Heist/ feed

Security feed

patchSecurity fix · UnratedNode.js announcements

Node.js 6.17.0 (LTS)

Node.js 6.17.0 is a security release that patches HTTP keep-alive denial-of-service issues and includes an OpenSSL update addressing a padding-oracle vulnerability.

Announced

Node.js · Fixed in 6.17.0OpenSSL · Fixed in 1.0.2rCVE-2019-5739CVE-2019-5737CVE-2019-1559
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release. All Node.js users should consult the security release summary

Node.js

Node.js 6.17.0 (LTS)
Affected versions
Not stated in this extraction
Fixed versions
6.17.0
Node.js 6.17.0 (LTS)
Prerequisites
Not stated in this extraction

OpenSSL

OpenSSL: 0-byte record padding oracle (CVE-2019-1559)
Affected versions
Not stated in this extraction
Fixed versions
1.0.2r
OpenSSL has been upgraded to 1.0.2r
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2019-5739
CVE-2019-5739
CVE-2019-5737
CVE-2019-5737
CVE-2019-1559
CVE-2019-1559

Publisher severity

No explicit severity was extracted.

Event
#51190 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

Node.js 8.15.1 (LTS)

Node.js 8.15.1 is a security release that addresses Slowloris HTTP denial of service and includes OpenSSL 1.0.2r, which fixes a padding-oracle vulnerability.

Announced

Node.js · Fixed in 8.15.1OpenSSL · Fixed in 1.0.2rCVE-2019-5737CVE-2019-1559
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

This is a security release. All Node.js users should consult the security release summary at /blog/vulnerability/february-2019-security-releases/ for details on patched vulnerabilities.

Node.js

Node.js 8.15.1 (LTS)
Affected versions
Not stated in this extraction
Fixed versions
8.15.1
Node.js 8.15.1 (LTS)
Prerequisites
Not stated in this extraction

OpenSSL

OpenSSL: 0-byte record padding oracle (CVE-2019-1559)
Affected versions
Not stated in this extraction
Fixed versions
1.0.2r
OpenSSL has been upgraded to 1.0.2r which contains a fix for CVE-2019-1559.
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2019-5737
Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)
CVE-2019-1559
OpenSSL: 0-byte record padding oracle (CVE-2019-1559)

Publisher severity

No explicit severity was extracted.

Event
#50870 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

February 2019 Security Releases

Security releases address Node.js denial-of-service vulnerabilities and update OpenSSL in Node.js 6 and 8. The Misinterpretation of Input fix was withheld.

Announced

Node.js · Fixed in Node.js 11.10.1, Node.js 10.15.2, Node.js 8.15.1, Node.js 6.17.0OpenSSL · Fixed in OpenSSL 1.0.2rCVE-2019-5737CVE-2019-5739CVE-2019-1559
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for all active Node.js release lines.

Node.js

Node.js 11.10.1 (Current)
Affected versions
All versions of Node.js 6 (LTS "Boron")
All versions of Node.js 6 (LTS "Boron") are vulnerable
All versions of Node.js 8 (LTS "Carbon")
All versions of Node.js 8 (LTS "Carbon") are vulnerable
All versions of Node.js 10 (LTS "Dubnium")
All versions of Node.js 10 (LTS "Dubnium") are vulnerable
All versions of Node.js 11 (Current)
All versions of Node.js 11 (Current) are vulnerable
Fixed versions
Node.js 11.10.1
Node.js 11.10.1 (Current)
Node.js 10.15.2
Node.js 10.15.2 (LTS "Dubnium")
Node.js 8.15.1
Node.js 8.15.1 (LTS "Carbon")
Node.js 6.17.0
Node.js 6.17.0 (LTS "Boron")
Prerequisites
Not stated in this extraction

OpenSSL

OpenSSL 1.0.2r contains a fix for CVE-2019-1559
Affected versions
OpenSSL 1.0.2
The highest severity indicated by OpenSSL is 'moderate' and impacts OpenSSL 1.0.2
Fixed versions
OpenSSL 1.0.2r
OpenSSL 1.0.2r contains a fix for CVE-2019-1559
Prerequisites
included in the releases for Node.js versions 6 and 8 only
OpenSSL 1.0.2r contains a fix for CVE-2019-1559 and is included in the releases for Node.js versions 6 and 8 only.
Related CVEs
CVE-2019-5737
Node.js: Slowloris HTTP Denial of Service with keep-alive (CVE-2019-5737)
CVE-2019-5739
Node.js: Denial of Service with keep-alive HTTP connections (CVE-2019-5739)
CVE-2019-1559
OpenSSL 1.0.2r contains a fix for CVE-2019-1559

Publisher severity

No explicit severity was extracted.

Event
#50634 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
advisorySecurity fix · UnratedNode.js announcements

OpenSSL security releases may require Node.js security releases

OpenSSL planned security releases affecting versions used by Node.js active release lines. The Node.js project had not yet determined whether immediate Node.js security releases were needed.

Announced

Node.jsOpenSSL · Fixed in 1.0.2t, 1.1.1d
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

The Node.js project may be releasing new versions across all of its supported release lines early next week to incorporate upstream patches from OpenSSL.

Node.js

Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update.
Affected versions
v8.x
Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update.
v10.x
Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update.
v12.x
Node.js v8.x use OpenSSL v1.0.2 and Node.js v10.x and v12.x both use OpenSSL v1.1.1, therefore all active release lines are impacted by this update.
Fixed versions
Not stated in this extraction
Prerequisites
Not stated in this extraction

OpenSSL

The OpenSSL project announced this week that they will be releasing versions 1.0.2t and 1.1.1d on the 10th of September, UTC.
Affected versions
Not stated in this extraction
Fixed versions
1.0.2t
The OpenSSL project announced this week that they will be releasing versions 1.0.2t and 1.1.1d on the 10th of September, UTC.
1.1.1d
The OpenSSL project announced this week that they will be releasing versions 1.0.2t and 1.1.1d on the 10th of September, UTC.
Prerequisites
Not stated in this extraction

Publisher severity

No explicit severity was extracted.

Event
#48097 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchSecurity fix · UnratedNode.js announcements

January 2021 Security Releases

Node.js security releases address multiple vulnerabilities across supported release lines, including TLS use-after-free, HTTP request smuggling, and an OpenSSL issue. Updates are available for the listed Node.js versions.

Announced

Node.js · Fixed in Node.js v10.23.1 (LTS), Node.js v12.20.1 (LTS), Node.js v14.15.4 (LTS), Node.js v15.5.1 (Current)OpenSSLCVE-2020-8265CVE-2020-8287CVE-2020-1971
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Security releases available Updates are now available for v10,x, v12.x, v14.x and v15.x Node.js release lines for the following issues.

Node.js

Node.js v10.23.1 (LTS)
Affected versions
All versions of the 15.x, 14.x, 12.x and 10.x releases lines
Impacts: All versions of the 15.x, 14.x, 12.x and 10.x releases lines
Fixed versions
Node.js v10.23.1 (LTS)
Node.js v10.23.1 (LTS)
Node.js v12.20.1 (LTS)
Node.js v12.20.1 (LTS)
Node.js v14.15.4 (LTS)
Node.js v14.15.4 (LTS)
Node.js v15.5.1 (Current)
Node.js v15.5.1 (Current)
Prerequisites
Not stated in this extraction

OpenSSL

OpenSSL - EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)
Affected versions
All versions of the 14.x, 12.x and 10.x release lines
Impacts: All versions of the 14.x, 12.x and 10.x release lines
Versions of the 15.x line before 15.5.0
Versions of the 15.x line before 15.5.0 which included an update to the latest OpenSSL.
Fixed versions
Not stated in this extraction
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2020-8265
use-after-free in TLSWrap (High) (CVE-2020-8265)
CVE-2020-8287
HTTP Request Smuggling in nodejs (Low) (CVE-2020-8287)
CVE-2020-1971
OpenSSL - EDIPARTYNAME NULL pointer de-reference (CVE-2020-1971)

Publisher severity

No explicit severity was extracted.

Event
#41324 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
patchHighFix availableNode.js announcements

OpenSSL security releases require Node.js security releases

Node.js updates for the 12.x, 14.x, 16.x, and 17.x release lines incorporate upstream OpenSSL security patches, including a fix for CVE-2022-0778.

Announced

Node.js · Fixed in v12.22.11, v14.19.1, v16.14.2, v17.7.2OpenSSL · Fixed in 3.0.2n, 1.1.1nCVE-2022-0778
Machine-extracted · Revision 1Original source
Evidence and details

These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.

Security context

Updates are now available for v17.x, v16.x, v14.x, and v12.x Node.js release lines to incorporate upstream patches from OpenSSL.

Node.js

Node.js v12.22.11 (LTS)
Affected versions
17.x
Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines.
16.x
Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines.
14.x
Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines.
12.x
Impacts: All versions of the 17.x, 16.x, 14.x, and 12.x releases lines.
Fixed versions
v12.22.11
Node.js v12.22.11 (LTS)
v14.19.1
Node.js v14.19.1 (LTS)
v16.14.2
Node.js v16.14.2 (LTS)
v17.7.2
Node.js v17.7.2 (Current)
Prerequisites
Not stated in this extraction

OpenSSL

Update to OpenSSL 3.0.2n and 1.1.1n
Affected versions
Not stated in this extraction
Fixed versions
3.0.2n
Update to OpenSSL 3.0.2n and 1.1.1n
1.1.1n
Update to OpenSSL 3.0.2n and 1.1.1n
Prerequisites
Not stated in this extraction
Related CVEs
CVE-2022-0778
(High) (CVE-2022-0778) Infinite loop in BN_mod_sqrt() reachable when parsing certificates.

Publisher severity

high

The 17.x release line of Node.js is vulnerable to one High severity issue.
Event
#33187 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement