# openssl Published articles for openssl. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Node.js 26.9.0 (Current) DevFeed: [Node.js 26.9.0 (Current)]() Original publisher: [Read original article]() Published: 2026-09-16T18:17:42Z Content type: release Language: en Sources: [Node.js Blog]() Topics: [Node.js](), [JavaScript](), [Open Source]() Tags: [crypto](), [javascript](), [node](), [node-js](), [open-source](), [openssl](), [version]() ### AI overview Node.js 26.9.0 is a current release with semver-minor additions and fixes across cryptography, module loading, Web Workers, benchmarking, builds, and diagnostics. ### Source excerpt Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts. ## Security updates for Wednesday DevFeed: [Security updates for Wednesday]() Original publisher: [Read original article]() Author: corbet Published: 2026-09-16T13:40:53Z Content type: news Language: en Sources: [LWN.net]() Topics: [Security](), [Linux](), [nginx](), [openssl](), [Python](), [OpenSSH]() Tags: [debian](), [linux](), [nginx](), [openssh](), [openssl](), [python](), [security](), [updates]() ### AI overview Security updates were issued by AlmaLinux, Debian, Fedora, Oracle, Red Hat, SUSE, and Ubuntu for packages including kernels, nginx, OpenSSL, Python, Perl, Git, Docker, OpenSSH, and other software. ### Source excerpt Security updates have been issued by AlmaLinux (kernel, kernel-rt, libkcapi, nginx, nginx:1.24, openssl, osbuild-composer, perl, perl:5.32, python-tornado, rsync, and rust), Debian (cjose and nginx), Fedora (environment-modules, erlang, GitPython, knot, perl-Authen-SASL, python-configargparse, ruby, rubygems, and sblim-sfcb), Oracle (firefox, git-lfs, gstreamer1-plugins-base, kernel, libkcapi, nginx, nginx:1.26, openssl, osbuild-composer, perl, perl-YAML-Syck, postgresql18, python-tornado, and rust), Red Hat (fence-agents, git-lfs, microcode_ctl, osbuild-composer, podman, python-pyasn1, and resource-agents), SUSE (389-ds, ant, bson-devel, chirp-20260911, docker, gimp, google-cloud-sap-agent, hauler, kernel, kimi-code, libpcap, python-GitPython, python310, syncthing, yast2-samba-client, and zstd-jni), and Ubuntu (aom, imagemagick, kitty, openssh, phpseclib, policykit-1, python-sql, python-webob, shibboleth-sp, simplesamlphp, snapcast, srt, and suricata-update). ## Security updates for Tuesday DevFeed: [Security updates for Tuesday]() Original publisher: [Read original article]() Author: jzb Published: 2026-09-15T13:10:46Z Content type: news Language: en Sources: [LWN.net]() Topics: [Security](), [Debian](), [Fedora](), [Ubuntu](), [Linux](), [Grafana](), [nginx]() Tags: [debian](), [grafana](), [hat](), [java](), [linux](), [mozilla](), [network](), [nginx](), [openssl](), [php](), [podman](), [python](), [rust](), [security](), [systemd](), [ubuntu](), [updates](), [vim]() ### AI overview Debian, Fedora, Mageia, Red Hat, SUSE, and Ubuntu issued security updates for a broad range of packages and components, including Linux-related tools, libraries, servers, programming environments, and desktop software. ### Source excerpt Security updates have been issued by Debian (network-manager-l2tp and urwid), Fedora (perl-Dancer2, perl-Data-Entropy, perl-DBI, perl-Protocol-HTTP2, podman-tui, rust-lru, and rust-lru0.16), Mageia (bzip2, cups-filters, libcupsfilters, libssh2, perl-Authen-SASL, perl-HTML-FormFu, tar, unzip, and zip), Red Hat (grafana and image-builder), SUSE (389-ds, acl, attr, apache2-mod_auth_openidc, apr-util, aws-nitro-enclaves-cli, bzip2, c-ares, clamav, cpio, curl, dhcpcd, dovecot23, dovecot24, dracut, emacs, fuse-overlayfs, go1.25-openssl, go1.26-openssl, google-cloud-sap-agent, google-osconfig-agent, govulncheck-vulndb, gstreamer-devtools, gzip, helm, java-17-openjdk, java-21-openjdk, java-25-openjdk, jq, libBasicUsageEnvironment2, libgpg-error, libidn, librest, libusb-1_0, libvirt, LibVNCServer, libzypp, zypper, lkl, mcphost, MozillaFirefox, mozilla-nspr, mozilla-nss, rust-cbindgen, MozillaFirefox, mozilla-nss, mozilla-nspr, rust-cbindgen, MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nspr, mozilla-nss, rust-cbindgen, msgpack-c, multipath-tools, NetworkManager, openexr, openssl-3, perl-Protocol-HTTP2, perl-URI, php-composer2, postgresql14, postgresql15, postgresql16, postgresql17, postgresql18, python-aiohttp, python-cryptography, python-h2, python-ruff, python-sqlparse, python311, python312, python39.SUSE_SLE-15-SP3_Update, rav1e, rpcbind, sssd, systemd, tomcat, tomcat11, ucode-intel, udisks2, vim, and wicked2nm), and Ubuntu (cgit, dracut, freeciv, konsole, libinput, linux-azure, linux-nvidia-7.0, nginx, vips, and yelp). ## New in Symfony 8.2: KeyManagement Component DevFeed: [New in Symfony 8.2: KeyManagement Component]() Original publisher: [Read original article]() Author: Javier Eguiluz Published: 2026-09-15T07:11:00Z Content type: release Language: en Sources: [Symfony Blog]() Topics: [Symfony](), [Encryption](), [Amazon Web Services](), [Azure](), [Google]() Tags: [2026](), [api](), [article](), [aws](), [azure](), [backend](), [encryption](), [features](), [google](), [hashicorp-vault](), [kms](), [new-features](), [openssl](), [sdk](), [symfony]() ### AI overview Symfony 8.2 introduces an experimental KeyManagement component that provides one API for AWS KMS, Azure Key Vault, Google Cloud KMS, and HashiCorp Vault. It supports direct and envelope encryption, local development backends, provider bridges, console commands, debug-toolbar integration, and Doctrine support. ### Source excerpt This is the first article in a series showcasing the most important new features introduced by Symfony 8.2, which will be released at the end of November 2026. Contributed... ## curl 8.22.0 DevFeed: [curl 8.22.0]() Original publisher: [Read original article]() Author: Daniel Stenberg Published: 2026-09-02T05:52:46Z Content type: release Language: en Sources: [Daniel Stenberg]() Topics: [cURL](), [Security](), [HTTP](), [openssl](), [API](), [TLS (Transport Layer Security)](), [Command-line interface]() Tags: [bugfixes](), [command-line](), [curl](), [curl-and-libcurl](), [cve](), [cves](), [http](), [openssl](), [release](), [security](), [tls]() ### AI overview The curl 8.22.0 release includes six changes, 302 bug fixes, and nine curl/libcurl security fixes plus one wcurl fix. It adds Apple GSS Framework support, API guards, experimental HTTP Message Signatures support, and Apple fast UDP, while blocking NTLM fallback in SPNEGO and dropping TLS-SRP support. ### Source excerpt Welcome to this new release. Get it as always from https://curl.se. If you rather want a security-patched older release branch, stay tuned for the follow-up Rock-solid curl announcement within a few days. Release presentation Numbers the 276th release6 changes70 days (total: 10,887)302 bugfixes (total: 14,489)525 commits (total: 39,608)0 new public libcurl function (total: 100)4 new ... Continue reading curl 8.22.0 -> ## Announcing Oracle Jipher 10.37: FIPS 140-3 Cryptography for Java DevFeed: [Announcing Oracle Jipher 10.37: FIPS 140-3 Cryptography for Java]() Original publisher: [Read original article]() Author: Poonam Parhar Published: 2026-08-25T00:00:00Z Content type: release Language: en Sources: [Inside Java]() Topics: [Cryptography](), [fips 140-3](), [openssl](), [Java](), [Encryption](), [Security, Privacy and Abuse Prevention]() Tags: [cryptographic](), [cryptography](), [fips](), [fips-140-3](), [java](), [openssl](), [oracle](), [security](), [standard]() ### AI overview Oracle Jipher 10 packages a FIPS 140-3 validated OpenSSL cryptographic module and exposes cryptographic services through Java Cryptography Architecture (JCA). ### Source excerpt Oracle Jipher 10 packages a FIPS 140-3 validated OpenSSL cryptographic module, making cryptographic services available through the standard Java Cryptography Architecture (JCA) framework. ## Chainguard FIPS enters 2026 with OpenSSL 3.1.2 and better CMVP visibility DevFeed: [Chainguard FIPS enters 2026 with OpenSSL 3.1.2 and better CMVP visibility]() Original publisher: [Read original article]() Published: 2026-01-07T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Docker Hardened Images](), [Cryptography](), [Security, Privacy and Abuse Prevention](), [container images]() Tags: [2026](), [chainguard](), [chainguard-containers](), [chainguard-fips](), [cmvp](), [cmvp-sboms](), [fips](), [fips-140-3](), [fips-compliance](), [fips-containers](), [fips-validation](), [openssl](), [sboms](), [validation]() ### AI overview Chainguard updates its FIPS container images to use the Chainguard FIPS provider for OpenSSL 3.1.2, identified by CMVP certificate #5102. The images now expose CMVP and entropy certification numbers through SBOM packages, while future OpenSSL 3.4 and 3.6 upgrades remain under coordination and review with NIST. ### Source excerpt We updated our FIPS container images with OpenSSL 3.1.2 (CMVP #5102), clearer CMVP visibility in SBOMs, and a roadmap for upcoming FIPS 140-3 cryptography. ## \[Pentesting\] HTTP auth, part I: basic DevFeed: [\[Pentesting\] HTTP auth, part I: basic]() Original publisher: [Read original article]() Published: 2025-11-20T23:00:00Z Content type: tutorial Language: en Sources: [Dennis Yurichev]() Topics: [HTTP](), [passwords](), [Cryptography](), [openssl]() Tags: [blog-post](), [encryption](), [http](), [openssl](), [password]() ### AI overview A pentesting tutorial explains HTTP Basic Authentication setup with htpasswd and .htaccess, showing the credentials exchanged by a browser. It warns that Basic Authentication is weak without TLS because Base64 is only obfuscation, and discusses salted password hashes, hashcat cracking, and OpenSSL support. ### Source excerpt [Pentesting] HTTP auth, part I: basic ## Notes to self: Semaphore-UI secrets DevFeed: [Notes to self: Semaphore-UI secrets]() Original publisher: [Read original article]() Author: Jan-Piet Mens Published: 2025-10-27T23:00:00Z Content type: article Language: en Sources: [Jan-Piet Mens]() Topics: [Encryption](), [Cryptography](), [SQLite](), [ssh](), [data](), [private key](), [openssl](), [Code](), [ed25519](), [Development]() Tags: [code](), [database](), [ed25519](), [encryption](), [environment-variables](), [jan-piet-mens](), [jpm](), [jpmens](), [openssl](), [private-key](), [secrets](), [sql](), [ssh]() ### AI overview The article examines how Semaphore UI stores configured secrets, including variable-group secrets, SSH keys, and login credentials. It describes AES encryption at rest in the database, identifies the nonce placement and authenticated-encryption limitation of openssl enc, and adapts Semaphore UI source code to decrypt the stored values. ### Source excerpt I've been looking a bit more closely at Semaphore UI and was curious how secrets I can configure for it are stored. There are two distinct kinds of secrets as far as I've been able to ascertain, and they're in either variable groups or in one or more key stores (one key store for the CE edition, more than one for the Pro). I create three such secret values, using the UI: a secret in a variable group; secret environment variables in a variable group are also encrypted and work like "normal" secret variables: an SSH key in a key store into which I paste the SSH key's passphrase and the private key, generated with ssh-keygen -C DemoKey -t ed25519 -f sema1: a login/password combination a playbook can, say, use to login to "something": These values are then encrypted at rest with AES into the database, which is what the documentation states, and an SQL select confirms base64-encoded data in the secret column (id 1 was placed there by the setup routine): sqlite> SELECT id, name, type, SUBSTR(secret, 1, 25) AS secret FROM access_key; ┌────┬──────────────┬────────────────┬───────────────────────────┐ │ id │ name │ type │ secret │ ├────┼──────────────┼────────────────┼───────────────────────────┤ │ 1 │ None │ none │ │ │ 2 │ mug │ string │ cIRZIUUaFCxajOak6I51agLyq │ │ 3 │ dev-hosts │ ssh │ EzLAwD/CB7y23x/XABElWrF9g │ │ 4 │ router-creds │ login_password │ 6in0q49PmW1XrhQ33wTEO/GuG │ └────┴──────────────┴────────────────┴───────────────────────────┘ I spend a futile 20 minutes trying to decrypt the binary data (i.e. after base64 decoding) using openssl enc -d, futile because I only find out later that the nonce is actually in the first 12 bytes of the encrypted blob. I also spend an impossible amount of time consulting a robot which insists on hallucinating and leading me up the garden path until I'm breathless. And then, finally, I read in enc's documentation: This command does not support authenticated encryption modes like CCM and GCM, and will not support such modes in the ## Node.js 22.21.0 (LTS) DevFeed: [Node.js 22.21.0 (LTS)]() Original publisher: [Read original article]() Published: 2025-10-20T23:51:44Z Content type: release Language: en Sources: [Node.js Blog]() Topics: [Node.js](), [JavaScript](), [Command-line interface](), [HTTP](), [npm](), [Benchmark](), [Security](), [WebAssembly]() Tags: [benchmark](), [command-line](), [http](), [javascript](), [lts](), [node-js](), [npm](), [openssl](), [race-condition](), [security](), [webassembly]() ### AI overview Node.js 22.21.0 is an LTS release adding command-line and HTTP proxy capabilities, server-controlled HTTP upgrades, and built-in proxy support. It also includes dependency updates, OpenSSL upgrades, npm 10.9.4, performance changes, diagnostics fixes, documentation improvements, and security-policy documentation. ### Source excerpt Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts. ## Node.js 24.10.0 (Current) DevFeed: [Node.js 24.10.0 (Current)]() Original publisher: [Read original article]() Published: 2025-10-11T16:20:00Z Content type: release Language: en Sources: [Node.js Blog]() Topics: [Node.js](), [JavaScript](), [cross-platform](), [Open Source](), [Command-line interface](), [servers](), [Web](), [npm](), [V8]() Tags: [benchmark](), [command-line](), [cross-platform](), [doc](), [javascript](), [meta](), [node-js](), [npm](), [open-source](), [openssl](), [servers]() ### AI overview Node.js 24.10.0 is a Current release containing minor changes, performance improvements, dependency updates, documentation changes, and maintenance work. Notable updates include per-stream console options, a SQLite authorization API, V8 and npm updates, OpenSSL 3.5.4 upgrades, and improvements to diagnostic channels and priority queues. ### Source excerpt Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts. ## Node.js 22.20.0 (LTS) DevFeed: [Node.js 22.20.0 (LTS)]() Original publisher: [Read original article]() Published: 2025-09-24T13:48:52Z Content type: release Language: en Sources: [Node.js Blog]() Topics: [Node.js](), [JavaScript](), [Open Source](), [cross-platform](), [servers]() Tags: [cpu](), [cross-platform](), [http](), [javascript](), [lts](), [node-js](), [open-source](), [openssl](), [process](), [servers](), [sqlite](), [update]() ### AI overview Node.js 22.20.0 is an LTS release that updates the bundled OpenSSL version to 3.5.2, extending support for official and default-configured builds through the planned 2027-04-30 end-of-life date. It also includes HTTP, HTTP/2, stream, test runner, worker profiling, build, crypto, and documentation changes. ### Source excerpt Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts. ## TLS Certificate Cheat Sheet - OpenSSL & Curl DevFeed: [TLS Certificate Cheat Sheet - OpenSSL & Curl]() Original publisher: [Read original article]() Author: Chris Hager Published: 2025-09-22T00:00:00Z Content type: tutorial Language: en Sources: [Chris Hager]() Topics: [TLS (Transport Layer Security)](), [certificates](), [Cheat sheet](), [openssl](), [cURL]() Tags: [certificates](), [cheat-sheet](), [curl](), [openssl](), [tls](), [tools]() ### AI overview A cheat sheet for creating, inspecting, signing, validating, and testing TLS certificates and related keys and CSRs using OpenSSL and cURL. ### Source excerpt https://collective.flashbots.net/t/tls-certificates-know-how-quick-reference/5292 ## Announcing Kernel-Independent FIPS for Java DevFeed: [Announcing Kernel-Independent FIPS for Java]() Original publisher: [Read original article]() Published: 2025-08-14T00:00:00Z Content type: news Language: en Sources: [Chainguard: Unchained]() Topics: [Java](), [Cryptography](), [Cybersecurity](), [container images](), [Linux]() Tags: [amazon](), [ato](), [azure](), [chainguard](), [chainguard-containers](), [chainguard-fips-images](), [compliance](), [container-images](), [cos](), [cryptography](), [fedramp](), [fedramp-ato](), [fedramp-containers](), [fips](), [implementation](), [java](), [linux](), [nist](), [openssl](), [security]() ### AI overview Chainguard announces Kernel-Independent FIPS availability across its Java FIPS image catalog. The update uses FIPS-validated cryptography and validated userspace entropy, allowing Java FIPS workloads to run with any host kernel and on platforms including GKE with COS, Amazon Bottlerocket, Flatcar Linux, and Azure Linux. It is intended to simplify production deployment and accelerate FedRAMP authorization to operate. ### Source excerpt Kernel-Independent FIPS is now available across the full catalog of Chainguard FIPS images for Java, simplifying and accelerating compliance for FedRAMP ATO. ## Node.js 24.5.0 (Current) DevFeed: [Node.js 24.5.0 (Current)]() Original publisher: [Read original article]() Published: 2025-07-31T21:52:17Z Content type: release Language: en Sources: [Node.js Blog]() Topics: [Node.js](), [wasm](), [JavaScript](), [Web](), [Web Development]() Tags: [javascript](), [node-js](), [open-source](), [openssl](), [release](), [tls](), [wasm](), [webassembly]() ### AI overview Node.js 24.5.0 is a current release that updates its OpenSSL distribution, adds WebAssembly module import support, introduces proxy support for the built-in HTTP/HTTPS client, and provides dynamic CA certificate configuration for TLS clients. It also includes several CLI, DNS, networking, worker, benchmark, diagnostics, buffer, and build changes. ### Source excerpt Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts. ## Forging Ahead in Federal Compliance: Chainguard's FIPS 140-3 and 186-5 Milestones DevFeed: [Forging Ahead in Federal Compliance: Chainguard's FIPS 140-3 and 186-5 Milestones]() Original publisher: [Read original article]() Published: 2025-06-06T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [container images](), [Security](), [Testing](), [interoperability]() Tags: [chainguard](), [chainguard-containers](), [chainguard-fips](), [compliance](), [container-images](), [cryptographic](), [digital-signature](), [ed25519](), [federal-compliance](), [federal-information-processing-standards](), [fedramp](), [fips](), [fips-140-3](), [fips-validation](), [nist](), [openssl](), [security](), [signing](), [standards](), [validation]() ### AI overview Chainguard FIPS container images are being upgraded to support current FIPS 140-3 and FIPS 186-5 standards, including OpenSSL with FIPS 140-3 validation and Ed25519 signing support. ### Source excerpt Chainguard FIPS images have been upgraded to start using the OpenSSL project 3.1.2 module with FIPS 140-3 validation. Learn more about what this means. ## Implementing FIPS compliance in Redpanda DevFeed: [Implementing FIPS compliance in Redpanda]() Original publisher: [Read original article]() Author: Kavya Shivashankar Published: 2025-05-20T00:00:00Z Content type: tutorial Language: en Sources: [Redpanda]() Topics: [Security](), [Cryptography](), [Encryption](), [Command-line interface](), [Linux]() Tags: [clusters](), [command-line](), [compliance](), [crypto](), [deploying-fips-compliant-redpanda](), [encryption](), [fips](), [fips-140-2-compliance](), [fips-compliance-redpanda](), [fips-mode-redpanda-installation](), [fips-validation-for-cryptographic-modules](), [implementing-fips-in-redpanda](), [installation](), [k8s](), [openssl](), [openssl-3-0-9-fips](), [product](), [production](), [red-hat](), [redpanda-enterprise-security-features](), [redpanda-fips-compliant-cluster](), [redpanda-openssl-configuration](), [redpanda-security-standards](), [rhel](), [secure-redpanda-clusters](), [security](), [standards]() ### AI overview This tutorial explains FIPS requirements for cryptographic modules and how Redpanda supports FIPS-compliant operation. It covers validated OpenSSL libraries, FIPS mode settings, licensing, deployment limitations, and an example single-node cluster installation on RHEL. ### Source excerpt Redpanda now supports FIPS, so you can run our clusters in secure environments with strict federal security standards for crypto modules. ## Ekapkgs, a poly-repo fork of Nixpkgs DevFeed: [Ekapkgs, a poly-repo fork of Nixpkgs]() Original publisher: [Read original article]() Author: Jon Ringer Published: 2025-03-31T00:00:00Z Content type: opinion Language: en Sources: [Nixcademy Blog]() Topics: [Nix](), [repo](), [Development](), [Maintainability](), [cloud-infrastructure]() Tags: [development](), [fork](), [glibc](), [infrastructure](), [maintainability](), [openssl](), [repo]() ### AI overview The article presents Ekapkgs as a poly-repository fork of Nixpkgs. It argues that Nixpkgs' monolithic scale, lengthy RFC process, and staging workflow make maintenance, convention changes, and package updates difficult, while separate repositories could enable faster iteration and more focused curation. ### Source excerpt Ekapkgs forks Nixpkgs, splitting it into repos for faster updates & easier curation. Ditch monolithic development flows & slow RFCs. Innovate freely! ## FuzzSlice: Separating real CVEs from fakes through fuzzing DevFeed: [FuzzSlice: Separating real CVEs from fakes through fuzzing]() Original publisher: [Read original article]() Published: 2024-09-19T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Fuzzing/Fuzz testing](), [Vulnerabilities](), [openssl](), [Security](), [Testing](), [supply-chain-security]() Tags: [cves](), [false-positives](), [fuzzing](), [openssl](), [security](), [software-supply-chain]() ### AI overview Chainguard Labs presents FuzzSlice, a fuzzing technique for determining whether CVEs are exploitable within an application context. In an evaluation of 18 OpenSSL CVEs, it classified 12 as exploitable and six as unreachable or false positives. ### Source excerpt Chainguard Labs explores FuzzSlice, a novel fuzzing technique, to improve vulnerability remediation by distinguishing exploitable CVEs from false positives. ## Node.js 20.16.0 (LTS) DevFeed: [Node.js 20.16.0 (LTS)]() Original publisher: [Read original article]() Published: 2024-07-24T12:29:52Z Content type: release Language: en Sources: [Node.js Blog]() Topics: [Node.js](), [JavaScript](), [cross-platform](), [Open Source](), [tracing](), [Command-line interface](), [Chrome]() Tags: [chrome](), [command-line](), [cross-platform](), [javascript](), [lts](), [node-js](), [open-source](), [openssl](), [servers](), [tracing](), [wasi](), [web]() ### AI overview Node.js 20.16.0 is an LTS release that adds a way to conditionally load built-in modules from a globally available function. It also updates OpenSSL-related behavior, improves profiling behavior with Chrome DevTools, and includes documentation, networking, WASI, test runner, utility, buffer, benchmarking, and build changes. ### Source excerpt Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts. ## Latest CVE patch report: Securing software supply chains DevFeed: [Latest CVE patch report: Securing software supply chains]() Original publisher: [Read original article]() Published: 2024-06-27T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [chainguard images](), [Vulnerabilities](), [chainguard](), [Security]() Tags: [attacks](), [chainguard](), [chainguard-images](), [command-line](), [common-vulnerabilities-and-exposures](), [cve](), [cve-2024-4603](), [cve-remediation](), [openssl](), [report](), [security](), [software-supply-chain](), [software-supply-chain-security](), [vulnerabilities]() ### AI overview Chainguard's latest CVE patch report describes how its remediation team patches vulnerabilities in Chainguard Images and Wolfi Packages, aiming to provide accurate scanner results and reduce false positives. It also examines CVE-2024-4603 in OpenSSL, which can cause denial-of-service attacks when untrusted, excessively large DSA parameters are checked. ### Source excerpt Dive into our latest CVE patch report and see how Chainguard proactively mitigates vulnerabilities to enhance software supply chain security. ## Node.js 18.19.1 (LTS) DevFeed: [Node.js 18.19.1 (LTS)]() Original publisher: [Read original article]() Published: 2024-02-14T17:35:50Z Content type: release Language: en Sources: [Node.js Blog]() Topics: [Node.js](), [JavaScript](), [cross-platform](), [Open Source](), [Command-line interface]() Tags: [linux](), [lts](), [macos](), [node-js](), [npm](), [openssl](), [releases](), [security](), [windows]() ### AI overview Node.js 18.19.1 is an LTS security release addressing multiple vulnerabilities, including code injection and privilege escalation, HTTP request processing issues, timing attacks, and denial-of-service risks. It also updates dependencies such as undici, npm, OpenSSL, and root certificates, and improves release notarization and signing processes. ### Source excerpt Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts. ## Blog: Falco Weekly 46 - 2023 DevFeed: [Blog: Falco Weekly 46 - 2023]() Original publisher: [Read original article]() Published: 2023-11-17T00:00:00Z Content type: article Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Falco](), [Development](), [ci](), [CMake](), [openssl](), [osx](), [win32]() Tags: [blog](), [changes](), [ci](), [cmake](), [falco](), [openssl](), [osx](), [weekly](), [win32]() ### AI overview Falco Weekly 46 reviews development changes across Falco-related repositories, including library cleanups, fixes, new features, experimental ppc64le support, an OpenSSL upgrade, CI support for win32 and osx, and Kubernetes metadata work involving gRPC. ### Source excerpt This is the first of a series of weekly blog post whose aim is to give a quick overview about the development of Falco and its related projects. What happened in Falco this week? Let's go through the major changes that happened in various repositories under the falcosecurity organization. Libs Lots of cleanups happened in the libs repo; the most outstanding ones being: udig engine removal (https://github.com/falcosecurity/libs/pull/1485) dropped legacy metadata clients for k8s and mesos (https://github.com/falcosecurity/libs/pull/1478) cleaned up proc callback handling code (https://github.com/falcosecurity/libs/pull/1471) Please, note that the removal of the legacy k8s client is part of a bigger effort to entirely rewrite it as a plugin, with a more future proof architecture and language. See the tracking issue: https://github.com/falcosecurity/libs/issues/987. All of these cleanups account for ~26k loc removed!! :rocket: Moreover, some fixes landed: removed some more Undefined Behavior warnings from integer copies (https://github.com/falcosecurity/libs/pull/1481) solved win32 linking issues with zlib (https://github.com/falcosecurity/libs/pull/1484) prevent libbpf stats from being collected with no bpf stats (https://github.com/falcosecurity/libs/pull/1487) Finally, some new features were merged: libraries will now be properly installed under CMAKE_INSTALL_LIBDIR (https://github.com/falcosecurity/libs/pull/1101) added ppc64le experimental support for modern bpf driver (https://github.com/falcosecurity/libs/pull/1475) upgraded openssl to 3.1.4 (https://github.com/falcosecurity/libs/pull/1488) Also, we now have a target release date and a tracking issue for libs 0.14 and next driver release: https://github.com/falcosecurity/libs/issues/1482. Falco Now Falco builds and runs on win32 and osx too! https://github.com/falcosecurity/falco/pull/2889 While Falco won't ship for these platforms, we will now have proper CI for them. Following the huge round of cleanups in libs ## OpenSSL Recent Security Patches DevFeed: [OpenSSL Recent Security Patches]() Original publisher: [Read original article]() Published: 2023-10-26T17:00:15Z Content type: news Language: en Sources: [Node.js Blog]() Topics: [Node.js](), [Security](), [Vulnerabilities]() Tags: [cve](), [node](), [node-js](), [openssl](), [releases](), [security](), [vulnerabilities]() ### AI overview Node.js reports that Windows is affected by the low-severity CVE-2023-4807 vulnerability from the OpenSSL security advisories. The fix will be released through regular Node.js releases. Users invoking affected OpenSSL functions through native addons can link against a patched OpenSSL version until then. ### Source excerpt Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts. [Next page]()