{"action":"created","comment":{"url":"https://api.github.com/repos/nodejs/nodejs-ko/pulls/comments/46859488","id":46859488,"diff_hunk":"@@ -0,0 +1,157 @@\n+---\n+layout: post\n+title: 12월 보안 릴리스 요약\n+author: Rod Vagg\n+ref: December Security Release Summary\n+refurl: https://nodejs.org/en/blog/vulnerability/december-2015-security-releases/\n+translator:\n+- <a href=\"https://github.com/outsideris\" target=\"_blank\">Outsider</a>\n+---\n+\n+<!--\n+Last week we [announced](https://groups.google.com/d/msg/nodejs-sec/Zf7Nxtg230E/eX4UCWf0BAAJ) the planned release of patch updates to the v0.12.x, v4.x and v5.x lines to fix two vulnerabilities. That was further amended by the [announcement](https://mta.openssl.org/pipermail/openssl-announce/2015-November/000045.html) of OpenSSL updates with fixes for vulnerabilities labelled _medium_ severity. The OpenSSL update impacts all active release lines, including v0.10.x.\n+-->\n+지난주에 두 가지 취약점을 수정하려고 v0.12.x, v4.x, v5.x 버전을 패치 업데이트 릴리스 계획을\n+[발표](https://groups.google.com/d/msg/nodejs-sec/Zf7Nxtg230E/eX4UCWf0BAAJ)했습니다.\n+_중간_정도의 심각도로 표시된 취약점을 수정하는 OpenSSL 업데이트의\n+[발표](https://mta.openssl.org/pipermail/openssl-announce/2015-November/000045.html)에\n+의한 추가적인 수정이 있었습니다. OpenSSL 업데이트는 v0.10.x을 포함한 모든 릴리스 라인에 영향을 줍니다.\n+\n+<!--\n+Today we have released Node.js [v0.10.41 (Maintenance)](/en/blog/release/v0.10.41/), [v0.12.9 (LTS)](/en/blog/release/v0.12.9/), [v4.2.3 \"Argon\" (LTS)](/en/blog/release/v4.2.3/) and [v5.1.1 (Stable)](/en/blog/release/v5.1.1/) with fixes for the announced vulnerabilities and updates to OpenSSL.\n+\n+For the purpose of understanding the impact that the fixed vulnerabilities have on your Node.js deployment and the urgency of the upgrades for your circumstances we are providing details below.\n+-->\n+발표된 취약점과 OpenSSL을 업데이트하는 수정사항을 담은 Node.js\n+[v0.10.41 (유지보수 버전)](/en/blog/release/v0.10.41/),\n+[v0.12.9 (LTS)](/en/blog/release/v0.12.9/),\n+[v4.2.3 \"Argon\" (LTS)](/en/blog/release/v4.2.3/),\n+[v5.1.1 (안정 버전)](/en/blog/release/v5.1.1/)을 오늘 릴리스 했습니다.\n+\n+사용 중인 Node.js 버전의 수정된 취약점이 주는 영향도와 환경을 업그레이드해야 하는 긴급성을 알리기 위해\n+아래에 자세한 내용을 정리했습니다.\n+\n+<!--\n+### CVE-2015-8027 Denial of Service Vulnerability\n+-->\n+\n+### CVE-2015-8027 서비스 거부 취약점\n+\n+<!--\n+This critical denial of service (DoS) vulnerability impacts all versions of v0.12.x through to v5.x, inclusive. The vulnerability was discovered by Node.js core team member Fedor Indutny and relates to HTTP pipelining. Under certain conditions an HTTP socket may no longer have a parser associated with it but a pipelined request can trigger a pause or resume on the non-existent parser thereby causing an `uncaughtException` to be thrown. As these conditions can be created by an external attacker and cause a Node.js service to be shut down we consider this a critical vulnerability. It is recommended that users of impacted versions of Node.js exposing HTTP services upgrade to the appropriate patched versions as soon as practical.\n+-->\n+치명적인 서비스 거부(DoS, denial of service) 취약점은 v0.12.x부터 v5.x까지 모든 버전에 영향을\n+줍니다. 이 취약점은 Node.js 핵심 팀멤버인 Fedor Indutny가 발견했고 HTTP 파이프라인과 관련이\n+있습니다. 특정 조건에서 HTTP 소켓에 연결된 파서가 없을 수가 있는데 이때 파이프라인에 연결된 요청이\n+존재하지 않는 파서에서 일시 정지(pause)나 속행(resume)을 실행할 수 있으므로\n+`uncaughtException`가 던져지게 됩니다. 외부 공격자가 이 조건을 만들어서 Node.js 서비스를\n+종료시킬 수 있으므로 이를 심각한 취약점으로 분류했습니다. 이 취약점에 영향을 받는 버전의 Node.js로\n+HTTP 서비스를 외부에 노출하는 사용자는 현실적으로 최대한 빨리 수정된 버전으로 업그레이드 하기를 권합니다.\n+\n+<!--\n+* Versions 0.10.x of Node.js are not affected.\n+* Versions 0.12.x of Node.js are **vulnerable**, please upgrade to [v0.12.9 (LTS)](/en/blog/release/v0.12.9/).\n+* Versions 4.x, including LTS Argon, of Node.js are **vulnerable**, please upgrade to [v4.2.3 \"Argon\" (LTS)](/en/blog/release/v4.2.3/).\n+* Versions 5.x of Node.js are **vulnerable**, please upgrade to [v5.1.1 (Stable)](/en/blog/release/v5.1.1/).\n+-->\n+\n+* Node.js 0.10.x 버전은 영향받지 않습니다.\n+* Node.js 0.12.x 버전은 **취약합니다**. [v0.12.9 (LTS)](/en/blog/release/v0.12.9/)로 업그레이드하세요.\n+* LTS Argon을 포함한 Node.js 4.x 버전은 **취약합니다**. [v4.2.3 \"Argon\" (LTS)](/en/blog/release/v4.2.3/)로 업그레이드하세요.\n+* Node.js 5.x 버전은 **취약합니다**. [v5.1.1 (안정 버전)](/en/blog/release/v5.1.1/)로 업그레이드하세요.\n+\n+<!--\n+### CVE-2015-6764 V8 Out-of-bounds Access Vulnerability\n+-->\n+### CVE-2015-6764 V8 Out-of-bounds 접근 취약점\n+\n+<!--\n+A bug was discovered in V8's implementation of `JSON.stringify()` that can result in out-of-bounds reads on arrays. The patch was included in this week's [update of Chrome Stable](http://googlechromereleases.blogspot.nl/2015/12/stable-channel-update.html). While this bug is high severity for browsers, it is considered lower risk for Node.js users as it requires the execution of third-party JavaScript within an application in order to be exploitable.\n+-->\n+이 버그는 배열에서 out-of-bounds를 읽을 수 있는 `JSON.stringify()`의 V8 구현체에서","path":"articles/_posts/2015-12-04-vulnerability-december-2015-security-releases.md","position":71,"original_position":71,"commit_id":"d95e6c06f51a98a70ebac8f66e14fb7eee09df2b","original_commit_id":"d95e6c06f51a98a70ebac8f66e14fb7eee09df2b","user":{"login":"yous","id":853977,"avatar_url":"https://avatars.githubusercontent.com/u/853977?v=3","gravatar_id":"","url":"https://api.github.com/users/yous","html_url":"https://github.com/yous","followers_url":"https://api.github.com/users/yous/followers","following_url":"https://api.github.com/users/yous/following{/other_user}","gists_url":"https://api.github.com/users/yous/gists{/gist_id}","starred_url":"https://api.github.com/users/yous/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yous/subscriptions","organizations_url":"https://api.github.com/users/yous/orgs","repos_url":"https://api.github.com/users/yous/repos","events_url":"https://api.github.com/users/yous/events{/privacy}","received_events_url":"https://api.github.com/users/yous/received_events","type":"User","site_admin":false},"body":"out-of-bounds read는 배열 범위 밖을 읽는 행위를 가리키는 것 같습니다.\r\n'이 버그는 배열 밖을 읽을 수 있는 \\`JSON.stringify()\\`의 V8 구현체에서'는 어떻습니까?","created_at":"2015-12-07T18:50:35Z","updated_at":"2015-12-07T18:50:35Z","html_url":"https://github.com/nodejs/nodejs-ko/pull/212#discussion_r46859488","pull_request_url":"https://api.github.com/repos/nodejs/nodejs-ko/pulls/212","_links":{"self":{"href":"https://api.github.com/repos/nodejs/nodejs-ko/pulls/comments/46859488"},"html":{"href":"https://github.com/nodejs/nodejs-ko/pull/212#discussion_r46859488"},"pull_request":{"href":"https://api.github.com/repos/nodejs/nodejs-ko/pulls/212"}}},"pull_request":{"url":"https://api.github.com/repos/nodejs/nodejs-ko/pulls/212","id":52877047,"html_url":"https://github.com/nodejs/nodejs-ko/pull/212","diff_url":"https://github.com/nodejs/nodejs-ko/pull/212.diff","patch_url":"https://github.com/nodejs/nodejs-ko/pull/212.patch","issue_url":"https://api.github.com/repos/nodejs/nodejs-ko/issues/212","number":212,"state":"open","locked":false,"title":"Translate December Security Release Summary","user":{"login":"outsideris","id":390146,"avatar_url":"https://avatars.githubusercontent.com/u/390146?v=3","gravatar_id":"","url":"https://api.github.com/users/outsideris","html_url":"https://github.com/outsideris","followers_url":"https://api.github.com/users/outsideris/followers","following_url":"https://api.github.com/users/outsideris/following{/other_user}","gists_url":"https://api.github.com/users/outsideris/gists{/gist_id}","starred_url":"https://api.github.com/users/outsideris/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/outsideris/subscriptions","organizations_url":"https://api.github.com/users/outsideris/orgs","repos_url":"https://api.github.com/users/outsideris/repos","events_url":"https://api.github.com/users/outsideris/events{/privacy}","received_events_url":"https://api.github.com/users/outsideris/received_events","type":"User","site_admin":false},"body":"Related #200 ","created_at":"2015-12-07T17:46:53Z","updated_at":"2015-12-07T18:50:35Z","closed_at":null,"merged_at":null,"merge_commit_sha":"be726e75422f050979575c34ea8b01345b002458","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/nodejs/nodejs-ko/pulls/212/commits","review_comments_url":"https://api.github.com/repos/nodejs/nodejs-ko/pulls/212/comments","review_comment_url":"https://api.github.com/repos/nodejs/nodejs-ko/pulls/comments{/number}","comments_url":"https://api.github.com/repos/nodejs/nodejs-ko/issues/212/comments","statuses_url":"https://api.github.com/repos/nodejs/nodejs-ko/statuses/d95e6c06f51a98a70ebac8f66e14fb7eee09df2b","head":{"label":"outsideris:december-2015-security-releases","ref":"december-2015-security-releases","sha":"d95e6c06f51a98a70ebac8f66e14fb7eee09df2b","user":{"login":"outsideris","id":390146,"avatar_url":"https://avatars.githubusercontent.com/u/390146?v=3","gravatar_id":"","url":"https://api.github.com/users/outsideris","html_url":"https://github.com/outsideris","followers_url":"https://api.github.com/users/outsideris/followers","following_url":"https://api.github.com/users/outsideris/following{/other_user}","gists_url":"https://api.github.com/users/outsideris/gists{/gist_id}","starred_url":"https://api.github.com/users/outsideris/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/outsideris/subscriptions","organizations_url":"https://api.github.com/users/outsideris/orgs","repos_url":"https://api.github.com/users/outsideris/repos","events_url":"https://api.github.com/users/outsideris/events{/privacy}","received_events_url":"https://api.github.com/users/outsideris/received_events","type":"User","site_admin":false},"repo":{"id":30659339,"name":"nodejs-ko","full_name":"outsideris/nodejs-ko","owner":{"login":"outsideris","id":390146,"avatar_url":"https://avatars.githubusercontent.com/u/390146?v=3","gravatar_id":"","url":"https://api.github.com/users/outsideris","html_url":"https://github.com/outsideris","followers_url":"https://api.github.com/users/outsideris/followers","following_url":"https://api.github.com/users/outsideris/following{/other_user}","gists_url":"https://api.github.com/users/outsideris/gists{/gist_id}","starred_url":"https://api.github.com/users/outsideris/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/outsideris/subscriptions","organizations_url":"https://api.github.com/users/outsideris/orgs","repos_url":"https://api.github.com/users/outsideris/repos","events_url":"https://api.github.com/users/outsideris/events{/privacy}","received_events_url":"https://api.github.com/users/outsideris/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/outsideris/nodejs-ko","description":"io.js 한국어 번역팀","fork":true,"url":"https://api.github.com/repos/outsideris/nodejs-ko","forks_url":"https://api.github.com/repos/outsideris/nodejs-ko/forks","keys_url":"https://api.github.com/repos/outsideris/nodejs-ko/keys{/key_id}","collaborators_url":"https://api.github.com/repos/outsideris/nodejs-ko/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/outsideris/nodejs-ko/teams","hooks_url":"https://api.github.com/repos/outsideris/nodejs-ko/hooks","issue_events_url":"https://api.github.com/repos/outsideris/nodejs-ko/issues/events{/number}","events_url":"https://api.github.com/repos/outsideris/nodejs-ko/events","assignees_url":"https://api.github.com/repos/outsideris/nodejs-ko/assignees{/user}","branches_url":"https://api.github.com/repos/outsideris/nodejs-ko/branches{/branch}","tags_url":"https://api.github.com/repos/outsideris/nodejs-ko/tags","blobs_url":"https://api.github.com/repos/outsideris/nodejs-ko/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/outsideris/nodejs-ko/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/outsideris/nodejs-ko/git/refs{/sha}","trees_url":"https://api.github.com/repos/outsideris/nodejs-ko/git/trees{/sha}","statuses_url":"https://api.github.com/repos/outsideris/nodejs-ko/statuses/{sha}","languages_url":"https://api.github.com/repos/outsideris/nodejs-ko/languages","stargazers_url":"https://api.github.com/repos/outsideris/nodejs-ko/stargazers","contributors_url":"https://api.github.com/repos/outsideris/nodejs-ko/contributors","subscribers_url":"https://api.github.com/repos/outsideris/nodejs-ko/subscribers","subscription_url":"https://api.github.com/repos/outsideris/nodejs-ko/subscription","commits_url":"https://api.github.com/repos/outsideris/nodejs-ko/commits{/sha}","git_commits_url":"https://api.github.com/repos/outsideris/nodejs-ko/git/commits{/sha}","comments_url":"https://api.github.com/repos/outsideris/nodejs-ko/comments{/number}","issue_comment_url":"https://api.github.com/repos/outsideris/nodejs-ko/issues/comments{/number}","contents_url":"https://api.github.com/repos/outsideris/nodejs-ko/contents/{+path}","compare_url":"https://api.github.com/repos/outsideris/nodejs-ko/compare/{base}...{head}","merges_url":"https://api.github.com/repos/outsideris/nodejs-ko/merges","archive_url":"https://api.github.com/repos/outsideris/nodejs-ko/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/outsideris/nodejs-ko/downloads","issues_url":"https://api.github.com/repos/outsideris/nodejs-ko/issues{/number}","pulls_url":"https://api.github.com/repos/outsideris/nodejs-ko/pulls{/number}","milestones_url":"https://api.github.com/repos/outsideris/nodejs-ko/milestones{/number}","notifications_url":"https://api.github.com/repos/outsideris/nodejs-ko/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/outsideris/nodejs-ko/labels{/name}","releases_url":"https://api.github.com/repos/outsideris/nodejs-ko/releases{/id}","created_at":"2015-02-11T17:10:29Z","updated_at":"2015-11-14T14:21:37Z","pushed_at":"2015-12-07T17:46:30Z","git_url":"git://github.com/outsideris/nodejs-ko.git","ssh_url":"git@github.com:outsideris/nodejs-ko.git","clone_url":"https://github.com/outsideris/nodejs-ko.git","svn_url":"https://github.com/outsideris/nodejs-ko","homepage":"","size":854,"stargazers_count":1,"watchers_count":1,"language":"CSS","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":1,"mirror_url":null,"open_issues_count":0,"forks":1,"open_issues":0,"watchers":1,"default_branch":"gh-pages"}},"base":{"label":"nodejs:gh-pages","ref":"gh-pages","sha":"3522b71b9d5b6e7a29bd8afca43a60aadccac27b","user":{"login":"nodejs","id":9950313,"avatar_url":"https://avatars.githubusercontent.com/u/9950313?v=3","gravatar_id":"","url":"https://api.github.com/users/nodejs","html_url":"https://github.com/nodejs","followers_url":"https://api.github.com/users/nodejs/followers","following_url":"https://api.github.com/users/nodejs/following{/other_user}","gists_url":"https://api.github.com/users/nodejs/gists{/gist_id}","starred_url":"https://api.github.com/users/nodejs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nodejs/subscriptions","organizations_url":"https://api.github.com/users/nodejs/orgs","repos_url":"https://api.github.com/users/nodejs/repos","events_url":"https://api.github.com/users/nodejs/events{/privacy}","received_events_url":"https://api.github.com/users/nodejs/received_events","type":"Organization","site_admin":false},"repo":{"id":30468251,"name":"nodejs-ko","full_name":"nodejs/nodejs-ko","owner":{"login":"nodejs","id":9950313,"avatar_url":"https://avatars.githubusercontent.com/u/9950313?v=3","gravatar_id":"","url":"https://api.github.com/users/nodejs","html_url":"https://github.com/nodejs","followers_url":"https://api.github.com/users/nodejs/followers","following_url":"https://api.github.com/users/nodejs/following{/other_user}","gists_url":"https://api.github.com/users/nodejs/gists{/gist_id}","starred_url":"https://api.github.com/users/nodejs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nodejs/subscriptions","organizations_url":"https://api.github.com/users/nodejs/orgs","repos_url":"https://api.github.com/users/nodejs/repos","events_url":"https://api.github.com/users/nodejs/events{/privacy}","received_events_url":"https://api.github.com/users/nodejs/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/nodejs/nodejs-ko","description":"node.js 한국 커뮤니티","fork":false,"url":"https://api.github.com/repos/nodejs/nodejs-ko","forks_url":"https://api.github.com/repos/nodejs/nodejs-ko/forks","keys_url":"https://api.github.com/repos/nodejs/nodejs-ko/keys{/key_id}","collaborators_url":"https://api.github.com/repos/nodejs/nodejs-ko/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/nodejs/nodejs-ko/teams","hooks_url":"https://api.github.com/repos/nodejs/nodejs-ko/hooks","issue_events_url":"https://api.github.com/repos/nodejs/nodejs-ko/issues/events{/number}","events_url":"https://api.github.com/repos/nodejs/nodejs-ko/events","assignees_url":"https://api.github.com/repos/nodejs/nodejs-ko/assignees{/user}","branches_url":"https://api.github.com/repos/nodejs/nodejs-ko/branches{/branch}","tags_url":"https://api.github.com/repos/nodejs/nodejs-ko/tags","blobs_url":"https://api.github.com/repos/nodejs/nodejs-ko/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/nodejs/nodejs-ko/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/nodejs/nodejs-ko/git/refs{/sha}","trees_url":"https://api.github.com/repos/nodejs/nodejs-ko/git/trees{/sha}","statuses_url":"https://api.github.com/repos/nodejs/nodejs-ko/statuses/{sha}","languages_url":"https://api.github.com/repos/nodejs/nodejs-ko/languages","stargazers_url":"https://api.github.com/repos/nodejs/nodejs-ko/stargazers","contributors_url":"https://api.github.com/repos/nodejs/nodejs-ko/contributors","subscribers_url":"https://api.github.com/repos/nodejs/nodejs-ko/subscribers","subscription_url":"https://api.github.com/repos/nodejs/nodejs-ko/subscription","commits_url":"https://api.github.com/repos/nodejs/nodejs-ko/commits{/sha}","git_commits_url":"https://api.github.com/repos/nodejs/nodejs-ko/git/commits{/sha}","comments_url":"https://api.github.com/repos/nodejs/nodejs-ko/comments{/number}","issue_comment_url":"https://api.github.com/repos/nodejs/nodejs-ko/issues/comments{/number}","contents_url":"https://api.github.com/repos/nodejs/nodejs-ko/contents/{+path}","compare_url":"https://api.github.com/repos/nodejs/nodejs-ko/compare/{base}...{head}","merges_url":"https://api.github.com/repos/nodejs/nodejs-ko/merges","archive_url":"https://api.github.com/repos/nodejs/nodejs-ko/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/nodejs/nodejs-ko/downloads","issues_url":"https://api.github.com/repos/nodejs/nodejs-ko/issues{/number}","pulls_url":"https://api.github.com/repos/nodejs/nodejs-ko/pulls{/number}","milestones_url":"https://api.github.com/repos/nodejs/nodejs-ko/milestones{/number}","notifications_url":"https://api.github.com/repos/nodejs/nodejs-ko/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/nodejs/nodejs-ko/labels{/name}","releases_url":"https://api.github.com/repos/nodejs/nodejs-ko/releases{/id}","created_at":"2015-02-07T20:00:23Z","updated_at":"2015-12-01T15:06:49Z","pushed_at":"2015-12-07T17:46:53Z","git_url":"git://github.com/nodejs/nodejs-ko.git","ssh_url":"git@github.com:nodejs/nodejs-ko.git","clone_url":"https://github.com/nodejs/nodejs-ko.git","svn_url":"https://github.com/nodejs/nodejs-ko","homepage":"http://nodejs.github.io/nodejs-ko/","size":903,"stargazers_count":99,"watchers_count":99,"language":"CSS","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":24,"mirror_url":null,"open_issues_count":16,"forks":24,"open_issues":16,"watchers":99,"default_branch":"gh-pages"}},"_links":{"self":{"href":"https://api.github.com/repos/nodejs/nodejs-ko/pulls/212"},"html":{"href":"https://github.com/nodejs/nodejs-ko/pull/212"},"issue":{"href":"https://api.github.com/repos/nodejs/nodejs-ko/issues/212"},"comments":{"href":"https://api.github.com/repos/nodejs/nodejs-ko/issues/212/comments"},"review_comments":{"href":"https://api.github.com/repos/nodejs/nodejs-ko/pulls/212/comments"},"review_comment":{"href":"https://api.github.com/repos/nodejs/nodejs-ko/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/nodejs/nodejs-ko/pulls/212/commits"},"statuses":{"href":"https://api.github.com/repos/nodejs/nodejs-ko/statuses/d95e6c06f51a98a70ebac8f66e14fb7eee09df2b"}}}}