OpenSSL: Client DoS due to large DH parameter
This fixes a potential denial of service (DoS) attack
against client connections by a malicious server. During a TLS
communication handshake, where both client and server agree to
use a cipher-suite using DH or DHE (Diffie-Hellman, in both
ephemeral and non-ephemeral modes), a malicious server can
send a very large prime value to the client. Because this has
been unbounded in OpenSSL, the client can be forced to spend
an unreasonably long period of time to generate a key,
potentially causing a denial of service.
OpenSSL: ECDSA key extraction via local side-channel
Attackers with access to observe cache-timing may be able
to extract DSA or ECDSA private keys by causing the victim to
create several signatures and watching responses. This flaw
does not have a CVE due to OpenSSL policy to not assign itself
CVEs for local-only vulnerabilities that are more academic
than practical. This vulnerability was discovered by Keegan
Ryan at NCC Group and impacts many cryptographic libraries
including OpenSSL.
Unintentional exposure of uninitialized memory
Only Node.js 10 is impacted by this flaw.
Node.js TSC member Nikita Skovoroda discovered an argument
processing flaw that causes Buffer.alloc() to return
uninitialized memory. This method is intended to be safe and
only return initialized, or cleared, memory. The third
argument specifying encoding can be passed as a number, this
is misinterpreted by Buffer's internal "fill" method as the
start to a fill operation. This flaw may be abused where
Buffer.alloc() arguments are derived from user input to return
uncleared memory blocks that may contain sensitive
information.
Out of bounds (OOB) write
Node.js TSC member Nikita Skovoroda discovered an OOB write
in Buffer that can be used to write to memory outside of a
Buffer's memory space. This can corrupt unrelated Buffer
objects or cause the Node.js process to crash.
When used with UCS-2 encoding (recognized by Node.js under
the names 'ucs2', 'ucs-2', 'utf16le' and 'utf-16le'),
Buffer#write() can be abused to write outside of the bounds of
a single Buffer. Writes that start from the second-to-last
position of a buffer cause a miscalculation of the maximum
length of the input bytes to be written.