4 ms·

The most surprising to me is that NodeJS says they are affected https://nodejs.org/en/blog/vulnerability/openssl-november-2022/ https://nodejs.org/en/blog/vulne

• tempay 4y ago
  The offical NodeJS binaries statically link to OpenSSL so they have the be patched explicitly for OpenSSL vulnerabilities.
• joecool1029 4y ago
  Might be more surprising to you that it looks like you're shadowbanned with all your comments showing up dead (last 2 were vouched). I glanced at your post history and couldn't see why so you might want to send an email to hn@ycombinator.com.
• bilalq 4y ago
  They're only affected in the sense that newer versions of Node use OpenSSL 3.x. > Node.js v18.x and v19.x use OpenSSL v3. Therefore these release lines are impacted by this update. > Node.js 14.x and v16.x are not affected by this OpenSSL update. > At this stage, due to embargo, the exact nature of these defects is uncertain as well as the impact they will have on Node.js users. > After assessing the impact on Node.js, it will be decided whether the issues fixed require immediate security releases of Node.js, or whether they can be included in the normally scheduled updates.
• fulafel 4y ago
  I wonder if they are built with stack protector turned on in the compiler flags.