2020-06-02, Version 12.18.0 'Erbium' (LTS)

This is a security release. Notable changes: Vulnerabilities fixed: CVE-2020-8172: TLS session reuse can lead to host certificate verification bypass (High). CVE-2020-11080: HTTP/2 Large Settings Frame DoS (Low). CVE-2020-8174: `napi_get_value_string_*()` allows various kinds of memory corruption (High). PR-URL: nodejs-private/node-private#213
nodejs · Jun 2, 2020 · f19f5b3 · f19f5b3
1 parent 0932309
commit f19f5b3
Show file tree

Hide file tree

Showing 4 changed files with 36 additions and 10 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -28,7 +28,8 @@ release.
 </tr>
 <tr>
     <td valign="top">
-<b><a href="doc/changelogs/CHANGELOG_V12.md#12.17.0">12.17.0</a></b><br/>
+<b><a href="doc/changelogs/CHANGELOG_V12.md#12.18.0">12.18.0</a></b><br/>
+<a href="doc/changelogs/CHANGELOG_V12.md#12.17.0">12.17.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V12.md#12.16.3">12.16.3</a><br/>
 <a href="doc/changelogs/CHANGELOG_V12.md#12.16.2">12.16.2</a><br/>
 <a href="doc/changelogs/CHANGELOG_V12.md#12.16.1">12.16.1</a><br/>

diff --git a/doc/api/http2.md b/doc/api/http2.md
@@ -1948,8 +1948,9 @@ error will be thrown.
 <!-- YAML
 added: v8.4.0
 changes:
-  - version: REPLACEME
-    pr-url: https://github.com/nodejs-private/node-private/pull/204
+  - version:
+     - v12.18.0
+    pr-url: https://github.com/nodejs-private/node-private/pull/206
     description: Added `maxSettings` option with a default of 32.
   - version: v12.16.0
     pr-url: https://github.com/nodejs/node/pull/30534
@@ -2083,8 +2084,9 @@ server.listen(80);
 <!-- YAML
 added: v8.4.0
 changes:
-  - version: REPLACEME
-    pr-url: https://github.com/nodejs-private/node-private/pull/204
+  - version:
+     - v12.18.0
+    pr-url: https://github.com/nodejs-private/node-private/pull/206
     description: Added `maxSettings` option with a default of 32.
   - version: v12.16.0
     pr-url: https://github.com/nodejs/node/pull/30534
@@ -2205,8 +2207,9 @@ server.listen(80);
 <!-- YAML
 added: v8.4.0
 changes:
-  - version: REPLACEME
-    pr-url: https://github.com/nodejs-private/node-private/pull/204
+  - version:
+     - v12.18.0
+    pr-url: https://github.com/nodejs-private/node-private/pull/206
     description: Added `maxSettings` option with a default of 32.
   - version: v8.9.3
     pr-url: https://github.com/nodejs/node/pull/17105

diff --git a/doc/changelogs/CHANGELOG_V12.md b/doc/changelogs/CHANGELOG_V12.md
@@ -11,6 +11,7 @@
 </tr>
 <tr>
 <td valign="top">
+<a href="#12.18.0">12.18.0</a><br/>
 <a href="#12.17.0">12.17.0</a><br/>
 <a href="#12.16.3">12.16.3</a><br/>
 <a href="#12.16.2">12.16.2</a><br/>
@@ -58,6 +59,27 @@
   * [io.js](CHANGELOG_IOJS.md)
   * [Archive](CHANGELOG_ARCHIVE.md)
 
+<a id="12.18.0"></a>
+## 2020-06-02, Version 12.18.0 'Erbium' (LTS), @targos
+
+### Notable changes
+
+This is a security release.
+
+Vulnerabilities fixed:
+* **CVE-2020-8172**: TLS session reuse can lead to host certificate verification bypass (High).
+* **CVE-2020-11080**: HTTP/2 Large Settings Frame DoS (Low).
+* **CVE-2020-8174**: `napi_get_value_string_*()` allows various kinds of memory corruption (High).
+
+### Commits
+
+* [[`c6d0bdacc4`](https://github.com/nodejs/node/commit/c6d0bdacc4)] - **crypto**: update root certificates (AshCripps) [#33682](https://github.com/nodejs/node/pull/33682)
+* [[`916b2824d1`](https://github.com/nodejs/node/commit/916b2824d1)] - **(SEMVER-MINOR)** **deps**: update nghttp2 to 1.41.0 (James M Snell) [nodejs-private/node-private#206](https://github.com/nodejs-private/node-private/pull/206)
+* [[`d381426377`](https://github.com/nodejs/node/commit/d381426377)] - **(SEMVER-MINOR)** **http2**: implement support for max settings entries (James M Snell) [nodejs-private/node-private#206](https://github.com/nodejs-private/node-private/pull/206)
+* [[`7dd8982570`](https://github.com/nodejs/node/commit/7dd8982570)] - **napi**: fix memory corruption vulnerability (Tobias Nießen) [nodejs-private/node-private#195](https://github.com/nodejs-private/node-private/pull/195)
+* [[`0932309af2`](https://github.com/nodejs/node/commit/0932309af2)] - **tls**: emit `session` after verifying certificate (Fedor Indutny) [nodejs-private/node-private#200](https://github.com/nodejs-private/node-private/pull/200)
+* [[`c392d3923f`](https://github.com/nodejs/node/commit/c392d3923f)] - **tools**: update certdata.txt (AshCripps) [#33682](https://github.com/nodejs/node/pull/33682)
+
 <a id="12.17.0"></a>
 ## 2020-05-26, Version 12.17.0 'Erbium' (LTS), @targos
 

diff --git a/src/node_version.h b/src/node_version.h
@@ -23,13 +23,13 @@
 #define SRC_NODE_VERSION_H_
 
 #define NODE_MAJOR_VERSION 12
-#define NODE_MINOR_VERSION 17
-#define NODE_PATCH_VERSION 1
+#define NODE_MINOR_VERSION 18
+#define NODE_PATCH_VERSION 0
 
 #define NODE_VERSION_IS_LTS 1
 #define NODE_VERSION_LTS_CODENAME "Erbium"
 
-#define NODE_VERSION_IS_RELEASE 0
+#define NODE_VERSION_IS_RELEASE 1
 
 #ifndef NODE_STRINGIFY
 #define NODE_STRINGIFY(n) NODE_STRINGIFY_HELPER(n)