Heist/ feed

Security feed

patchSecurity fix · UnratedNode.js announcements

Node.js 12.22.11 (LTS)

Node.js 12.22.11 updates OpenSSL to version 1.1.1n, addressing an infinite-loop vulnerability reachable when parsing certificates.

Announced

Node.js · Fixed in 12.22.11CVE-2022-0778
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Update to OpenSSL 1.1.1n, which addresses the following vulnerability: Infinite loop in BN_mod_sqrt() reachable when parsing certificates (High)(CVE-2022-0778)

Node.js

Node.js 12.22.11 (LTS)
Affected versions
Not stated in this extraction
Fixed versions
12.22.11
Node.js 12.22.11 (LTS)
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2022-0778
CVE-2022-0778

Publisher severity

No explicit severity was extracted.

Event
#33699 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchHighFix availableNode.js announcements

OpenSSL security releases require Node.js security releases

Node.js updates for the 12.x, 14.x, 16.x, and 17.x release lines incorporate upstream OpenSSL security patches, including a fix for CVE-2022-0778.

Announced

Node.js · Fixed in v12.22.11, v14.19.1, v16.14.2, v17.7.2OpenSSL · Fixed in 3.0.2n, 1.1.1nCVE-2022-0778
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for v17.x, v16.x, v14.x, and v12.x Node.js release lines to incorporate upstream patches from OpenSSL.

Node.js

Node.js v12.22.11 (LTS)
Affected versions
17.x
Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines.
16.x
Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines.
14.x
Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines.
12.x
Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines.
Fixed versions
v12.22.11
Node.js v12.22.11 (LTS)
v14.19.1
Node.js v14.19.1 (LTS)
v16.14.2
Node.js v16.14.2 (LTS)
v17.7.2
Node.js v17.7.2 (Current)
Prerequisites
Not stated in this extraction

OpenSSL

Update to OpenSSL 3.0.2n and 1.1.1n
Affected versions
Not stated in this extraction
Fixed versions
3.0.2n
Update to OpenSSL 3.0.2n and 1.1.1n
1.1.1n
Update to OpenSSL 3.0.2n and 1.1.1n
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2022-0778
(High) (CVE-2022-0778) Infinite loop in BN_mod_sqrt() reachable when parsing certificates.

Publisher severity

high

The 17.x release line of Node.js is vulnerable to one High severity issue.
Event
#33187 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement