V4.3.2 proposal #5526
V4.3.2 proposal #5526
Conversation
PR-URL: #5507 Reviewed-By: Fedor Indutny <[email protected]>
|
ci: https://ci.nodejs.org/job/node-test-pull-request/1809/ /cc @nodejs/lts edit: if everything goes well here it is my hope to have this release go out this afternoon followed by a new v4.4.0-rc which rolls in these changes. edit: seems like lots of infra failures on linux. Re-running CI job --> https://ci.nodejs.org/job/node-test-commit-linux/2495/ citgm looks a-ok! edit: linux job looks fine now. |
|
In the commit message:
would be clearer like:
|
MylesBorins
added
meta
MylesBorins
force-pushed
the
v4.3.2-proposal
branch
from
ac86e33 to
3494979
Compare
|
@evanlucas updated |
|
See Notable changes test at #5433 (comment), I've made it so it can stand alone and addresses the Node.js-specific items. |
|
Thanks @rvagg updated the notable changes |
MylesBorins
force-pushed
the
v4.3.2-proposal
branch
2 times, most recently
from
fae749b to
992e74f
Compare
This is a security release with only a single commit, an update to openssl due to a recent security advisory. You can read more about the security advisory on the Node.js website (https://nodejs.org/en/blog/vulnerability/openssl-march-2016/) Notable changes * openssl - this upgrade to openssl 1.0.2g. This fixes the security vulnerabilities that are references in this openssl announce (https://mta.openssl.org/pipermail/openssl-announce/2016-February/000063.html) PR-URL: #5526
|
Build job for release --> https://ci.nodejs.org/job/iojs+release/434/ |
This is a security release with only a single commit, an update to openssl due to a recent security advisory. You can read more about the security advisory on the Node.js website (https://nodejs.org/en/blog/vulnerability/openssl-march-2016/) Notable changes * openssl - this upgrade to openssl 1.0.2g. This fixes the security vulnerabilities that are references in this openssl announce (https://mta.openssl.org/pipermail/openssl-announce/2016-February/000063.html) PR-URL: #5526
MylesBorins
force-pushed
the
v4.3.2-proposal
branch
from
992e74f to
c23f608
Compare
|
release commit didn't update the notable changes, not sure it's a big deal but we should aim for consistency in future |
This is a security release with only a single commit, an update to openssl due to a recent security advisory. You can read more about the security advisory on the Node.js website https://nodejs.org/en/blog/vulnerability/openssl-march-2016/ * openssl: Upgrade from 1.0.2f to 1.0.2g (Ben Noordhuis) #5507 - Fix a double-free defect in parsing malformed DSA keys that may potentially be used for DoS or memory corruption attacks. It is likely to be very difficult to use this defect for a practical attack and is therefore considered low severity for Node.js users. More info is available at CVE-2016-0705 https://www.openssl.org/news/vulnerabilities.html#2016-0705. - Fix a defect that can cause memory corruption in certain very rare cases relating to the internal `BN_hex2bn()` and `BN_dec2bn()` functions. It is believed that Node.js is not invoking the code paths that use these functions so practical attacks via Node.js using this defect are _unlikely_ to be possible. More info is available at CVE-2016-0797 https://www.openssl.org/news/vulnerabilities.html#2016-0797. - Fix a defect that makes the _CacheBleed Atta https://ssrg.nicta.com.au/projects/TS/cachebleed/ _ possible. This defect enables attackers to execute side-channel attacks leading to the potential recovery of entire RSA private keys. It only affects the Intel Sandy Bridge (and possibly older) microarchitecture when using hyper-threading. Newer microarchitectures, including Haswell, are unaffected. More info is available at CVE-2016-0702 https://www.openssl.org/news/vulnerabilities.html#2016-0702. PR-URL: #5526
|
@thealphanerd I think this may have landed on master... |
|
At least, i'm curious why the commit message is "2016-03-02, Version 4.3.2 'Argon' (LTS)" |
|
I just cherry-picked the release commit to master. That is the process we have been doing for cherry-picking the changelogs You can see past examples of this in my commit history --> https://github.com/nodejs/node/commits/master?author=TheAlphaNerd |
|
@thealphanerd Sorry, my bad. I'd only noticed the v5 cherry-picks onto master in the past. not the v4. nm me :) |
2016-03-02, Version 4.3.2 'Argon' (LTS), @thealphanerd
This is a security release with only a single commit, an update to openssl due to a recent security advisory. You can read more about the security advisory on the Node.js website
Notable changes