Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

deps: upgrade to openssl 1.0.1q (v0.12) #4133

Closed
wants to merge 3 commits into from
Closed

deps: upgrade to openssl 1.0.1q (v0.12) #4133

wants to merge 3 commits into from

Conversation

bnoordhuis
Copy link
Member

Contains fixes for:

(v0.12 is not affected by CVE-2015-3193 and CVE-2015-3196.)

OpenSSL did a character encoding fix-up that I've split off into a separate commit to keep down the noise in the main commit.

R=@nodejs/crypto

CI: https://ci.nodejs.org/job/node-test-pull-request/909/

@bnoordhuis
deps: upgrade to openssl 1.0.1q
144c8af 
Contains fixes for:

* CVE-2015-3194 Certificate verify crash with missing PSS parameter
* CVE-2015-3195 X509_ATTRIBUTE memory leak
@bnoordhuis
fixup! character encoding noise
0767226
@bnoordhuis bnoordhuis added tls Issues and PRs related to the tls subsystem. crypto Issues and PRs related to the crypto subsystem. v0.12 labels Dec 3, 2015
@indutny
Copy link
Member

indutny commented Dec 3, 2015

LGTM if CI is happy.

@shigeki
Copy link
Contributor

shigeki commented Dec 3, 2015

@bnoordhuis What to do for opensslconf.h change in openssl/openssl@98b9454 ? It is for sun and seems not be serious. But just confirmation.

@shigeki
Copy link
Contributor

shigeki commented Dec 3, 2015

asm, header files and floating patches are fine. The remaining is only opensslconf.h

@mscdex mscdex added openssl Issues and PRs related to the OpenSSL dependency. and removed crypto Issues and PRs related to the crypto subsystem. tls Issues and PRs related to the tls subsystem. labels Dec 3, 2015
@bnoordhuis
Copy link
Member Author

I forgot to commit that. New CI with opensslconf.h fix-up: https://ci.nodejs.org/job/node-test-pull-request/911/

@shigeki
Copy link
Contributor

shigeki commented Dec 3, 2015

I think node is not vulnerable to X509_ATTRIBUTE memory leak (CVE-2015-3195) because PKCS7/CMS is not supported in Node.

@shigeki
Copy link
Contributor

shigeki commented Dec 3, 2015

LGTM if CI is fine.

@shigeki
Copy link
Contributor

shigeki commented Dec 3, 2015

Is the fix of character encoding also necessary for 1.0.2e? I never had a warning noise of character encoding while I'm working on it.

@bnoordhuis
Copy link
Member Author

@shigeki bnoordhuis/io.js@353c7f8 is what the diff looks like for 1.0.2e.

@shigeki
Copy link
Contributor

shigeki commented Dec 3, 2015

There seems nothing to be changed in my branch with your commit. Why difference happened?

$ git cherry-pick 353c7f8
On branch upgrade_opessl1.0.2e
You are currently cherry-picking commit 353c7f8.

nothing to commit, working directory clean
The previous cherry-pick is now empty, possibly due to conflict resolution.
If you wish to commit it anyway, use:

@shigeki
Copy link
Contributor

shigeki commented Dec 3, 2015

CI is fine. But this PR is against v0.12 not v0.12-staging. Which is a right branch to land?

@rvagg
Copy link
Member

rvagg commented Dec 3, 2015

@shigeki land it in v0.12-staging, I'll pull from there.

@shigeki
Copy link
Contributor

shigeki commented Dec 3, 2015

Okay, I will land this to v0.12-staging.

bnoordhuis added a commit that referenced this pull request Dec 3, 2015
@bnoordhuis
deps: upgrade to openssl 1.0.1q
6ee1536 
Contains fixes for:

* CVE-2015-3194 Certificate verify crash with missing PSS parameter
* CVE-2015-3195 X509_ATTRIBUTE memory leak

fixup! character encoding noise

fixup! update opensslconf.h

PR-URL: #4133
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>
@shigeki
Copy link
Contributor

shigeki commented Dec 3, 2015

Landed in 6ee1536 . Thanks.

@shigeki shigeki closed this Dec 3, 2015
@bnoordhuis bnoordhuis deleted the upgrade-openssl-v0.12 branch December 3, 2015 20:11
rvagg added a commit that referenced this pull request Dec 3, 2015
@rvagg
2015-12-04, Version 0.10.41 (Maintenance)
2f947e9 
Security Update

Notable items:

* build: Add support for Microsoft Visual Studio 2015
* npm: Upgrade to v1.4.29 from v1.4.28. A special one-off release as
  part of the strategy to get a version of npm into Node.js v0.10.x that
  works with the current registry
  (nodejs/Release#37). This version of npm prints
  out a banner each time it is run. The banner warns that the next
  standard release of Node.js v0.10.x will ship with a version of npm
  v2.
* openssl: Upgrade to 1.0.1q, containing fixes CVE-2015-3194
  "Certificate verify crash with missing PSS parameter", a potential
  denial-of-service vector for Node.js TLS servers; TLS clients are also
  impacted. Details are available at
  <http://openssl.org/news/secadv/20151203.txt>. (Ben Noordhuis)
  #4133

PR-URL: nodejs-private/node-private#15
@rvagg rvagg mentioned this pull request Dec 3, 2015
Merged
rvagg added a commit that referenced this pull request Dec 4, 2015
@rvagg
2015-12-04, Version 0.12.9 (Stable)
ffc1395 
Security Update

Notable items:

* http: Fix a bug where an HTTP socket may no longer have a socket but a
  pipelined request triggers a pause or resume, a potential
  denial-of-service vector. (Fedor Indutny)
* openssl: Upgrade to 1.0.1q, fixes CVE-2015-3194
  "Certificate verify crash with missing PSS parameter", a potential
  denial-of-service vector for Node.js TLS servers; TLS clients are also
  impacted. Details are available at
  <http://openssl.org/news/secadv/20151203.txt>. (Ben Noordhuis) #4133

PR-URL: nodejs-private/node-private#13
rvagg added a commit to rvagg/io.js that referenced this pull request Dec 4, 2015
@rvagg
2015-12-04, Version 0.10.41 (Maintenance)
575f484 
Security Update

Notable items:

* build: Add support for Microsoft Visual Studio 2015
* npm: Upgrade to v1.4.29 from v1.4.28. A special one-off release as
  part of the strategy to get a version of npm into Node.js v0.10.x that
  works with the current registry
  (nodejs/Release#37). This version of npm prints
  out a banner each time it is run. The banner warns that the next
  standard release of Node.js v0.10.x will ship with a version of npm
  v2.
* openssl: Upgrade to 1.0.1q, containing fixes CVE-2015-3194
  "Certificate verify crash with missing PSS parameter", a potential
  denial-of-service vector for Node.js TLS servers; TLS clients are also
  impacted. Details are available at
  <http://openssl.org/news/secadv/20151203.txt>. (Ben Noordhuis)
  nodejs#4133

PR-URL: nodejs-private/node-private#15
rvagg added a commit to rvagg/io.js that referenced this pull request Dec 4, 2015
@rvagg
2015-12-04, Version 0.12.9 (Stable)
8fcf4c7 
Security Update

Notable items:

* http: Fix a bug where an HTTP socket may no longer have a socket but a
  pipelined request triggers a pause or resume, a potential
  denial-of-service vector. (Fedor Indutny)
* openssl: Upgrade to 1.0.1q, fixes CVE-2015-3194
  "Certificate verify crash with missing PSS parameter", a potential
  denial-of-service vector for Node.js TLS servers; TLS clients are also
  impacted. Details are available at
  <http://openssl.org/news/secadv/20151203.txt>. (Ben Noordhuis) nodejs#4133

PR-URL: nodejs-private/node-private#13
rvagg added a commit that referenced this pull request Dec 5, 2015
@rvagg
2015-12-04, Version 0.10.41 (Maintenance)
2c61b84 
Security Update

Notable items:

* build: Add support for Microsoft Visual Studio 2015
* npm: Upgrade to v1.4.29 from v1.4.28. A special one-off release as
  part of the strategy to get a version of npm into Node.js v0.10.x that
  works with the current registry
  (nodejs/Release#37). This version of npm prints
  out a banner each time it is run. The banner warns that the next
  standard release of Node.js v0.10.x will ship with a version of npm
  v2.
* openssl: Upgrade to 1.0.1q, containing fixes CVE-2015-3194
  "Certificate verify crash with missing PSS parameter", a potential
  denial-of-service vector for Node.js TLS servers; TLS clients are also
  impacted. Details are available at
  <http://openssl.org/news/secadv/20151203.txt>. (Ben Noordhuis)
  #4133

PR-URL: nodejs-private/node-private#15
rvagg added a commit that referenced this pull request Dec 5, 2015
@rvagg
2015-12-04, Version 0.12.9 (Stable)
07d8741 
Security Update

Notable items:

* http: Fix a bug where an HTTP socket may no longer have a socket but a
  pipelined request triggers a pause or resume, a potential
  denial-of-service vector. (Fedor Indutny)
* openssl: Upgrade to 1.0.1q, fixes CVE-2015-3194
  "Certificate verify crash with missing PSS parameter", a potential
  denial-of-service vector for Node.js TLS servers; TLS clients are also
  impacted. Details are available at
  <http://openssl.org/news/secadv/20151203.txt>. (Ben Noordhuis) #4133

PR-URL: nodejs-private/node-private#13
scovetta pushed a commit to scovetta/node that referenced this pull request Apr 2, 2016
@rvagg
2015-12-04, Version 0.10.41 (Maintenance)
8063d89 
Security Update

Notable items:

* build: Add support for Microsoft Visual Studio 2015
* npm: Upgrade to v1.4.29 from v1.4.28. A special one-off release as
  part of the strategy to get a version of npm into Node.js v0.10.x that
  works with the current registry
  (nodejs/Release#37). This version of npm prints
  out a banner each time it is run. The banner warns that the next
  standard release of Node.js v0.10.x will ship with a version of npm
  v2.
* openssl: Upgrade to 1.0.1q, containing fixes CVE-2015-3194
  "Certificate verify crash with missing PSS parameter", a potential
  denial-of-service vector for Node.js TLS servers; TLS clients are also
  impacted. Details are available at
  <http://openssl.org/news/secadv/20151203.txt>. (Ben Noordhuis)
  nodejs#4133

PR-URL: nodejs-private/node-private#15
scovetta pushed a commit to scovetta/node that referenced this pull request Apr 2, 2016
@rvagg
2015-12-04, Version 0.12.9 (Stable)
2a67fbb 
Security Update

Notable items:

* http: Fix a bug where an HTTP socket may no longer have a socket but a
  pipelined request triggers a pause or resume, a potential
  denial-of-service vector. (Fedor Indutny)
* openssl: Upgrade to 1.0.1q, fixes CVE-2015-3194
  "Certificate verify crash with missing PSS parameter", a potential
  denial-of-service vector for Node.js TLS servers; TLS clients are also
  impacted. Details are available at
  <http://openssl.org/news/secadv/20151203.txt>. (Ben Noordhuis) nodejs#4133

PR-URL: nodejs-private/node-private#13
jBarz pushed a commit to ibmruntimes/node that referenced this pull request Nov 4, 2016
@bnoordhuis @jBarz
deps: upgrade to openssl 1.0.1q
689abae 
Contains fixes for:

* CVE-2015-3194 Certificate verify crash with missing PSS parameter
* CVE-2015-3195 X509_ATTRIBUTE memory leak

fixup! character encoding noise

fixup! update opensslconf.h

PR-URL: nodejs/node#4133
Reviewed-By: Fedor Indutny <fedor@indutny.com>
Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>
This was referenced Mar 18, 2020
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
Open
@snyk-bot snyk-bot mentioned this pull request Apr 30, 2023
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
openssl Issues and PRs related to the OpenSSL dependency.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@bnoordhuis @indutny @shigeki @rvagg @mscdex