From 03f4920d6a8b4ac1d990f7659f2815075c8c896b Mon Sep 17 00:00:00 2001 From: Rod Vagg Date: Tue, 27 Sep 2016 22:33:58 +1000 Subject: [PATCH] crypto: don't build hardware engines Compile out hardware engines. `ENGINE_load_builtin_engines()` is not called in v0.10 so this does not represent a known security vulnerability. Backport of https://github.com/nodejs/node-private/pull/58 PR-URL: https://github.com/nodejs/node-private/pull/68 Reviewed-By: Fedor Indutny Reviewed-By: Ben Noordhuis --- deps/openssl/openssl.gyp | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/deps/openssl/openssl.gyp b/deps/openssl/openssl.gyp index 58feb474453bb8..462111d53226e0 100644 --- a/deps/openssl/openssl.gyp +++ b/deps/openssl/openssl.gyp @@ -1099,6 +1099,11 @@ # Microsoft's IIS, which seems to be ignoring whole ClientHello after # seeing this extension. 'OPENSSL_NO_HEARTBEATS', + + # Compile out hardware engines. Most are stubs that dynamically load + # the real driver but that poses a security liability when an attacker + # is able to create a malicious DLL in one of the default search paths. + 'OPENSSL_NO_HW', ], 'direct_dependent_settings': { 'defines': [