OpenSSL upgrades: March 1st 2016 [1.0.2g, 1.0.1s]

[rvagg]

@nodejs/security

OpenSSL versions 1.0.2g, 1.0.1s.

These releases will be made available on 1st March 2016 between approximately
1300-1700 UTC. They will fix several security defects with maximum severity
"high".

Please see the following page for further details of severity levels:
https://www.openssl.org/policies/secpolicy.html

https://mta.openssl.org/pipermail/openssl-announce/2016-February/000063.html

Same severity level as the January 28th releases, FYI. Impacting 0.10, 0.12, 4 and 5.

[shigeki]

I will be available at that time frame of the release and can make vulnerability assessments.

[bnoordhuis]

I'll be around as well.

[rvagg]

@nodejs/lts we have a quandary to sort out:

• This update impacts on all our release lines
• We can't tell ahead of time whether there is material impact to Node for their vulnerabilities so it's probably best we work on the assumption that we have to release and should probably do it anyway since we have to create a clear message for users
• We have 0.10.43 and 0.12.11 backed up and they contain critical fixes for the http parser regression that I don't think any of us are comfortable delaying much more, 0.12 contains a bunch of other fixes that have been on hold for too long as well. I honestly don't know what to do with both of these releases, input would be helpful!
• 4.4 is scheduled for release next week (afaik) and contains a bunch of extra stuff including the semver-minor's
• If the openssl update contains items that impact Node in any serious way then it's not ideal that we lump together a lot of changes in a single release and leave LTS users without a means to find a middle-ground if there are any regressions for their use-case, i.e. the philosophy we've been taking with releasing security updates mostly isolated from other updates on LTS.

And for @nodejs/ctc, this to consider: this could be the new norm for OpenSSL. I'm going to try and catch up with someone doing a talk on where OpenSSL is heading at collab summit at the end of April to try and understand better what we should expect. But if we're going to see more regular updates with as little lead-time as this and we're left having to assume that Node is impacted, how do we let that interact with our normal release process, particularly for LTS where we are trying to be steady and intentional (witness the long RC process for recent v4's). In a way we've made this difficult for ourselves by being so dogged on statically linking everything together, but that's really not something we can undo without making the install experience very frustrating for non-Linux users, but perhaps we can lean harder in to making it more straightforward for packagers on Linux at least (tbh I don't know what this means and whether there are actual issues to resolve here other than the annoyance that Node requires newer OpenSSL versions than is available on many systems we support).

[rvagg]

@nodejs/security @nodejs/lts here's my proposal:

• Announce ASAP to nodejs-sec and nodejs.org that there is an OpenSSL upgrade landing on the 1st
• Allow ourselves approximately 24 hours to issue an impact assessment prepared by our @nodejs/crypto experts
• Push forward with planned releases next week for all release lines since we have them due anyway, timing to be determined by the OpenSSL release—mostly a question of difficulty of adapting to the release, hopefully it'll be straightforward.
• v0.10 Release proposal: v0.10.43 (Maintenance) #5404 has a fixes for domains and a fix for a regression in http_parser that came via the last security update. It will likely include the new version of OpenSSL unless there are major problems including it at short notice and there are no major impacts for v0.10 from this release. v0.10 users are encouraged to try out the v0.10.43-rc.1 release to ensure that the minor planned fixes do not cause any regressions for them.
• v0.12 Release proposal: v0.10.43 (Maintenance) #5404 has a fixes for domains, a fix for a regression in http_parser that came via the last security update, and some other minor fixes. It will likely include the new version of OpenSSL unless there are major problems including it at short notice and there are no major impacts for v0.12 from this release. v0.12 users are encouraged to try out the v0.12.11.rc.1 release to ensure that the minor planned fixes do not cause any regressions for them.
• v4 the plan for v4 will vary depending on the assessment of the OpenSSL release and we will announce the plan as soon as we have that assessment. If the OpenSSL release contains important fixes that are relevant to Node.js users then we will release a v4.3.2 with just the OpenSSL update included. On the other hand, if the OpenSSL release is deemed to be of low impact to Node.js users and not requiring urgent upgrade then we will proceed with the v4.4.0 release that was planned for this week anyway and it will include the new version of OpenSSL unless there are major problems including it at short notice.
• v5 Release proposal: v5.7.1 #5464 is a regular update to Node.js v5, we are excluding semver-minor changes from this release although it has a fixes for some regressions included in v5.7.0. It will likely include the new version of OpenSSL unless there are major problems including it at short notice and there are no major impacts for v5 from this release. It will proceed as planned for next week unless anything serious comes up.

I'm going to write up a notice to nodejs-sec and nodejs.org that uses the above plan and will post it here for feedback but I'm going to be on a plane for the next 15 hours so would like to have approval or adjustments to the plan and move to a quick notification post based on that and a short review period here.

Can I have some +1's on the plan please? Particularly @thealphanerd and @jasnell on he v4 plan, is this acceptable?

[rvagg]

Plane is delayed, here's my proposed text to post to nodejs-sec and nodejs.org. You have ~15 hours to let me know what you think:

---

March OpenSSL updates

The OpenSSL project announced this week that they will be releasing versions 1.0.2g and 1.0.1s on Tuesday the 1st of March, UTC. The releases will fix "several defects" that are labelled as "high" severity under their security policy, meaning they are:

... issues that are of a lower risk than critical, perhaps due to affecting less common configurations, or which are less likely to be exploitable.

Node.js v0.10 and v0.12 both use OpenSSL v1.0.1 and Node.js v4 and v5 both use OpenSSL v1.0.2 and releases from nodejs.org and some other distribution sources are statically compiled. Therefore, all active release lines are impacted by this update.

At this stage, due to embargo, it is uncertain the exact nature of these defects, nor what impact they will have on Node.js users, if any.

As we already had minor, non-security releases scheduled for each of our active release lines during this week and next, we will be adjusting our schedule to adapt to the OpenSSL releases depending on their impact on Node.js users.

We will therefore proceed as follows:

Within approximately 24 hours of the OpenSSL releases, our crypto team will make an impact assessment for Node.js users of the OpenSSL releases. This information may vary depending for the different active release lines and will be posted here.

As part of that impact assessment we will announce our release plans for each of the active release lines to take into account any impact. Please be prepared for the possibility of important updates to Node.js v0.10, v0.12, v4 and v5 soon after Tuesday, the 1st of March.

Node.js v0.10 (Maintenance)

A release of Node.js v0.10.43 has been proposed for this week, it currently contains fixes for domains and an important fix for a regression in http_parser that was introduced in v0.10.42. Details of the changes included in this release along with instructions on how to download and use a release candidate (v0.10.43-rc.1) can be found in #5404. Node.js v0.10 users are encouraged to test the release candidate build to ensure compatibility with existing deployments.

If the OpenSSL 1.0.1s release contains important fixes that impact Node.js v0.10 we will endeavour to ensure that our v0.10.43 release contains the update.

Node.js v0.12 (LTS)

A release of Node.js v0.12.11 has been proposed for this week, it currently contains fixes for domains, an important fix for a regression in http_parser that was introduced in v0.12.42, and some other minor fixes. Details of the changes included in this release along with instructions on how to download and use a release candidate (v0.12.11-rc.1) can be found in #5403. Node.js v0.12 users are encouraged to test the release candidate build to ensure compatibility with existing deployments.

If the OpenSSL 1.0.1s release contains important fixes for Node.js v0.12 we will endevour to ensure that our v0.12.11 release contains the update.

Node.js v4 (LTS "Argon")

A significant update to Node.js v4 has been proposed for next week, the 8th of March. You can read about what will be included in Node.js v4.4.0 and find release candidates to test against your deployments at #5301.

If the OpenSSL 1.0.2g update includes important fixes that impact Node.js v4, we may release a v4.3.2 this week with only the security updates in order to provide a low-risk path for Node.js v4 users.

If the OpenSSL 1.0.2g update does not include important fixes that impact Node.js v4, we will continue with our planned v4.4.0 release and also attempt to include the OpenSSL 1.0.2g upgrade. Users of Node.js v4 can then upgrade to v4.4.0 in their own time and allow for proper testing of the changes included.

Node.js v5 (Stable)

A regular update to Node.js v5 has been proposed for this week. You can read about what will be included in the proposed Node.js v5.7.1 at #5464. We are excluding any semver-minor changes from this release although it has fixes for some regressions

If the OpenSSL 1.0.2g release contains important fixes for Node.js v5, we will endevour to ensure that our v5.7.1 release contains the update.

Summary

• Expect an impact assessment of the OpenSSL updates within 24 hours of their release
• Expect releases of Node.js v0.10, v0.12 and v5 this week, possibly containing important security releases
• Expect a Node.js v4.4.0 release next with the possibility of a v4.3.2 security update this week

Please monitor the nodejs-sec Google Group for updates, including an impact assessment and updated details on release timing within approximately 24 hours after the OpenSSL release: https://groups.google.com/forum/#!forum/nodejs-sec

Contact and future updates

The current Node.js security policy can be found at https://nodejs.org/en/security/.

Please contact security@nodejs.org if you wish to report a vulnerability in Node.js.

Subscribe to the low-volume announcement-only nodejs-sec mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the nodejs GitHub organisation.

[MylesBorins]

@rvagg LGTM. I was under the impression the v4.4.0 was going to have another week for RC. There are a few more semver minor commits I wanted to try and get in this week, which would give us the next week to hopefully catch any regressions.

AFAIK there is nothing super major omg need to launch yesterday that is in v4.4.0, more semver minor stuff that has been staged for quite some time. I'd much rather be patient and get more stuff in... otherwise it could be 2 - 3 months, or potentially never, for the remaining semver minor commits.

Monday morning I'll put together an assessment / audit of the remaining stuff to be merged. If the openssl vuln is bad for us we should 100% do a v4.3.2 and push out v4.4.0 soon after. I know there is the concern of release fatigue... but if these kind of updates are coming from openssl there is not much we can really do aside from static linking, which as you mentioned can be a non starter.

[rvagg]

@thealphanerd thanks for the update, good to know 4.4.0 is another week out, I'll adjust wording accordingly: we'll proceed with 4.4.0 next week regardless and the openssl update will either be in that release or a special 4.3.2 this week if there is enough of an impact.

[rvagg]

Updated my text above to clarify a few things including the 4.4.0 schedule. Please review.

[bnoordhuis]

Proposed text LGTM.

[rvagg]

One of the problems being addressed is CVE-2016-0799, I don't know why it's public but there's an interesting writeup at https://guidovranken.wordpress.com/2016/02/27/openssl-cve-2016-0799-heap-corruption-via-bio_printf/

It's all about not properly handling allocation failures during large writes using BIO_printf(). We only have one use of BIO_printf() and it's to print a %l so that suggests that we're unlikely to have direct exposure to this one, but it's used so much internally that I don't think it can be ruled out. Would love @nodejs/crypto to have a poke at this one.

[shigeki]

+1 for Rod's proposal.
I guess that the fix for CVE-2016-0799 has already landed because its severity is considered to be low.
Node uses BIO_printf() in tlsSocket.getPeerCertificate() to show an exponent value of RSA public key in a peer certificate.
Reading the comment in openssl/openssl@578b956, the size of a certificate to receive is limited not to be overflowed so that it would not affect Node.
I'm going to look at it later.

[indutny]

Just a heads up, there are other places in node where we use BIO_printf implicitly, through the others OpenSSL methods like X509V3_EXT_print. I will investigate it more carefully today.

[shigeki]

The default size limit of receiving certificate from server is 100k bytes with SSL_MAX_CERT_LIST_DEFAULT in https://github.com/nodejs/node/blob/master/deps/openssl/openssl/ssl/ssl_lib.c#L1920. We don't change its size and this is far less than 32bits.

I confirmed this limit with connecting the server that has a self signed certs of more than 100k bytes.

$ ./node ~/tmp/tls_test/tls_connect.js
connect
{}
error: { Error: write EPROTO 140348587698048:error:1408E098:SSL routines:ssl3_get_message:excessive message size:../deps/openssl/openssl/ssl/s3_both.c:415:

    at exports._errnoException (util.js:859:11)
    at WriteWrap.afterWrite (net.js:767:14) code: 'EPROTO', errno: 'EPROTO', syscall: 'write' }

So I think CVE-2016-0799 does not affect Node.