Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

sec: upcoming security announcement #1496

Closed
wants to merge 6 commits into from
Closed

sec: upcoming security announcement #1496

Changes from 3 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
3233cd2
sec: upcoming security announcement
mhdawson Dec 4, 2017
4d1d197
squash: fix up formatting
mhdawson Dec 4, 2017
09a9eb0
squash: address comments
mhdawson Dec 4, 2017
33f3d75
squash: address comments
mhdawson Dec 4, 2017
728c052
squash: fix capitalization
mhdawson Dec 4, 2017
af0be36
nit fixes
Trott Dec 4, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions locale/en/blog/vulnerability/december-2017-security-releases.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
---
date: 2017-12-04T19:30:00.617Z
category: vulnerability
title: Data Confidentiality/Integrity Vulnerability, December 2017
slug: december-2017-security-releases
layout: blog-post.hbs
author: Michael Dawson
---

# Summary
The Node.js project will be releasing new versions of 4.x, 6.x, 8.x and 9.x as soon as possible after the OpenSSL release, on or soon after December 8th UTC, to incorporate a security fix.

# Data Confidentiality/Integrity Vulnerability

All versions of 4.x, 6.x, 8.x and 9.x are vulnerable to an issue to be fixed in the forthcoming OpenSSL-1.0.2n released on Dec 7 see https://mta.openssl.org/pipermail/openssl-announce/2017-December/000108.html for more details. The severity of this vulnerability of Node.js is HIGH (due to the way Node.js uses the OpenSSL APIs) and users of the affected versions should plan to upgrade when a fix is made available.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: add a comma after Dec 7?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed


# Impact

* Versions 4.0 and later of Node.js are vulnerable
* Versions 6.0 and later of Node.js are vulnerable
* Versions 8.0 and later of Node.js are vulnerable
* Versions 9.0 and later of Node.js are vulnerable

# Release timing
Releases will be available as soon as possible after the OpenSSL release, along with disclosure of the details for the vulnerability in order to allow for complete impact assessment by users.

# Contact and future updates

The current Node.js security policy can be found at https://nodejs.org/en/security/.

Please contact security@nodejs.org if you wish to report a vulnerability in Node.js.

Subscribe to the low-volume announcement-only nodejs-sec mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the [nodejs GitHub organisation](https://github.com/nodejs/).