OpenSSL security releases do not require Node.js security releases

Summary

The OpenSSL Security releases of September 10th, 2019 do not affect Node.js.

Analysis

Our assessment of the security advisory is:

• ECDSA remote timing attack (CVE-2019-1547) Not affected. Node supports only named curves for ECDSA signing.

• Fork Protection (CVE-2019-1549) Not affected. Node.js always call exec() after fork() so will not duplicate the PRNG state in the forked process.

• Padding Oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey (CVE-2019-1563) Not affected. Node does not support PCKS7 and CMS.

Given this assessment, the OpenSSL updates will be treated as non-security patch updates, and will come out in the regularly scheduled updates to supported release lines.

Acknowledgements

Thanks to Shigeki Ohtsu for his rapid analysis of the OpenSSL security advisory.