| Package | Affected versions | Patched versions |
|---|---|---|
| node.js | ≥ 4.0.0, ≤ 4.1.2≥ 4.2.0, < 4.7.3≥ 5.0.0, ≤ 5.12.0≥ 6.0.0, ≤ 6.8.1≥ 6.9.0, < 6.9.5≥ 7.0.0, < 7.5.0 | 4.7.36.9.57.5.0 |
| openssl | = 1.0.2= 1.0.2a= 1.0.2b= 1.0.2c= 1.0.2d= 1.0.2e= 1.0.2f= 1.0.2h= 1.0.2i= 1.0.2j= 1.1.0a= 1.1.0b= 1.1.0c |
If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free