HighFix available
OpenSSL updates, 1.0.1t and 1.0.2h
Node.js released updated versions across its active release lines incorporating OpenSSL security updates. The announcement identifies affected Node.js versions and says users should upgrade to the listed releases.
Announced Source revision 1
Original source ↗nodejs
Primary source · Revision 1
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
The following releases have been made available to include the security updates to OpenSSL discussed in the post below. Please upgrade your Node.js installation as soon as possible in order to be protected against the disclosed vulnerabilities.
Node.js
Node.js v0.10 and v0.12 both use OpenSSL v1.0.1 and Node.js v4, v5 and v6 use OpenSSL v1.0.2
- Affected versions
- v0.10
Node.js v0.10 and v0.12 both use OpenSSL v1.0.1
v0.12Node.js v0.10 and v0.12 both use OpenSSL v1.0.1
v4Node.js v4, v5 and v6 use OpenSSL v1.0.2
v5Node.js v4, v5 and v6 use OpenSSL v1.0.2
v6Node.js v4, v5 and v6 use OpenSSL v1.0.2
- Fixed versions
- v6.1.0
Node v6.1.0 (Current): /blog/release/v6.1.0/
v5.11.1Node v5.11.1: /blog/release/v5.11.1/
v4.4.4Node v4.4.4 (LTS): /blog/release/v4.4.4/
v0.12.14Node v0.12.14 (Maintenance): /blog/release/v0.12.14/
v0.10.45Node v0.10.45 (Maintenance): /blog/release/v0.10.45/
- Prerequisites
- Not stated in this extraction
OpenSSL
The OpenSSL project has announced that they will be releasing versions 1.0.1t and 1.0.2h this week
- Affected versions
- Not stated in this extraction
- Fixed versions
- 1.0.1t
The OpenSSL project has announced that they will be releasing versions 1.0.1t and 1.0.2h this week
1.0.2hThe OpenSSL project has announced that they will be releasing versions 1.0.1t and 1.0.2h this week
- Prerequisites
- Not stated in this extraction
- Related CVEs
- CVE-2016-2107
CVE-2016-2107: Padding oracle in AES-NI CBC MAC check
CVE-2016-2105CVE-2016-2105: EVP_EncodeUpdate overflow
CVE-2016-2108CVE-2016-2108: Memory corruption in the ASN.1 encoder
CVE-2016-2106CVE-2016-2106: EVP_EncryptUpdate overflow
CVE-2016-2109CVE-2016-2109: ASN.1 BIO excessive memory allocation (CVE-2016-2109)
CVE-2016-2176CVE-2016-2176: EBCDIC overread
Publisher severity
high
The OpenSSL project has labelled this vulnerability high severity.
- Event
- #65630 · Revision 1
- Added to Heist Feed
- Publisher date