Unrated
OpenSSL upgrade low-severity Node.js security fixes
Node.js announced planned security releases for active release lines, covering upstream OpenSSL updates and HTTP-processing fixes. The announcement lists affected versions but does not provide fixed versions.
Announced Source revision 1
Original source ↗nodejs
Primary source · Revision 1
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
The Node.js project will be releasing new versions across all of its active release lines early next week (possibly sooner, pending full impact assessment) to incorporate upstream patches from OpenSSL and some additional low-severity fixes relating to HTTP handling.
Node.js
Versions 0.10.x of Node.js are affected.
- Affected versions
- 0.10.x
Versions 0.10.x of Node.js are affected.
0.12.xVersions 0.12.x of Node.js are affected.
4.xVersions 4.x, including LTS Argon, of Node.js are affected.
5.xVersions 5.x of Node.js are affected.
- Fixed versions
- Not stated in this extraction
- Prerequisites
- unless the --enable-ssl2 command line argument is being used (not recommended).
Node.js v0.10 and v0.12 disable SSLv2 by default and are not affected unless the --enable-ssl2 command line argument is being used (not recommended).
- Related CVEs
- CVE-2016-0701
DH small subgroups (CVE-2016-0701)
CVE-2015-3197SSLv2 doesn't block disabled ciphers (CVE-2015-3197)
Publisher severity
No explicit severity was extracted.
- Event
- #69689 · Revision 1
- Added to Heist Feed
- Publisher date