deps: upgrade to openssl 1.0.1q (v0.12) by bnoordhuis · Pull Request #4133 · nodejs/node

bnoordhuis · 2015-12-03T16:47:00Z

Contains fixes for:

CVE-2015-3194 Certificate verify crash with missing PSS parameter
CVE-2015-3195 X509_ATTRIBUTE memory leak

(v0.12 is not affected by CVE-2015-3193 and CVE-2015-3196.)

OpenSSL did a character encoding fix-up that I've split off into a separate commit to keep down the noise in the main commit.

R=@nodejs/crypto

CI: https://ci.nodejs.org/job/node-test-pull-request/909/

Contains fixes for: * CVE-2015-3194 Certificate verify crash with missing PSS parameter * CVE-2015-3195 X509_ATTRIBUTE memory leak

indutny · 2015-12-03T17:13:03Z

LGTM if CI is happy.

shigeki · 2015-12-03T17:29:17Z

@bnoordhuis What to do for opensslconf.h change in openssl/openssl@98b9454 ? It is for sun and seems not be serious. But just confirmation.

shigeki · 2015-12-03T17:38:05Z

asm, header files and floating patches are fine. The remaining is only opensslconf.h

bnoordhuis · 2015-12-03T17:54:44Z

I forgot to commit that. New CI with opensslconf.h fix-up: https://ci.nodejs.org/job/node-test-pull-request/911/

shigeki · 2015-12-03T17:54:50Z

I think node is not vulnerable to X509_ATTRIBUTE memory leak (CVE-2015-3195) because PKCS7/CMS is not supported in Node.

shigeki · 2015-12-03T17:55:51Z

LGTM if CI is fine.

shigeki · 2015-12-03T18:01:05Z

Is the fix of character encoding also necessary for 1.0.2e? I never had a warning noise of character encoding while I'm working on it.

bnoordhuis · 2015-12-03T18:05:01Z

@shigeki bnoordhuis/io.js@353c7f8 is what the diff looks like for 1.0.2e.

shigeki · 2015-12-03T18:14:35Z

There seems nothing to be changed in my branch with your commit. Why difference happened?

$ git cherry-pick 353c7f8
On branch upgrade_opessl1.0.2e
You are currently cherry-picking commit 353c7f8.
nothing to commit, working directory clean
The previous cherry-pick is now empty, possibly due to conflict resolution.
If you wish to commit it anyway, use:

shigeki · 2015-12-03T18:23:48Z

CI is fine. But this PR is against v0.12 not v0.12-staging. Which is a right branch to land?

rvagg · 2015-12-03T18:24:33Z

@shigeki land it in v0.12-staging, I'll pull from there.

shigeki · 2015-12-03T18:25:24Z

Okay, I will land this to v0.12-staging.

Contains fixes for: * CVE-2015-3194 Certificate verify crash with missing PSS parameter * CVE-2015-3195 X509_ATTRIBUTE memory leak fixup! character encoding noise fixup! update opensslconf.h PR-URL: #4133 Reviewed-By: Fedor Indutny <fedor@indutny.com> Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>

shigeki · 2015-12-03T18:34:46Z

Landed in 6ee1536 . Thanks.

Security Update Notable items: * build: Add support for Microsoft Visual Studio 2015 * npm: Upgrade to v1.4.29 from v1.4.28. A special one-off release as part of the strategy to get a version of npm into Node.js v0.10.x that works with the current registry (nodejs/Release#37). This version of npm prints out a banner each time it is run. The banner warns that the next standard release of Node.js v0.10.x will ship with a version of npm v2. * openssl: Upgrade to 1.0.1q, containing fixes CVE-2015-3194 "Certificate verify crash with missing PSS parameter", a potential denial-of-service vector for Node.js TLS servers; TLS clients are also impacted. Details are available at <http://openssl.org/news/secadv/20151203.txt>. (Ben Noordhuis) #4133 PR-URL: nodejs-private/node-private#15

Security Update Notable items: * http: Fix a bug where an HTTP socket may no longer have a socket but a pipelined request triggers a pause or resume, a potential denial-of-service vector. (Fedor Indutny) * openssl: Upgrade to 1.0.1q, fixes CVE-2015-3194 "Certificate verify crash with missing PSS parameter", a potential denial-of-service vector for Node.js TLS servers; TLS clients are also impacted. Details are available at <http://openssl.org/news/secadv/20151203.txt>. (Ben Noordhuis) #4133 PR-URL: nodejs-private/node-private#13

Security Update Notable items: * build: Add support for Microsoft Visual Studio 2015 * npm: Upgrade to v1.4.29 from v1.4.28. A special one-off release as part of the strategy to get a version of npm into Node.js v0.10.x that works with the current registry (nodejs/Release#37). This version of npm prints out a banner each time it is run. The banner warns that the next standard release of Node.js v0.10.x will ship with a version of npm v2. * openssl: Upgrade to 1.0.1q, containing fixes CVE-2015-3194 "Certificate verify crash with missing PSS parameter", a potential denial-of-service vector for Node.js TLS servers; TLS clients are also impacted. Details are available at <http://openssl.org/news/secadv/20151203.txt>. (Ben Noordhuis) nodejs#4133 PR-URL: nodejs-private/node-private#15

Security Update Notable items: * http: Fix a bug where an HTTP socket may no longer have a socket but a pipelined request triggers a pause or resume, a potential denial-of-service vector. (Fedor Indutny) * openssl: Upgrade to 1.0.1q, fixes CVE-2015-3194 "Certificate verify crash with missing PSS parameter", a potential denial-of-service vector for Node.js TLS servers; TLS clients are also impacted. Details are available at <http://openssl.org/news/secadv/20151203.txt>. (Ben Noordhuis) nodejs#4133 PR-URL: nodejs-private/node-private#13

Security Update Notable items: * build: Add support for Microsoft Visual Studio 2015 * npm: Upgrade to v1.4.29 from v1.4.28. A special one-off release as part of the strategy to get a version of npm into Node.js v0.10.x that works with the current registry (nodejs/Release#37). This version of npm prints out a banner each time it is run. The banner warns that the next standard release of Node.js v0.10.x will ship with a version of npm v2. * openssl: Upgrade to 1.0.1q, containing fixes CVE-2015-3194 "Certificate verify crash with missing PSS parameter", a potential denial-of-service vector for Node.js TLS servers; TLS clients are also impacted. Details are available at <http://openssl.org/news/secadv/20151203.txt>. (Ben Noordhuis) #4133 PR-URL: nodejs-private/node-private#15

Security Update Notable items: * http: Fix a bug where an HTTP socket may no longer have a socket but a pipelined request triggers a pause or resume, a potential denial-of-service vector. (Fedor Indutny) * openssl: Upgrade to 1.0.1q, fixes CVE-2015-3194 "Certificate verify crash with missing PSS parameter", a potential denial-of-service vector for Node.js TLS servers; TLS clients are also impacted. Details are available at <http://openssl.org/news/secadv/20151203.txt>. (Ben Noordhuis) #4133 PR-URL: nodejs-private/node-private#13

Security Update Notable items: * build: Add support for Microsoft Visual Studio 2015 * npm: Upgrade to v1.4.29 from v1.4.28. A special one-off release as part of the strategy to get a version of npm into Node.js v0.10.x that works with the current registry (nodejs/Release#37). This version of npm prints out a banner each time it is run. The banner warns that the next standard release of Node.js v0.10.x will ship with a version of npm v2. * openssl: Upgrade to 1.0.1q, containing fixes CVE-2015-3194 "Certificate verify crash with missing PSS parameter", a potential denial-of-service vector for Node.js TLS servers; TLS clients are also impacted. Details are available at <http://openssl.org/news/secadv/20151203.txt>. (Ben Noordhuis) nodejs#4133 PR-URL: nodejs-private/node-private#15

Security Update Notable items: * http: Fix a bug where an HTTP socket may no longer have a socket but a pipelined request triggers a pause or resume, a potential denial-of-service vector. (Fedor Indutny) * openssl: Upgrade to 1.0.1q, fixes CVE-2015-3194 "Certificate verify crash with missing PSS parameter", a potential denial-of-service vector for Node.js TLS servers; TLS clients are also impacted. Details are available at <http://openssl.org/news/secadv/20151203.txt>. (Ben Noordhuis) nodejs#4133 PR-URL: nodejs-private/node-private#13

Contains fixes for: * CVE-2015-3194 Certificate verify crash with missing PSS parameter * CVE-2015-3195 X509_ATTRIBUTE memory leak fixup! character encoding noise fixup! update opensslconf.h PR-URL: nodejs/node#4133 Reviewed-By: Fedor Indutny <fedor@indutny.com> Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>

bnoordhuis added 2 commits December 3, 2015 17:37

deps: upgrade to openssl 1.0.1q
144c8af
Contains fixes for: * CVE-2015-3194 Certificate verify crash with missing PSS parameter * CVE-2015-3195 X509_ATTRIBUTE memory leak

fixup! character encoding noise
0767226

bnoordhuis added tls Issues and PRs related to the tls subsystem. crypto Issues and PRs related to the crypto subsystem. v0.12 labels Dec 3, 2015

mscdex added openssl Issues and PRs related to the OpenSSL dependency. and removed crypto Issues and PRs related to the crypto subsystem. tls Issues and PRs related to the tls subsystem. labels Dec 3, 2015

fixup! update opensslconf.h
86d1490

shigeki closed this Dec 3, 2015

bnoordhuis deleted the upgrade-openssl-v0.12 branch December 3, 2015 20:11

rvagg mentioned this pull request Dec 3, 2015
Release proposal: v0.10.41 #2805
Merged

snyk-bot mentioned this pull request Apr 30, 2023
[Snyk] Fix for 15 vulnerabilities aliscco/alisco-node#387
Open

Uh oh!

Uh oh!

Conversation

bnoordhuis commented Dec 3, 2015

Uh oh!

indutny commented Dec 3, 2015

Uh oh!

shigeki commented Dec 3, 2015

Uh oh!

shigeki commented Dec 3, 2015

Uh oh!

bnoordhuis commented Dec 3, 2015

Uh oh!

shigeki commented Dec 3, 2015

Uh oh!

shigeki commented Dec 3, 2015

Uh oh!

shigeki commented Dec 3, 2015

Uh oh!

bnoordhuis commented Dec 3, 2015

Uh oh!

shigeki commented Dec 3, 2015

Uh oh!

shigeki commented Dec 3, 2015

Uh oh!

rvagg commented Dec 3, 2015

Uh oh!

shigeki commented Dec 3, 2015

Uh oh!

shigeki commented Dec 3, 2015

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants