Skip to content

crypto: fix RSA_PKCS1_PADDING error message#55629

Merged
nodejs-github-bot merged 1 commit intonodejs:mainfrom
richardlau:norevert
Nov 3, 2024
Merged

crypto: fix RSA_PKCS1_PADDING error message#55629
nodejs-github-bot merged 1 commit intonodejs:mainfrom
richardlau:norevert

Conversation

@richardlau
Copy link
Copy Markdown
Member

@richardlau richardlau commented Nov 1, 2024

The ability to revert the fix for CVE-2023-46809 was only added to Node.js 18.x, 20.x and 21.x as, per policy, security reverts are only added to the existing supported release lines at the time of the fix.

The error message thrown when RSA_PKCS1_PADDING is used on main and subsequent major versions (i.e. Node.js 22 and 23) when OpenSSL does not support implicit rejections should not have suggested that it is possible to revert the fix.

Fixes: #55628

Loading
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

author ready PRs that have at least one approval, no pending requests for changes, and a CI started. c++ Issues and PRs that require attention from people who are familiar with C++. crypto Issues and PRs related to the crypto subsystem. dont-land-on-v20.x PRs that should not land on the v20.x-staging branch and should not be released in v20.x. needs-ci PRs that need a full CI run.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Unable to use RSA_PKCS1_PADDING with v22+ - --security-revert suggests CVE-2024-PEND

8 participants