Merge pull request #491 from nodejs/openssl-and-low-severity-fixes-jan-2016

include impact assessment of jan 2016 openssl release

Author: rvagg

locale/en/blog/vulnerability/openssl-and-low-severity-fixes-jan-2016.md

@@ -7,6 +7,8 @@ layout: blog-post.hbs
 author: Rod Vagg
 ---
 
+***(An update to this post is included below)***
+
 ### Summary
 
 The Node.js project will be releasing new versions across all of its active release lines early next week (possibly sooner, pending full impact assessment) to incorporate upstream patches from OpenSSL and some additional low-severity fixes relating to HTTP handling. Please read on for full details.
@@ -68,3 +70,30 @@ The current Node.js security policy can be found at <https://nodejs.org/en/secur
 Please contact [[email protected]](mailto:[email protected]) if you wish to report a vulnerability in Node.js.
 
 Subscribe to the low-volume announcement-only **nodejs-sec** mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the [nodejs GitHub organisation](https://github.com/nodejs).
+
+## _(Update 29-Jan-2016)_ OpenSSL Impact Assessment
+
+OpenSSL versions 1.0.1r and 1.0.21 have been released, the announcement can be found here: https://mta.openssl.org/pipermail/openssl-announce/2016-January/000061.html
+
+Our team has made an assessment of the impact of the disclosed defects and concluded that there is no urgency in releasing patched versions of Node.js in response to this release. Therefore, we will be proceeding as planned and attempt to release new versions of each of our active release lines on or after
+**Monday the 1st of February, 11pm UTC** _(Monday the 1st of February, 3pm Pacific Time)_. Please note that this is simply an approximation of release timing. Please tune in to **nodejs-sec** (https://groups.google.com/forum/#!topic/nodejs-sec) where we will announce the availability of releases.
+
+### Details
+
+**DH small subgroups (CVE-2016-0701)**
+
+Node.js v0.10 and v0.12 are not affected by this defect.
+
+Node.js v4 and v5 use the `SSL_OP_SINGLE_DH_USE` option already and are therefore not affected by this defect.
+
+**SSLv2 doesn't block disabled ciphers (CVE-2015-3197)**
+
+Node.js v0.10 and v0.12 disable SSLv2 by default and are not affected _unless_ the `--enable-ssl2` command line argument is being used (not recommended).
+
+Node.js v4 and v5 do not support SSLv2.
+
+**An update on DHE man-in-the-middle protection (Logjam)**
+
+Previous releases of OpenSSL (since Node.js v0.10.39, v0.12.5, v4.0.0 and v5.0.0) mitigated against [Logjam](https://en.wikipedia.org/wiki/Logjam_%28computer_security%29) for TLS _clients_ by rejecting connections from servers where Diffie-Hellman parameters were shorter than 768-bits.
+
+The new OpenSSL release, for all Node.js lines, increases this to 1024-bits. The change only impacts TLS clients connecting to servers with weak DH parameter lengths.