sec: upcoming security announcement #1496
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
@nodejs/website please review, would like to publish within the next hour (Although I'm in a meeting 3-4 so it may be 4 before I get back to it, so feel free to land if it looks ok) |
|
Should we also update the main header? |
chris--young
approved these changes
Dec 4, 2017
maclover7
reviewed
Dec 4, 2017
| --- | ||
| date: 2017-12-04T19:30:00.617Z | ||
| category: vulnerability | ||
| title: Data Confidentiality/Integrity Vulnerability, September 2017 |
|
@maclover7 thanks, good catch. Updated. |
|
@MylesBorins we should probably define our policy on that. If we should do it as part of the announce and release I'll update the instructions to reflect that. |
lpinca
approved these changes
Dec 4, 2017
|
|
||
| # Data Confidentiality/Integrity Vulnerability | ||
|
|
||
| All versions of 4.x, 6.x, 8.x and 9.x are vulnerable to an issue to be fixed in the forthcoming OpenSSL-1.0.2n released on Dec 7 see https://mta.openssl.org/pipermail/openssl-announce/2017-December/000108.html for more details. The severity of this vulnerability of Node.js is HIGH (due to the way Node.js uses the OpenSSL APIs) and users of the affected versions should plan to upgrade when a fix is made available. |
cjihrig
approved these changes
Dec 4, 2017
|
Also added to banner. |
evanlucas
approved these changes
Dec 4, 2017
pierreneter
approved these changes
Dec 4, 2017
jseijas
approved these changes
Dec 4, 2017
mhdawson
added a commit
that referenced
this pull request
Dec 4, 2017
PR-URL: #1496 Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Evan Lucas <evanlucas@me.com>
|
Landed as e552ce4 |
|
Oops, I was a few minutes too late. Oh, well, they were very small nits. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.