-
-
Notifications
You must be signed in to change notification settings - Fork 14.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Nodejs: Minor updates #31494
Closed
Closed
Nodejs: Minor updates #31494
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
c0bw3b
added
1.severity: security
Issues which raise a security issue, or PRs that fix one
8.has: package (update)
This PR updates a package to a newer version
labels
Nov 10, 2017
@adisbladis in your opinion, does this needs backporting to 17.09 ? |
Our expressions look like we use system openssl instead of the builtin one, meaning this update probably wouldn't have security impact. |
disassembler
removed
the
1.severity: security
Issues which raise a security issue, or PRs that fix one
label
Nov 10, 2017
ccing maintainers @cillianderoiste @Havvy @gilligan @cko |
adisbladis
force-pushed
the
nodejs-CVE-2017-3736
branch
from
November 15, 2017 15:52
653fd51
to
ee7c006
Compare
There is a new release of
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
8.has: package (update)
This PR updates a package to a newer version
10.rebuild-darwin: 1-10
10.rebuild-darwin: 501+
10.rebuild-linux: 1-10
10.rebuild-linux: 501+
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation for this change
Fix for CVE-2017-3736.From upstream PR nodejs/node#16691This upgrades to OpenSSL-1.0.2m . It includes the fix of the moderate severity of CVE-2017-3736 that affects Node in RSA calculations of TLS and crypto modules but the attack is said to be very difficult.Edit: As @vcunat points out we are already using the system
OpenSSL
so it does not have any security impact. This is just a normal update.Things done
build-use-sandbox
innix.conf
on non-NixOS)nix-shell -p nox --run "nox-review wip"
./result/bin/
)