=====================================================================

                               CERT-Renater

                     Note d'Information No. 2021/VULN121
_____________________________________________________________________

DATE                : 18/03/2022

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Node.js versions prior to
       12.22.11 (LTS), 14.19.1 (LTS), 16.14.2 (LTS), 17.7.2 (Current).

===================================================================== 
https://nodejs.org/en/blog/vulnerability/mar-2022-security-releases/
_____________________________________________________________________

OpenSSL security releases require Node.js security releases
by Joe Sepi, 2022-03-18
(Update 18-Mar-2022) Security releases available

Updates are now available for v17.x, v16.x, v14.x, and v12.x Node.js 
release lines to incorporate upstream patches from OpenSSL.

Update to OpenSSL 3.0.2n and 1.1.1n, (High) (CVE-2022-0778)

Infinite loop in BN_mod_sqrt() reachable when parsing certificates. More 
details are available at https://www.openssl.org/news/secadv/20220315.txt


Impacts:

     All versions of the 17.x, 16.x, 14.x, and 12.x releases lines.


Downloads and release details

     Node.js v12.22.11 (LTS)
     Node.js v14.19.1 (LTS)
     Node.js v16.14.2 (LTS)
     Node.js v17.7.2 (Current)


(Update 16-Mar-2022) Summary

The Node.js project will release new versions of the 12.x, 14.x, 16.x, 
and 17.x releases lines on or shortly after Thursday, March 17th, 2022 
to incorporate upstream patches from OpenSSL.


Impact

The 17.x release line of Node.js is vulnerable to one High severity issue.

The 16.x release line of Node.js is vulnerable to one High severity issue.

The 14.x release line of Node.js is vulnerable to one High severity issue.

The 12.x release line of Node.js is vulnerable to one High severity issue.


Release timing

Releases will be available on, or shortly after, Thursday, March 17th, 2022.
Contact and future updates

The current Node.js security policy can be found at 
https://github.com/nodejs/node/blob/master/SECURITY.md. Please follow 
the process outlined in 
https://github.com/nodejs/node/blob/master/SECURITY.md if you wish to 
report a vulnerability in Node.js.

Subscribe to the low-volume announcement-only nodejs-sec mailing list at 
https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on 
security vulnerabilities and security-related releases of Node.js and 
the projects maintained in the nodejs GitHub organization.


Summary

The Node.js project may be releasing new versions across all of its 
supported release lines late this week to incorporate upstream patches 
from OpenSSL. Please read on for full details.


OpenSSL

The OpenSSL project announced this week that they will be releasing 
versions 3.0.2 and 1.1.1n on the 15th of March 2022 between 1300-1700 
UTC. The releases will fix two security defects that are labelled as 
"HIGH" severity under their security policy.

Node.js v12.x, v14.x and v16.x use OpenSSL v1.1.1 and Node.js v17.x uses
OpenSSL v3. Therefore all active release lines are impacted by this update.

At this stage, due to embargo, the exact nature of these defects is 
uncertain as well as the impact they will have on Node.js users.

After assessing the impact on Node.js, it will be decided whether the 
issues fixed require immediate security releases of Node.js, or whether 
they can be included in the normally scheduled updates.

Please monitor the nodejs-sec Google Group for updates, including a 
ecision within 24 hours after the OpenSSL release regarding release 
timing, and full details of the defects upon eventual release: 
https://groups.google.com/forum/#!forum/nodejs-sec


Contact and future updates

The current Node.js security policy can be found at 
https://github.com/nodejs/node/blob/HEAD/SECURITY.md#security, including 
information on how to report a vulnerability in Node.js.

Subscribe to the low-volume announcement-only nodejs-sec mailing list at 
https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on 
security vulnerabilities and security-related releases of Node.js and 
the projects maintained in the nodejs GitHub organization.


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================