 64-bit Installer and Source Code. Refs: nodejs/node#38084

targos removed doc Issues and PRs related to the documentations. needs-ci PRs that need a full CI run. openssl Issues and PRs related to the OpenSSL dependency. meta Issues and PRs related to the general management of the project. labels Jun 6, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

v15.14.0 proposal #38084

v15.14.0 proposal #38084

MylesBorins commented Apr 4, 2021 •

edited

Loading

MylesBorins commented Apr 5, 2021

nodejs-github-bot commented Apr 5, 2021 •

edited by MylesBorins

Loading

bricss commented Apr 6, 2021

MylesBorins commented Apr 6, 2021

v15.14.0 proposal #38084

v15.14.0 proposal #38084

Conversation

MylesBorins commented Apr 4, 2021 • edited Loading

2021-04-06, Version 15.14.0 (Current), @MylesBorins

Notable Changes

Commits

MylesBorins commented Apr 5, 2021

nodejs-github-bot commented Apr 5, 2021 • edited by MylesBorins Loading

bricss commented Apr 6, 2021

MylesBorins commented Apr 6, 2021

MylesBorins commented Apr 4, 2021 •

edited

Loading

nodejs-github-bot commented Apr 5, 2021 •

edited by MylesBorins

Loading