blog: aug 2019 security post-release announcement #2412
Conversation
|
It looks like some of the fixes are revertible (via |
(Also it looks like the flag is |
|
In these cases, I would rather not doc the sec reverts. They are there if anyone reports problems, but there weren't any concerns raised about the limits during PR review, they seem pretty generous and unlikely to be hit by normal apps. The inconsistency is not good. I think it was a typo introduced in https://github.com/addaleax/node/blob/be4a3b658a692d390f4fa9a187189c2ee993de1c/src/node_options.cc#L137 but probably not noticed because there were no revertible CVEs at the time. I don't think this should be fixed now, but maybe it is worth fixing on master for next time, if there is one? EDIT or perhaps it was intentional because the argument is an array? Not sure |
It was called --security-revert prior to 12.x, but changed in nodejs#22490. See: nodejs/nodejs.org#2412 (comment)
sam-github
force-pushed
the
19-08-sec-announce-post
branch
from
8b1c0cd
to
caaccec
Compare
It was called --security-revert prior to 12.x, but changed in #22490. See: nodejs/nodejs.org#2412 (comment) PR-URL: #29153 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Richard Lau <riclau@uk.ibm.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
It was called --security-revert prior to 12.x, but changed in #22490. See: nodejs/nodejs.org#2412 (comment) PR-URL: #29153 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Richard Lau <riclau@uk.ibm.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
Waiting on actual release to update timestamps and merge.