is this project affected by OpenSSL CRITICAL vulnerability ?

[Rod-O]

Soon to be released the fix for the major OpenSSL bug,

https://mta.openssl.org/pipermail/openssl-announce/2022-October/000238.html

does this project needs to update?

[the1ts]

Until its fully released its usually tricky to know, but I believe its version 3.0 of openssl thats affected, as NPM uses debian as its base its using 1.1 version.

[the1ts]

@Rod-O Yes, the 3.0 version of OpenSSL has a couple of problems around cert verification and 2 CVEs where opened and fixed today, but as stated, Debian and NPM are using the 1.1 branch of OpenSSL and not affected by these 2 problems. Good to check though.

[github-actions]

Issue is now considered stale. If you want to keep it open, please comment 👍

[github-actions]

Issue was closed due to inactivity.