|
| 1 | +# Created with YamlCreate.ps1 Dumplings Mod |
| 2 | +# yaml-language-server: $schema=https://aka.ms/winget-manifest.defaultLocale.1.10.0.schema.json |
| 3 | + |
| 4 | +PackageIdentifier: OpenJS.NodeJS.8 |
| 5 | +PackageVersion: 8.11.0 |
| 6 | +PackageLocale: en-US |
| 7 | +Publisher: Node.js Foundation |
| 8 | +PublisherUrl: https://openjsf.org/ |
| 9 | +PublisherSupportUrl: https://github.com/nodejs/node/blob/HEAD/.github/SUPPORT.md |
| 10 | +PrivacyUrl: https://privacy-policy.openjsf.org/ |
| 11 | +Author: OpenJS Foundation |
| 12 | +PackageName: Node.js 8 |
| 13 | +PackageUrl: https://nodejs.org/ |
| 14 | +License: MIT |
| 15 | +LicenseUrl: https://github.com/nodejs/node/blob/v8.11.0/LICENSE |
| 16 | +Copyright: Copyright Node.js contributors. All rights reserved. |
| 17 | +CopyrightUrl: https://trademark-policy.openjsf.org/ |
| 18 | +ShortDescription: Run JavaScript Everywhere |
| 19 | +Description: Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts. |
| 20 | +Moniker: nodejs-8 |
| 21 | +Tags: |
| 22 | +- coding |
| 23 | +- cross-platform |
| 24 | +- develop |
| 25 | +- development |
| 26 | +- environment |
| 27 | +- javascript |
| 28 | +- js |
| 29 | +- lts |
| 30 | +- node |
| 31 | +- npm |
| 32 | +- programming |
| 33 | +- runtime |
| 34 | +- v8 |
| 35 | +ReleaseNotes: |- |
| 36 | + This is a security release. All Node.js users should consult the security release summary at https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/ for details on patched vulnerabilities. |
| 37 | + Fixes for the following CVEs are included in this release: |
| 38 | + - CVE-2018-7158 |
| 39 | + - CVE-2018-7159 |
| 40 | + - CVE-2018-7160 |
| 41 | + Notable Changes |
| 42 | + - Upgrade to OpenSSL 1.0.2o: Does not contain any security fixes that are known to impact Node.js. |
| 43 | + - Fix for inspector DNS rebinding vulnerability (CVE-2018-7160): A malicious website could use a DNS rebinding attack to trick a web browser to bypass same-origin-policy checks and allow HTTP connections to localhost or to hosts on the local network, potentially to an open inspector port as a debugger, therefore gaining full code execution access. The inspector now only allows connections that have a browser Host value of localhost or localhost6. |
| 44 | + - Fix for 'path' module regular expression denial of service (CVE-2018-7158): A regular expression used for parsing POSIX paths could be used to cause a denial of service if an attacker were able to have a specially crafted path string passed through one of the impacted 'path' module functions. |
| 45 | + - Reject spaces in HTTP Content-Length header values (CVE-2018-7159): The Node.js HTTP parser allowed for spaces inside Content-Length header values. Such values now lead to rejected connections in the same way as non-numeric values. |
| 46 | + - Update root certificates: 5 additional root certificates have been added to the Node.js binary and 30 have been removed. |
| 47 | + Commits |
| 48 | + - [dc290562e9] - crypto: update root certificates (Ben Noordhuis) #19322 |
| 49 | + - [df92da3f3c] - deps: add -no_rand_screen to openssl s_client (Shigeki Ohtsu) nodejs/io.js#1836 |
| 50 | + - [259156ea40] - deps: fix asm build error of openssl in x86_win32 (Shigeki Ohtsu) iojs/io.js#1389 |
| 51 | + - [d559d0eb25] - deps: fix openssl assembly error on ia32 win32 (Fedor Indutny) iojs/io.js#1389 |
| 52 | + - [cf8e8bcad2] - deps: copy all openssl header files to include dir (Shigeki Ohtsu) #19638 |
| 53 | + - [987138e488] - deps: upgrade openssl sources to 1.0.2o (Shigeki Ohtsu) #19638 |
| 54 | + - [1b7f6d9072] - deps: reject interior blanks in Content-Length (Ben Noordhuis) nodejs-private/http-parser-private#1 |
| 55 | + - [86c9ec6c5c] - deps: upgrade http-parser to v2.8.0 (Ben Noordhuis) nodejs-private/http-parser-private#1 |
| 56 | + - [de0c84889b] - inspector: minor adjustments (Eugene Ostroukhov) |
| 57 | + - [b7690655ef] - inspector: check Host header (Ali Ijaz Sheikh) |
| 58 | + - [0641f2dbf9] - openssl: fix keypress requirement in apps on win32 (Shigeki Ohtsu) iojs/io.js#1389 |
| 59 | + - [6ee4228c1d] - src: drop CNNIC+StartCom certificate whitelisting (Ben Noordhuis) #19322 |
| 60 | + - [633e23a618] - tools: update certdata.txt (Ben Noordhuis) #19322 |
| 61 | +ReleaseNotesUrl: https://github.com/nodejs/node/releases/tag/v8.11.0 |
| 62 | +Documentations: |
| 63 | +- DocumentLabel: Learn |
| 64 | + DocumentUrl: https://nodejs.org/learn/ |
| 65 | +- DocumentLabel: Documentation |
| 66 | + DocumentUrl: https://nodejs.org/docs/v8.11.0/api/ |
| 67 | +- DocumentLabel: About |
| 68 | + DocumentUrl: https://nodejs.org/about/ |
| 69 | +ManifestType: defaultLocale |
| 70 | +ManifestVersion: 1.10.0 |
0 commit comments