René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"OpenSSL upgrades: January 28th 2016","articleBody":"@nodejs/security\n\nRef: https://mta.openssl.org/pipermail/openssl-announce/2016-January/000058.html\n\n\u003e Forthcoming OpenSSL releases\n\u003e \n\u003e The OpenSSL project team would like to announce the forthcoming release of OpenSSL versions 1.0.2f, 1.0.1r.\n\u003e These releases will be made available on 28th January between approx.  1pm and 5pm (UTC). They will fix two security defects, one of \"high\" severity affecting 1.0.2 releases, and one \"low\" severity affecting all releases.\n\u003e Please see the following page for further details of severity levels: https://www.openssl.org/policies/secpolicy.html\n\u003e Please also note that, as per our previous announcements, support for 1.0.0 and 0.9.8 releases ended on 31st December 2015 and are no longer receiving security updates.  Support for 1.0.1 will end on 31st December 2016.\n\nHigh severity is [defined](https://www.openssl.org/policies/secpolicy.html) as:\n\n\u003e  This includes issues that are of a lower risk than critical, perhaps due to affecting less common configurations, or which are less likely to be exploitable. These issues will be kept private and will trigger a new release of all supported versions. We will attempt to keep the time these issues are private to a minimum; our aim would be no longer than a month where this is something under our control\n\nThe last round of updates were also high.\n\nNote that this impacts all our active release lines, v0.10 and v0.12 use 1.0.1 and v4 and v5 use 1.0.2. It's very possible that both of the bugs being fixed don't impact Node.js at all or that our impact assessment is much lower than theirs due to how we are using the particular parts of OpenSSL affected. Therefore, we will have to make an assessment on the urgency of release when we see the details on the 28th. It may be prudent to plan for releases for some or all of our release lines within one or two days of the 28th regardless, in order to give some predictability to users. The only catch here is that we only have two commits queued up for v0.10, a doc fix and a fix to tools/install.py to generate proper header files (a welcome fix). So it's harder to justify a v0.10 release if the OpenSSL fixes turn out to be irrelevant for Node.js. v0.12 has more meaty commits (7), worthy of a stand-alone release.\n\nI'll prepare an announcement for [nodejs-sec](https://groups.google.com/forum/#!forum/nodejs-sec) and nodejs.org and post a draft here but I'd like to hear thoughts on my above point about planning for releases regardless of impact.\n","author":{"url":"https://github.com/rvagg","@type":"Person","name":"rvagg"},"datePublished":"2016-01-25T13:03:08.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":31},"url":"https://github.com/4857/node/issues/4857"}