* deps: upgrade OpenSSL source to 1.0.2r. Under certain
circumstances, a TLS server can be forced to respond differently
to a client if a zero-byte record is received with an
invalid padding compared to a zero-byte record with an
invalid MAC. This can be used as the basis of a padding
oracle attack to decrypt data.
(openssl_1_0_2q.patch - CVE-2019-1559, bsc#1127080)
* http: (http-keep-alive.patch)
+ Backport server.keepAliveTimeout to prevent keep-alive
HTTP and HTTPS connections remaining open and inactive for
an extended period of time, leading to a potential
Denial of Service (DoS).
(CVE-2019-5739, bsc#1127533)
+ Further prevention of "Slowloris" attacks on HTTP and HTTPS
connections by consistently applying the receive timeout set
by server.headersTimeout to connections in keep-alive mode.
(CVE-2019-5737, bsc#1127532)
- nodejs.keyring: update keyring to today's list as per
https://github.com/nodejs/node
OBS-URL: https://build.opensuse.org/package/show/devel:languages:nodejs/nodejs4?expand=0&rev=105
+ add maxHeaderSize property (max_header_size.patch)
(CVE-2018-12121.patch - CVE-2018-12121, bsc#1117626)
+ A timeout of 40 seconds now applies to servers receiving
HTTP headers. This value can be adjusted with
server.headersTimeout. Where headers are not completely
received within this period, the socket is destroyed on
the next received chunk. In conjunction with
server.setTimeout(), this aids in protecting against
excessive resource retention and possible Denial of Service.
(CVE-2018-12122.patch - CVE-2018-12122, bsc#1117627)
(CVE-2018-12116.patch - CVE-2018-12116, bsc#1117630)
(CVE-2018-12123.patch - CVE-2018-12123, bnc#1117629)
OBS-URL: https://build.opensuse.org/package/show/devel:languages:nodejs/nodejs4?expand=0&rev=101
* debugger: prevent the debugger from listening on 0.0.0.0.
It now defaults to 127.0.0.1.
CVE-2018-12120.patch - (CVE-2018-12120, bsc#1117625)
* http:
+ Two-byte characters are now strictly disallowed for the path
option in HTTP client requests. Paths containing characters
outside of the range \u0021 - \u00ff will now be rejected
with a TypeError. This behavior can be reverted if necessary
by supplying the --security-revert=CVE-2018-12116 command
line argument (this is not recommended).
CVE-2018-12116.patch - (CVE-2018-12116, bsc#1117630)
* util: Fix a bug that would allow a hostname being spoofed when
parsing URLs with url.parse() with the 'javascript:' protocol.
CVE-2018-12123.patch - (CVE-2018-12123, bnc#1117629)
OBS-URL: https://build.opensuse.org/package/show/devel:languages:nodejs/nodejs4?expand=0&rev=99
