deps: float b18162a7c from openssl (CVE-2018-5407) (8.x and 6.x only) #24352
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Only changes to src/base/debug/stack_trace_posix.cc included.
Original commit message:
Fixes to V8 GN build process on aix platform
src/base/debug/stack_trace_posix.cc: suppressed unused function
warnings for functions DemangleSymbols, OutputPointer(in order to
compile with -Werror flag)
test/cctest/test-isolate-independent-builtins.cc: corrections to
make ByteInText test case compatible with aix. (affects aix only)
Change-Id: I49e45e63545404c77aaed3f51b26557f6f03455e
Reviewed-on: https://chromium-review.googlesource.com/927484
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{nodejs#52071}
PR-URL: nodejs#23958
Reviewed-By: Refael Ackermann <refack@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Original commit message:
ppc64, aix: Pass CallFrequency object by const reference to avoid
value copy error.
Bug: v8:8193
GCC bug: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61976
Change-Id: I0d4efca4da03ef82651325e15ddf2160022bc8de
Reviewed-on: https://chromium-review.googlesource.com/1228633
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#56275}
PR-URL: nodejs#23958
Reviewed-By: Refael Ackermann <refack@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Floating this patch since the code does not exist upstream anymore. deps/v8/testing/gtest.gyp: Suppress -Wnonnull-compare, -Waddress warnings for deps/v8/testing/gtest project; deps/v8/src/compiler/store-store-elimination.cc, deps/v8/src/conversions.cc: Suppress unused function warnings in order to compile with newer (>4.8.5) gcc on Aix. PR-URL: nodejs#23958 Reviewed-By: Refael Ackermann <refack@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Low severity timing vulnerability in ECC calculations impacting ECDSA and ECDH. Publicly disclosed but unreleased, pending OpenSSL 1.0.1q Ref: https://www.openssl.org/news/secadv/20181112.txt Ref: openssl/openssl#7593 Upstream: openssl/openssl@b18162a7c Original commit message: CVE-2018-5407 fix: ECC ladder Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from openssl/openssl#7593)
nodejs-github-bot
added
openssl
Merged
BethGriggs
force-pushed
the
v8.x-staging
branch
from
e083cc1
to
62dd1d7
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Low severity timing vulnerability in ECC calculations impacting ECDSA and ECDH. This was fixed already in 1.1.0i which we already have but there was a long delay in getting it back in to 1.0.1. They are not releasing a new 1.0.1 specifically for this and I'd expect there to be a delay on a new version because of a shift in development focus.
So this should go into 8.x and 6.x when we do them next.
@nodejs/release @nodejs/crypto
Ref: https://www.openssl.org/news/secadv/20181112.txt