Node v0.10.42(LTS)

중요한 보안 릴리스입니다. 패치된 취약점에 관한 자세한 사항은 https://nodejs.org/en/blog/vulnerability/february-2016-security-releases/ 문서를 참고하세요.

주요 변경 사항

• http: 요청과 응답의 HTTP 헤더를 파싱할 때 요청 스머글링(smuggling)을 허용하거나(CVE-2016-2086) 응답 스플리팅(splitting)을 허용할 수 있는(CVE-2016-2216) 취약점이 수정됐습니다.
  이제 HTTP 헤더 파싱은 수용하는 문자를 제한하는 등 HTTP 스펙에 더 근접하게 조정되었습니다.
• http-parser: 1.0 버전에서 1.1 버전으로 업그레이드 했습니다.
• openssl: 1.0.1q 버전에서 1.0.1r 버전으로 업그레이드 했습니다.
  로그잼(Logjam) 공격을 방지하기 위해 TLS 클라이언트는 이제 파라미터가 1024비트보다 짧은 디피-헬만(Diffie-Hellman) 핸드셰이크를 거부합니다.
  이전에는 768비트까지 허용했습니다.
• src:
  • 특정 CVE 수정 사항을 선택적으로 되돌리는 --security-revert={cvenum} 명령행 플래그를 새롭게 도입했습니다.
  • --security-revert=CVE-2016-2216를 사용하면 CVE-2016-2216에 대한 수정 사항만 선택적으로 되돌릴 수 있습니다.
• build:
  • 0.10.42 버전부터 v0.10 빌드를 nodejs.org에서 xz 방식으로 압축된 tar 파일로 받을 수 있습니다.
  • 0.10.42 버전부터 v0.10 빌드에 해당하는 headers.tar.gz 파일을 nodejs.org에서 받을 수 있습니다. 이 파일을 사용하려면 node-gyp가 업데이트 되어야 합니다.

Commits

• [fdc332183e] - build: enable xz compressed tarballs where possible (Rod Vagg) https://github.com/nodejs/node/pull/4894
• [2d35b421b5] - deps: upgrade openssl sources to 1.0.1r (Shigeki Ohtsu) https://github.com/joyent/node/pull/25368
• [b31c0f3ea4] - deps: update http-parser to version 1.1 (James M Snell)
• [616ec1d6b0] - doc: clarify v0.10.41 openssl tls security impact (Rod Vagg) https://github.com/nodejs/node/pull/4153
• [ccb3c2377c] - http: strictly forbid invalid characters from headers (James M Snell)
• [f0af0d1f96] - src: avoid compiler warning in node_revert.cc (James M Snell)
• [df80e856c6] - src: add --security-revert command line flag (James M Snell)
• [ff58dcdd74] - tools: backport tools/install.py for headers (Richard Lau) https://github.com/nodejs/node/pull/4149

Windows 32-bit Installer: https://nodejs.org/dist/v0.10.42/node-v0.10.42-x86.msi

Windows 64-bit Installer: https://nodejs.org/dist/v0.10.42/x64/node-v0.10.42-x64.msi

Windows 32-bit Binary: https://nodejs.org/dist/v0.10.42/node.exe

Windows 64-bit Binary: https://nodejs.org/dist/v0.10.42/x64/node.exe

Mac OS X Universal Installer: https://nodejs.org/dist/v0.10.42/node-v0.10.42.pkg

Mac OS X 64-bit Binary: https://nodejs.org/dist/v0.10.42/node-v0.10.42-darwin-x64.tar.gz

Mac OS X 32-bit Binary: https://nodejs.org/dist/v0.10.42/node-v0.10.42-darwin-x86.tar.gz

Linux 32-bit Binary: https://nodejs.org/dist/v0.10.42/node-v0.10.42-linux-x86.tar.gz

Linux 64-bit Binary: https://nodejs.org/dist/v0.10.42/node-v0.10.42-linux-x64.tar.gz

SmartOS 32-bit Binary: https://nodejs.org/dist/v0.10.42/node-v0.10.42-sunos-x86.tar.gz

SmartOS 64-bit Binary: https://nodejs.org/dist/v0.10.42/node-v0.10.42-sunos-x64.tar.gz

Source Code: https://nodejs.org/dist/v0.10.42/node-v0.10.42.tar.gz

Other release files: https://nodejs.org/dist/v0.10.42/

Documentation: https://nodejs.org/docs/v0.10.42/api/

Shasums (GPG signing hash: SHA512, file hash: SHA256):

------BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

f0280e1f5c2568e5fda9f911ab8341b47914a21d30f854136299f510dc843816  node.exe
aed0f1ba2e58ceec1c06050f5f0d3eaad6630da2457d2bf1bb839e68f33fd7b0  node.exp
647609c5f6d885752d4374cf5fd67de72c896b43f888c4c37db9e6bd90633c50  node.lib
5b4b8f3f88ef533ebb7e9baecdd8e9ae8e8f53559320e77ea176a607be4d6858  node.pdb
356b4891c7060b6a68cf126837689807c30d43b709120b7fe6f167404612eb5a  node-v0.10.42-darwin-x64.tar.gz
cb794c57c5af5c06ef4b24bbbc423dd155867e2e01ee266f2da8e8c6aa5a33d3  node-v0.10.42-darwin-x64.tar.xz
ff61d24f80db9c5e6b007103751cdb8ac6cb3ff4180972ce1532bcb934847e0c  node-v0.10.42-darwin-x86.tar.gz
7c67fc5992f5b038bebfd7274b7d4197011470562737d46b9a006876692513d1  node-v0.10.42-darwin-x86.tar.xz
64d3e067cda5a675b44cee9875d1d72f8a29ed8bc19e476a16467336b832bfb3  node-v0.10.42-headers.tar.gz
5add37eb5d1f8f9ac061524dcbe8a87a17b9af19f9521f622fdc491cbf23dc32  node-v0.10.42-headers.tar.xz
a9b80fb22efc483b6aef282ebb0254b5d9b092ed8091521977af593069a81d53  node-v0.10.42-linux-x64.tar.gz
fd049d9f6a53497092568c81c77a85c3035911ff687eeece95e98b59fb543ec6  node-v0.10.42-linux-x64.tar.xz
5e528360a59314e2357184a8582d4d9dd1aa1c77687145bcf11b23e28f4ddd00  node-v0.10.42-linux-x86.tar.gz
f19ee1f785ea79d26187c8956e01a9362bbfbcb117d98d6bd6c6927a6d33906a  node-v0.10.42-linux-x86.tar.xz
600b983bf2802d29d175da885fb0b5905195b322dc0c2d45c510ef5de356fb66  node-v0.10.42.pkg
af15246d6889db4449dc46d5c4a549bb56b19481cbb801d30a09153ba71b88e1  node-v0.10.42-sunos-x64.tar.gz
5c15420d3fa7253f966cd29ea9d863d383ce05bca040c517c204a4abbc31d353  node-v0.10.42-sunos-x64.tar.xz
3333f1fd394bdde5aafa424d945b002b0d0876e17396f864af9c230c81aac08b  node-v0.10.42-sunos-x86.tar.gz
ae9ceedb9f80eda4d14fb29b3b862b29acf1a45666b34d53867aad80c05ef1b6  node-v0.10.42-sunos-x86.tar.xz
ebc1d53698f80c5a7b0b948e1108d7858f93d2d9ebf4541c12688d85704de105  node-v0.10.42.tar.gz
9b4cc1b5bc397d80dfe217625b04bb6212a3b5a8b1e0eb36000a30d7ae567b8a  node-v0.10.42.tar.xz
8fc72fa366d886cf41a80bcc0b78b37e3eb7a0eb78a9b80e8d328accec430150  node-v0.10.42-x86.msi
aefe011af949fa65cc89df70815f61abe3839841a069f85d4db6e9f55281bc6d  openssl-cli.exe
5d6869db2027e9a7a5a912d597a5772d2630515315119affb96d4ff91cacd9ed  openssl-cli.pdb
94d2835c74d6dd8c4e457a0f4c48be9fec48c15d185b6e2874794d1e9a19561f  x64/node.exe
d44a2acd401c0e2c388cf58607f90b275728b4e51650bd4516dce13de436c5e0  x64/node.exp
e1526036dc9acc16072f2da806a240b8b93fbe1e67368e10b0cfb96703f579d3  x64/node.lib
8ea78b09fa6014542b4eba8b8d03243effa2099425d41d66c7368b2a008abe06  x64/node.pdb
93609d2b7c127121150a3d65f123da0038d80ab870bf9844c05130bd9d2e7c71  x64/node-v0.10.42-x64.msi
4c4b7452a192e5b1b4596fa3375baa100a88bba7f81fb95c3c7f8641b818dbb3  x64/openssl-cli.exe
14fbf4dad971c6bfe64c46bd667613f8c0756c1d425bbef740b4fc213e30ea5a  x64/openssl-cli.pdb
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQEcBAEBCgAGBQJWuhvlAAoJEHNBsVwHCHesU7sH/jkm32kqNQA+qV4V4nO4W2XQ
m+RHBfLKoXzw26amM17I9UNtbjzEcwfmVj060qmdjZgofer/aFx+cP43SpiVPVmG
BD4jfp46wqsd4v4R+ZBwQV/GppTU/Xsfux4k5h7ied2oIoSJsUQhhBNdUk4GZj2/
iDPhIe/3ugBFJVnT+YGGmM/y7V9L8hz91K+jxmkGx0p2EQZchkYSXYWONXv9pVbz
VNhLmW7H7/afuIqBlsA327Q4ZdGAgqVqLqiPGkwzRQOob2+Wlb7nHsger7VnMh9S
XJf42E17IDB3zVD2HHPzaSti3BC+Jm18i0PwBqE3YksTnPPxry70GGmSm7OK6iY=
=NYfo
-----END PGP SIGNATURE-----