Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Upgrade to openssl-1.0.2i #8714

Closed
wants to merge 8 commits into from
Closed

Upgrade to openssl-1.0.2i #8714

wants to merge 8 commits into from

Conversation

shigeki
Copy link
Contributor

@shigeki shigeki commented Sep 22, 2016

Checklist
  • make -j4 test (UNIX), or vcbuild test nosign (Windows) passes
  • commit message follows commit guidelines
Affected core subsystem(s)

crypto, tls and https

Description of change
  • Upgrading openssl-1.0.2i with a procedure written in deps/openssl/doc/UPGRADING.md.
  • Asm files are also changed according to the openssl updates.
  • One additional fix of 65f2bf1 is needed in test/parallel/test-tls-no-sslv3.js because openssl-cli s_client changed its option checks due to openssl/openssl@e88a5cf.

CI is running on https://ci.nodejs.org/job/node-test-commit/5232/

CC: @indutny or @bnoordhuis

shigeki and others added 8 commits September 22, 2016 20:53
@shigeki
deps: upgrade openssl sources to 1.0.2i
6dfa78b 
This replaces all sources of openssl-1.0.2i.tar.gz into
deps/openssl/openssl
@shigeki
deps: copy all openssl header files to include dir
ed97a5b 
All symlink files in `deps/openssl/openssl/include/openssl/`
are removed and replaced with real header files to avoid
issues on Windows. Two files of opensslconf.h in crypto and
include dir are replaced to refer config/opensslconf.h.
@indutny @shigeki
deps: fix openssl assembly error on ia32 win32
a201015 
`x86masm.pl` was mistakenly using .486 instruction set, why `cpuid` (and
perhaps others) are requiring .686 .

Fixes: nodejs#589
PR-URL: nodejs#1389
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Ben Noordhuis <[email protected]>
Reviewed-By: Shigeki Ohtsu <[email protected]>
@shigeki
deps: fix asm build error of openssl in x86_win32
77b3da7 
See
https://mta.openssl.org/pipermail/openssl-dev/2015-February/000651.html

iojs needs to stop using masm and move to nasm or yasm on Win32.

Fixes: nodejs#589
PR-URL: nodejs#1389
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Ben Noordhuis <[email protected]>
@shigeki
openssl: fix keypress requirement in apps on win32
fa9cd1e 
Reapply b910613 .

Fixes: nodejs#589
PR-URL: nodejs#1389
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Ben Noordhuis <[email protected]>
@shigeki
deps: add -no_rand_screen to openssl s_client
7dfd230 
In openssl s_client on Windows, RAND_screen() is invoked to initialize
random state but it takes several seconds in each connection.
This added -no_rand_screen to openssl s_client on Windows to skip
RAND_screen() and gets a better performance in the unit test of
test-tls-server-verify.
Do not enable this except to use in the unit test.

Fixes: nodejs#1461
PR-URL: nodejs#1836
Reviewed-By: Ben Noordhuis <[email protected]>
@shigeki
deps: update openssl asm and asm_obsolete files
0d85496 
Regenerate asm files with Makefile and CC=gcc and ASM=gcc where
gcc-5.4.0. Also asm files in asm_obsolete dir to support old compiler
and assembler are regenerated without CC and ASM envs.
@shigeki
test: remove openssl options of -no_<prot>
65f2bf1 
openssl command does not allow to both "-ssl3" and "-no_tls1".
A protocol connecting to the server is only specified.
@nodejs-github-bot nodejs-github-bot added the openssl Issues and PRs related to the OpenSSL dependency. label Sep 22, 2016
@indutny
Copy link
Member

indutny commented Sep 22, 2016

Yikes, this was quick! Thank you!

@indutny
Copy link
Member

indutny commented Sep 22, 2016

CI: https://ci.nodejs.org/job/node-test-pull-request/4208/

@indutny
Copy link
Member

indutny commented Sep 22, 2016

LGTM

@jbergstroem
Copy link
Member

Fail looks unrelated on SmartOS:

not ok 1166 parallel/test-tick-processor-unknown
# TIMEOUT

@indutny
Copy link
Member

indutny commented Sep 22, 2016

@jbergstroem it is unrelated indeed.

@shigeki
Copy link
Contributor Author

shigeki commented Sep 22, 2016

Yes, thanks. I'm going to land them.

shigeki added a commit that referenced this pull request Sep 22, 2016
@shigeki
deps: upgrade openssl sources to 1.0.2i
d103970 
This replaces all sources of openssl-1.0.2i.tar.gz into
deps/openssl/openssl

PR-URL: #8714
Reviewed-By: Fedor Indutny <[email protected]>
shigeki added a commit that referenced this pull request Sep 22, 2016
@shigeki
deps: copy all openssl header files to include dir
aec7ed9 
All symlink files in `deps/openssl/openssl/include/openssl/`
are removed and replaced with real header files to avoid
issues on Windows. Two files of opensslconf.h in crypto and
include dir are replaced to refer config/opensslconf.h.

PR-URL: #8714
Reviewed-By: Fedor Indutny <[email protected]>
shigeki added a commit that referenced this pull request Sep 22, 2016
@shigeki
deps: update openssl asm and asm_obsolete files
c17a1fe 
Regenerate asm files with Makefile and CC=gcc and ASM=gcc where
gcc-5.4.0. Also asm files in asm_obsolete dir to support old compiler
and assembler are regenerated without CC and ASM envs.

PR-URL: #8714
Reviewed-By: Fedor Indutny <[email protected]>
shigeki added a commit that referenced this pull request Sep 22, 2016
@shigeki
test: remove openssl options of -no_<prot>
53835a2 
openssl command does not allow to both "-ssl3" and "-no_tls1".
A protocol connecting to the server is only specified.

PR-URL: #8714
Reviewed-By: Fedor Indutny <[email protected]>
@jbergstroem
Copy link
Member

LGTM

@shigeki
Copy link
Contributor Author

shigeki commented Sep 22, 2016

@jbergstroem Very sorry, I've just landed before having your LGTM. I missed your name to put in the commits.

Thanks, again. Landed in d103970, aec7ed9, da1d9bd, f427cac, ad0260a, 6a485bf, c17a1fe and 53835a2.

@shigeki shigeki closed this Sep 22, 2016
@MylesBorins
Copy link
Contributor

@shigeki are you planning to backport to v6 / v4? I can take the lead on that if you want to focus on the 1.0.1 update

@indutny
Copy link
Member

indutny commented Sep 22, 2016

We need to update OpenSSL in v0.10 too.

@shigeki
Copy link
Contributor Author

shigeki commented Sep 22, 2016

@thealphanerd Please do them for v6 and v4. I will submit PR for v0.12 soon.

MylesBorins pushed a commit to MylesBorins/node that referenced this pull request Sep 22, 2016
@shigeki
deps: upgrade openssl sources to 1.0.2i
e7fdace 
This replaces all sources of openssl-1.0.2i.tar.gz into
deps/openssl/openssl

PR-URL: nodejs#8714
Reviewed-By: Fedor Indutny <[email protected]>
MylesBorins pushed a commit to MylesBorins/node that referenced this pull request Sep 22, 2016
@shigeki
deps: copy all openssl header files to include dir
cbed5e6 
All symlink files in `deps/openssl/openssl/include/openssl/`
are removed and replaced with real header files to avoid
issues on Windows. Two files of opensslconf.h in crypto and
include dir are replaced to refer config/opensslconf.h.

PR-URL: nodejs#8714
Reviewed-By: Fedor Indutny <[email protected]>
MylesBorins pushed a commit to MylesBorins/node that referenced this pull request Sep 22, 2016
@shigeki
deps: update openssl asm and asm_obsolete files
8f3d676 
Regenerate asm files with Makefile and CC=gcc and ASM=gcc where
gcc-5.4.0. Also asm files in asm_obsolete dir to support old compiler
and assembler are regenerated without CC and ASM envs.

PR-URL: nodejs#8714
Reviewed-By: Fedor Indutny <[email protected]>
MylesBorins pushed a commit to MylesBorins/node that referenced this pull request Sep 22, 2016
@shigeki
test: remove openssl options of -no_<prot>
c7a601c 
openssl command does not allow to both "-ssl3" and "-no_tls1".
A protocol connecting to the server is only specified.

PR-URL: nodejs#8714
Reviewed-By: Fedor Indutny <[email protected]>
@MylesBorins MylesBorins mentioned this pull request Sep 22, 2016
Merged
2 tasks
MylesBorins pushed a commit to MylesBorins/node that referenced this pull request Sep 22, 2016
@shigeki
deps: upgrade openssl sources to 1.0.2i
8937fd0 
This replaces all sources of openssl-1.0.2i.tar.gz into
deps/openssl/openssl

PR-URL: nodejs#8714
Reviewed-By: Fedor Indutny <[email protected]>
MylesBorins pushed a commit to MylesBorins/node that referenced this pull request Sep 22, 2016
@shigeki
deps: copy all openssl header files to include dir
3e4ea60 
All symlink files in `deps/openssl/openssl/include/openssl/`
are removed and replaced with real header files to avoid
issues on Windows. Two files of opensslconf.h in crypto and
include dir are replaced to refer config/opensslconf.h.

PR-URL: nodejs#8714
Reviewed-By: Fedor Indutny <[email protected]>
MylesBorins pushed a commit to MylesBorins/node that referenced this pull request Sep 22, 2016
@shigeki
deps: update openssl asm and asm_obsolete files
2573efc 
Regenerate asm files with Makefile and CC=gcc and ASM=gcc where
gcc-5.4.0. Also asm files in asm_obsolete dir to support old compiler
and assembler are regenerated without CC and ASM envs.

PR-URL: nodejs#8714
Reviewed-By: Fedor Indutny <[email protected]>
MylesBorins pushed a commit to MylesBorins/node that referenced this pull request Sep 22, 2016
@shigeki
test: remove openssl options of -no_<prot>
a14d832 
openssl command does not allow to both "-ssl3" and "-no_tls1".
A protocol connecting to the server is only specified.

PR-URL: nodejs#8714
Reviewed-By: Fedor Indutny <[email protected]>
@MylesBorins MylesBorins mentioned this pull request Sep 22, 2016
Merged
2 tasks
rvagg added a commit that referenced this pull request Sep 28, 2016
@rvagg
2016-09-27, Version 4.6.0 'Argon' (LTS)
eba39c4 
This is a security release. All Node.js users should consult the
security release summary at
https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
for details on patched vulnerabilities.

Notable Changes

Semver Minor:

* openssl:
  - Upgrade to 1.0.2i, fixes a number of defects impacting Node.js:
    CVE-2016-6304 ("OCSP Status Request extension unbounded memory
    growth", high severity), CVE-2016-2183, CVE-2016-6303,
    CVE-2016-2178 and CVE-2016-6306.
    (Shigeki Ohtsu) #8714
  - Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in
    a crash when using CRLs, CVE-2016-7052.
    (Shigeki Ohtsu) #8786
  - Remove support for loading dynamic third-party engine modules.
    An attacker may be able to hide malicious code to be inserted into
    Node.js at runtime by masquerading as one of the dynamic engine
    modules. Originally reported by Ahmed Zaki (Skype).
    (Ben Noordhuis) nodejs-private/node-private#70
* http: CVE-2016-5325 - Properly validate for allowable characters in
  the `reason` argument in `ServerResponse#writeHead()`. Fixes a
  possible response splitting attack vector. This introduces a new
  case where `throw` may occur when configuring HTTP responses, users
  should already be adopting try/catch here. Originally reported
  independently by Evan Lucas and Romain Gaucher.
  (Evan Lucas) nodejs-private/node-private#46

Semver Patch:

* buffer: Zero-fill excess bytes in new `Buffer` objects created with
  `Buffer.concat()` while providing a `totalLength` parameter that
  exceeds the total length of the original `Buffer` objects being
  concatenated.
  (Сковорода Никита Андреевич) nodejs-private/node-private#65
* tls: CVE-2016-7099 - Fix invalid wildcard certificate validation
  check whereby a TLS server may be able to serve an invalid wildcard
  certificate for its hostname due to improper validation of `*.` in
  the wildcard string. Originally reported by Alexander Minozhenko and
  James Bunton (Atlassian).
  (Ben Noordhuis) nodejs-private/node-private#63

PR-URL: nodejs-private/node-private#74
evanlucas added a commit that referenced this pull request Sep 28, 2016
@evanlucas
2016-09-27, Version 6.7.0 (Current)
aae1862 
This is a security release. All Node.js users should consult the
security release summary at
https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
for details on patched vulnerabilities.

Notable Changes

Semver Minor:

* openssl:
  - Upgrade to 1.0.2i, fixes a number of defects impacting Node.js:
    CVE-2016-6304 ("OCSP Status Request extension unbounded memory
    growth", high severity), CVE-2016-2183, CVE-2016-2178, and CVE-2016-6306.
    (Shigeki Ohtsu) #8714
  - Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in
    a crash when using CRLs, CVE-2016-7052.
    (Shigeki Ohtsu) #8786
  - Remove support for loading dynamic third-party engine modules.
    An attacker may be able to hide malicious code to be inserted
    into Node.js at runtime by masquerading as one of the dynamic
    engine modules. Originally reported by Ahmed Zaki (Skype).
    (Ben Noordhuis) https://github.com/nodejs/node-private/pull/73
* http: CVE-2016-5325 - Properly validate for allowable characters in
  the `reason` argument in `ServerResponse#writeHead()`. Fixes a
  possible response splitting attack vector. This introduces a new
  case where `throw` may occur when configuring HTTP responses, users
  should already be adopting try/catch here. Originally reported
  independently by Evan Lucas and Romain Gaucher.
  (Evan Lucas) https://github.com/nodejs/node-private/pull/60

Semver Patch:

* buffer: Zero-fill excess bytes in new `Buffer` objects created with
  `Buffer.concat()` while providing a `totalLength` parameter that
  exceeds the total length of the original `Buffer` objects being
  concatenated.
  (Сковорода Никита Андреевич) https://github.com/nodejs/node-private/pull/64
* src: Fix regression where passing an empty password and/or salt to
  crypto.pbkdf2() would cause a fatal error
  (Rich Trott) #8572
* tls: CVE-2016-7099 - Fix invalid wildcard certificate validation
  check whereby a TLS server may be able to serve an invalid wildcard
  certificate for its hostname due to improper validation of `*.` in the
  wildcard string. Originally reported by Alexander Minozhenko and
  James Bunton (Atlassian).
  (Ben Noordhuis) https://github.com/nodejs/node-private/pull/75
* v8: Fix regression where a regex on a frozen object was broken
  (Myles Borins) #8673
@MylesBorins MylesBorins added the semver-minor PRs that contain new features and should be released in the next minor version. label Sep 28, 2016
imyller added a commit to imyller/meta-nodejs that referenced this pull request Sep 28, 2016
@imyller
2016-09-27, Version 4.6.0 'Argon' (LTS)
8af8860 
    This is a security release. All Node.js users should consult the
    security release summary at
    https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
    for details on patched vulnerabilities.

    Notable Changes

    Semver Minor:

    * openssl:
      - Upgrade to 1.0.2i, fixes a number of defects impacting Node.js:
        CVE-2016-6304 ("OCSP Status Request extension unbounded memory
        growth", high severity), CVE-2016-2183, CVE-2016-6303,
        CVE-2016-2178 and CVE-2016-6306.
        (Shigeki Ohtsu) nodejs/node#8714
      - Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in
        a crash when using CRLs, CVE-2016-7052.
        (Shigeki Ohtsu) nodejs/node#8786
      - Remove support for loading dynamic third-party engine modules.
        An attacker may be able to hide malicious code to be inserted into
        Node.js at runtime by masquerading as one of the dynamic engine
        modules. Originally reported by Ahmed Zaki (Skype).
        (Ben Noordhuis) https://github.com/nodejs/node-private/pull/70
    * http: CVE-2016-5325 - Properly validate for allowable characters in
      the `reason` argument in `ServerResponse#writeHead()`. Fixes a
      possible response splitting attack vector. This introduces a new
      case where `throw` may occur when configuring HTTP responses, users
      should already be adopting try/catch here. Originally reported
      independently by Evan Lucas and Romain Gaucher.
      (Evan Lucas) https://github.com/nodejs/node-private/pull/46

    Semver Patch:

    * buffer: Zero-fill excess bytes in new `Buffer` objects created with
      `Buffer.concat()` while providing a `totalLength` parameter that
      exceeds the total length of the original `Buffer` objects being
      concatenated.
      https://github.com/nodejs/node-private/pull/65
    * tls: CVE-2016-7099 - Fix invalid wildcard certificate validation
      check whereby a TLS server may be able to serve an invalid wildcard
      certificate for its hostname due to improper validation of `*.` in
      the wildcard string. Originally reported by Alexander Minozhenko and
      James Bunton (Atlassian).
      (Ben Noordhuis) https://github.com/nodejs/node-private/pull/63

Signed-off-by: Ilkka Myller <[email protected]>
imyller added a commit to imyller/meta-nodejs that referenced this pull request Sep 28, 2016
@imyller
2016-09-27, Version 6.7.0 (Current)
d3326b5 
    This is a security release. All Node.js users should consult the
    security release summary at
    https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
    for details on patched vulnerabilities.

    Notable Changes

    Semver Minor:

    * openssl:
      - Upgrade to 1.0.2i, fixes a number of defects impacting Node.js:
        CVE-2016-6304 ("OCSP Status Request extension unbounded memory
        growth", high severity), CVE-2016-2183, CVE-2016-2178, and CVE-2016-6306.
        (Shigeki Ohtsu) nodejs/node#8714
      - Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in
        a crash when using CRLs, CVE-2016-7052.
        (Shigeki Ohtsu) nodejs/node#8786
      - Remove support for loading dynamic third-party engine modules.
        An attacker may be able to hide malicious code to be inserted
        into Node.js at runtime by masquerading as one of the dynamic
        engine modules. Originally reported by Ahmed Zaki (Skype).
        (Ben Noordhuis) https://github.com/nodejs/node-private/pull/73
    * http: CVE-2016-5325 - Properly validate for allowable characters in
      the `reason` argument in `ServerResponse#writeHead()`. Fixes a
      possible response splitting attack vector. This introduces a new
      case where `throw` may occur when configuring HTTP responses, users
      should already be adopting try/catch here. Originally reported
      independently by Evan Lucas and Romain Gaucher.
      (Evan Lucas) https://github.com/nodejs/node-private/pull/60

    Semver Patch:

    * buffer: Zero-fill excess bytes in new `Buffer` objects created with
      `Buffer.concat()` while providing a `totalLength` parameter that
      exceeds the total length of the original `Buffer` objects being
      concatenated.
      https://github.com/nodejs/node-private/pull/64
    * src: Fix regression where passing an empty password and/or salt to
      crypto.pbkdf2() would cause a fatal error
      (Rich Trott) nodejs/node#8572
    * tls: CVE-2016-7099 - Fix invalid wildcard certificate validation
      check whereby a TLS server may be able to serve an invalid wildcard
      certificate for its hostname due to improper validation of `*.` in the
      wildcard string. Originally reported by Alexander Minozhenko and
      James Bunton (Atlassian).
      (Ben Noordhuis) https://github.com/nodejs/node-private/pull/75
    * v8: Fix regression where a regex on a frozen object was broken
      (Myles Borins) nodejs/node#8673

Signed-off-by: Ilkka Myller <[email protected]>
imyller added a commit to imyller/meta-nodejs that referenced this pull request Sep 28, 2016
@imyller
2016-09-27, Version 4.6.0 'Argon' (LTS)
99721d4 
    This is a security release. All Node.js users should consult the
    security release summary at
    https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
    for details on patched vulnerabilities.

    Notable Changes

    Semver Minor:

    * openssl:
      - Upgrade to 1.0.2i, fixes a number of defects impacting Node.js:
        CVE-2016-6304 ("OCSP Status Request extension unbounded memory
        growth", high severity), CVE-2016-2183, CVE-2016-6303,
        CVE-2016-2178 and CVE-2016-6306.
        (Shigeki Ohtsu) nodejs/node#8714
      - Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in
        a crash when using CRLs, CVE-2016-7052.
        (Shigeki Ohtsu) nodejs/node#8786
      - Remove support for loading dynamic third-party engine modules.
        An attacker may be able to hide malicious code to be inserted into
        Node.js at runtime by masquerading as one of the dynamic engine
        modules. Originally reported by Ahmed Zaki (Skype).
        (Ben Noordhuis) https://github.com/nodejs/node-private/pull/70
    * http: CVE-2016-5325 - Properly validate for allowable characters in
      the `reason` argument in `ServerResponse#writeHead()`. Fixes a
      possible response splitting attack vector. This introduces a new
      case where `throw` may occur when configuring HTTP responses, users
      should already be adopting try/catch here. Originally reported
      independently by Evan Lucas and Romain Gaucher.
      (Evan Lucas) https://github.com/nodejs/node-private/pull/46

    Semver Patch:

    * buffer: Zero-fill excess bytes in new `Buffer` objects created with
      `Buffer.concat()` while providing a `totalLength` parameter that
      exceeds the total length of the original `Buffer` objects being
      concatenated.
      https://github.com/nodejs/node-private/pull/65
    * tls: CVE-2016-7099 - Fix invalid wildcard certificate validation
      check whereby a TLS server may be able to serve an invalid wildcard
      certificate for its hostname due to improper validation of `*.` in
      the wildcard string. Originally reported by Alexander Minozhenko and
      James Bunton (Atlassian).
      (Ben Noordhuis) https://github.com/nodejs/node-private/pull/63

Signed-off-by: Ilkka Myller <[email protected]>
imyller added a commit to imyller/meta-nodejs that referenced this pull request Sep 28, 2016
@imyller
2016-09-27, Version 6.7.0 (Current)
cdd99db 
    This is a security release. All Node.js users should consult the
    security release summary at
    https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
    for details on patched vulnerabilities.

    Notable Changes

    Semver Minor:

    * openssl:
      - Upgrade to 1.0.2i, fixes a number of defects impacting Node.js:
        CVE-2016-6304 ("OCSP Status Request extension unbounded memory
        growth", high severity), CVE-2016-2183, CVE-2016-2178, and CVE-2016-6306.
        (Shigeki Ohtsu) nodejs/node#8714
      - Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in
        a crash when using CRLs, CVE-2016-7052.
        (Shigeki Ohtsu) nodejs/node#8786
      - Remove support for loading dynamic third-party engine modules.
        An attacker may be able to hide malicious code to be inserted
        into Node.js at runtime by masquerading as one of the dynamic
        engine modules. Originally reported by Ahmed Zaki (Skype).
        (Ben Noordhuis) https://github.com/nodejs/node-private/pull/73
    * http: CVE-2016-5325 - Properly validate for allowable characters in
      the `reason` argument in `ServerResponse#writeHead()`. Fixes a
      possible response splitting attack vector. This introduces a new
      case where `throw` may occur when configuring HTTP responses, users
      should already be adopting try/catch here. Originally reported
      independently by Evan Lucas and Romain Gaucher.
      (Evan Lucas) https://github.com/nodejs/node-private/pull/60

    Semver Patch:

    * buffer: Zero-fill excess bytes in new `Buffer` objects created with
      `Buffer.concat()` while providing a `totalLength` parameter that
      exceeds the total length of the original `Buffer` objects being
      concatenated.
      https://github.com/nodejs/node-private/pull/64
    * src: Fix regression where passing an empty password and/or salt to
      crypto.pbkdf2() would cause a fatal error
      (Rich Trott) nodejs/node#8572
    * tls: CVE-2016-7099 - Fix invalid wildcard certificate validation
      check whereby a TLS server may be able to serve an invalid wildcard
      certificate for its hostname due to improper validation of `*.` in the
      wildcard string. Originally reported by Alexander Minozhenko and
      James Bunton (Atlassian).
      (Ben Noordhuis) https://github.com/nodejs/node-private/pull/75
    * v8: Fix regression where a regex on a frozen object was broken
      (Myles Borins) nodejs/node#8673

Signed-off-by: Ilkka Myller <[email protected]>
jasnell pushed a commit that referenced this pull request Sep 29, 2016
@shigeki @jasnell
deps: upgrade openssl sources to 1.0.2i
ea31f50 
This replaces all sources of openssl-1.0.2i.tar.gz into
deps/openssl/openssl

PR-URL: #8714
Reviewed-By: Fedor Indutny <[email protected]>
jasnell pushed a commit that referenced this pull request Sep 29, 2016
@shigeki @jasnell
deps: copy all openssl header files to include dir
5df6ed1 
All symlink files in `deps/openssl/openssl/include/openssl/`
are removed and replaced with real header files to avoid
issues on Windows. Two files of opensslconf.h in crypto and
include dir are replaced to refer config/opensslconf.h.

PR-URL: #8714
Reviewed-By: Fedor Indutny <[email protected]>
jasnell pushed a commit that referenced this pull request Sep 29, 2016
@shigeki @jasnell
deps: update openssl asm and asm_obsolete files
1ac9e28 
Regenerate asm files with Makefile and CC=gcc and ASM=gcc where
gcc-5.4.0. Also asm files in asm_obsolete dir to support old compiler
and assembler are regenerated without CC and ASM envs.

PR-URL: #8714
Reviewed-By: Fedor Indutny <[email protected]>
jasnell pushed a commit that referenced this pull request Sep 29, 2016
@shigeki @jasnell
test: remove openssl options of -no_<prot>
d5c8a6b 
openssl command does not allow to both "-ssl3" and "-no_tls1".
A protocol connecting to the server is only specified.

PR-URL: #8714
Reviewed-By: Fedor Indutny <[email protected]>
jasnell pushed a commit that referenced this pull request Oct 10, 2016
@evanlucas @jasnell
2016-09-27, Version 6.7.0 (Current)
cc2e7db 
This is a security release. All Node.js users should consult the
security release summary at
https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/
for details on patched vulnerabilities.

Notable Changes

Semver Minor:

* openssl:
  - Upgrade to 1.0.2i, fixes a number of defects impacting Node.js:
    CVE-2016-6304 ("OCSP Status Request extension unbounded memory
    growth", high severity), CVE-2016-2183, CVE-2016-2178, and CVE-2016-6306.
    (Shigeki Ohtsu) #8714
  - Upgrade to 1.0.2j, fixes a defect included in 1.0.2i resulting in
    a crash when using CRLs, CVE-2016-7052.
    (Shigeki Ohtsu) #8786
  - Remove support for loading dynamic third-party engine modules.
    An attacker may be able to hide malicious code to be inserted
    into Node.js at runtime by masquerading as one of the dynamic
    engine modules. Originally reported by Ahmed Zaki (Skype).
    (Ben Noordhuis) nodejs-private/node-private#73
* http: CVE-2016-5325 - Properly validate for allowable characters in
  the `reason` argument in `ServerResponse#writeHead()`. Fixes a
  possible response splitting attack vector. This introduces a new
  case where `throw` may occur when configuring HTTP responses, users
  should already be adopting try/catch here. Originally reported
  independently by Evan Lucas and Romain Gaucher.
  (Evan Lucas) nodejs-private/node-private#60

Semver Patch:

* buffer: Zero-fill excess bytes in new `Buffer` objects created with
  `Buffer.concat()` while providing a `totalLength` parameter that
  exceeds the total length of the original `Buffer` objects being
  concatenated.
  (Сковорода Никита Андреевич) nodejs-private/node-private#64
* src: Fix regression where passing an empty password and/or salt to
  crypto.pbkdf2() would cause a fatal error
  (Rich Trott) #8572
* tls: CVE-2016-7099 - Fix invalid wildcard certificate validation
  check whereby a TLS server may be able to serve an invalid wildcard
  certificate for its hostname due to improper validation of `*.` in the
  wildcard string. Originally reported by Alexander Minozhenko and
  James Bunton (Atlassian).
  (Ben Noordhuis) nodejs-private/node-private#75
* v8: Fix regression where a regex on a frozen object was broken
  (Myles Borins) #8673
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@indutny indutny indutny approved these changes

Assignees
No one assigned
Labels
openssl Issues and PRs related to the OpenSSL dependency. semver-minor PRs that contain new features and should be released in the next minor version.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@shigeki @indutny @jbergstroem @MylesBorins @nodejs-github-bot