blog: add March 2018 security releases post

Refs: #1599

Author: rvagg

build.js

@@ -270,8 +270,8 @@ function getSource (callback) {
         },
         banner: {
           visible: true,
-          text: 'Spectre and Meltdown in the context of Node.js.',
-          link: 'https://nodejs.org/en/blog/vulnerability/jan-2018-spectre-meltdown/'
+          text: 'March 2018 Security Releases',
+          link: '/en/blog/vulnerability/march-2018-security-releases/'
         }
       }
     }

locale/en/blog/vulnerability/march-2018-security-releases.md

@@ -0,0 +1,76 @@
+---
+date: 2018-03-21T23:49:59.230Z
+category: vulnerability
+title: March 2018 Security Releases
+slug: march-2018-security-releases
+layout: blog-post.hbs
+author: Rod Vagg
+---
+
+## Summary
+
+The Node.js project will be releasing new versions for each of its supported release lines on, or shortly after, the 27th of March, 2018 (UTC). These releases will incorporate a number of security fixes and will also likely include an upgraded version of OpenSSL.
+
+## Inclusions
+
+### OpenSSL 1.0.2o
+
+The OpenSSL team [have announced](https://mta.openssl.org/pipermail/openssl-announce/2018-March/000116.html) that OpenSSL 1.0.2o will be made available on the 27th of March, 2018. The highest severity issue fixed in these releases is MODERATE. According to the [OpenSSL Security Policy](https://www.openssl.org/policies/secpolicy.html), this classification is defined as follows:
+
+> MODERATE Severity. This includes issues like crashes in client applications, flaws in protocols that are less commonly used (such as DTLS), and local flaws. These will in general be kept private until the next release, and that release will be scheduled so that it can roll up several such flaws at one time.
+
+This post will be updated with a Node.js impact assessment for the flaws addressed in this OpenSSL release. However, regardless of severity, all actively supported Node.js release lines will likely receive an upgrade from OpenSSL 1.0.2n to 1.0.2o.
+
+**Impact:**
+
+* All versions of Node.js 4.x (LTS "Argon") **are** impacted
+* All versions of Node.js 6.x (LTS "Boron") **are** impacted
+* All versions of Node.js 8.x (LTS "Carbon") **are** impacted
+* All versions of Node.js 9.x (Current) **are** impacted
+
+### Denial of service (DoS) vulnerability
+
+All versions of 4.x are vulnerable to a flaw that can be used by an external attacker to cause a denial of service (DoS). The severity of this vulnerability is HIGH, users of the impacted versions should plan to upgrade when a fix is made available.
+
+**Impact:**
+
+* All versions of Node.js 4.x (LTS "Argon") **are** vulnerable
+* All versions of Node.js 6.x (LTS "Boron") **are NOT** vulnerable
+* All versions of Node.js 8.x (LTS "Carbon") **are NOT** vulnerable
+* All versions of Node.js 9.x (Current) **are NOT** vulnerable
+
+### HTTP parsing flaw
+
+All versions of Node.js contain a flaw in their HTTP parser whereby a malformed HTTP request may be misinterpreted. The security impact of this flaw is minimal and therefore the severity is VERY LOW. The impact relates to usability concerns but we are currently not aware of practical uses of this flaw to attack well-constructed HTTP servers.
+
+**Impact:**
+
+* All versions of Node.js 4.x (LTS "Argon") **are** vulnerable
+* All versions of Node.js 6.x (LTS "Boron") **are** vulnerable
+* All versions of Node.js 8.x (LTS "Carbon") **are** vulnerable
+* All versions of Node.js 9.x (Current) **are** vulnerable
+
+### Update root certificates
+
+All releases will also include an update to the root certificates that are bundled in the Node.js binary. This includes 5 new additional certificates and the removal of 30 certificates. Details are available in on the public Node.js repository at <https://github.com/nodejs/node/pull/19322>.
+
+Please note that the [`NODE_EXTRA_CA_CERTS`](https://nodejs.org/docs/latest-v4.x/api/cli.html#cli_node_extra_ca_certs_file) environment variable may be used to add back in certificates that have been removed if required (although this is not advised). In addition, the `ca` option may be used when creating TLS or HTTPS servers to provide a custom list of trusted certificates.
+
+## Regarding Node.js 4.x (LTS "Argon")
+
+Please be aware that according to the Node.js [release schedule](https://github.com/nodejs/release#release-schedule), support for Node.js 4.x (LTS "Argon") will cease on the 30th of April. As this release line is in "Maintenance" and therefore receives minimal updates, this upcoming release of Node.js 4.x may be the final version for that release line.
+
+If you have not already migrated from Node.js 4.x to a later release line, please do so at your earliest convenience. The Node.js team recommends adopting either Node.js 6.x (LTS "Boron") or Node.js 8.x (LTS "Carbon").
+
+## Release timing
+
+Releases will be available at, or shortly after, the 27th of March, 2018 (UTC), along with disclosure of the details for the flaws addressed in each release in order to allow for complete impact assessment by users.
+
+## Contact and future updates
+
+The current Node.js security policy can be found at https://nodejs.org/en/security/.
+
+Please contact [email protected] if you wish to report a vulnerability in Node.js.
+
+Subscribe to the low-volume announcement-only nodejs-sec mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the [nodejs GitHub organization](https://github.com/nodejs/).
+