Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

doc: mar-2022 OpenSSL security pre-release announcement #4487

Merged
merged 4 commits into from
Mar 14, 2022
Merged

doc: mar-2022 OpenSSL security pre-release announcement #4487

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2ddaccd
doc: mar-2022 OpenSSL security pre-release announcement
joesepi Mar 14, 2022
d11bc66
Update locale/en/blog/vulnerability/mar-2022-security-releases.md
Trott Mar 14, 2022
c38fc2a
Merge branch 'main' into patch-4
Trott Mar 14, 2022
c6b82f4
Merge branch 'main' into patch-4
Trott Mar 14, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 50 additions & 0 deletions locale/en/blog/vulnerability/mar-2022-security-releases.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
---
date: 2022-03-14T12:00:00.000Z
category: vulnerability
title: OpenSSL security releases may require Node.js security releases
slug: openssl-and-high-severity-fixes-mar-2022
layout: blog-post.hbs
author: Joe Sepi
---

### Summary

The Node.js project may be releasing new versions across all of its supported
release lines late next week to incorporate upstream patches from OpenSSL.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we were planning for late this week? (It was "next week" last week when we were having the discussions.)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll open a PR to fix that. Sorry about the auto-merge.

Please read on for full details.

### OpenSSL

The OpenSSL project
[announced](https://mta.openssl.org/pipermail/openssl-announce/2022-March/000216.html)
this week that they will be releasing versions 3.0.2 and 1.1.1n on the 15th of
March 2022 between 1300-1700 UTC. The releases will fix two security defects that are
labelled as "HIGH" severity under their
[security policy](https://www.openssl.org/policies/secpolicy.html).

Node.js v12.x, v14.x and v16.x use OpenSSL v1.1.1 and Node.js v17.x uses OpenSSL
v3, therefore all active release lines are impacted by this update.
Trott marked this conversation as resolved.
Show resolved Hide resolved

At this stage, due to embargo, the exact nature of these defects is uncertain
as well as the impact they will have on Node.js users.

After assessing the impact on Node.js, it will be decided whether the issues
fixed require immediate security releases of Node.js, or whether they can be
included in the normally scheduled updates.

Please monitor the **nodejs-sec** Google Group for updates, including a
decision within 24 hours after the OpenSSL release regarding release timing,
and full details of the defects upon eventual release:
https://groups.google.com/forum/#!forum/nodejs-sec

### Contact and future updates

The current Node.js security policy can be found at
<https://github.com/nodejs/node/blob/HEAD/SECURITY.md#security>,
including information on how to report a vulnerability in Node.js.

Subscribe to the low-volume announcement-only **nodejs-sec** mailing list at
https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on
security vulnerabilities and security-related releases of Node.js and the
projects maintained in the
[nodejs GitHub organization](https://github.com/nodejs).