diff --git a/pages/en/blog/release/v18.19.1.md b/pages/en/blog/release/v18.19.1.md new file mode 100644 index 0000000000000..b7ea96748c2c2 --- /dev/null +++ b/pages/en/blog/release/v18.19.1.md @@ -0,0 +1,116 @@ +--- +date: '2024-02-14T17:35:50.369Z' +category: release +title: Node v18.19.1 (LTS) +layout: blog-post.hbs +author: Rafael Gonzaga +--- + +## 2024-02-14, Version 18.19.1 'Hydrogen' (LTS), @RafaelGSS prepared by @marco-ippolito + +### Notable changes + +This is a security release. + +### Notable changes + +- CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High) +- CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High) +- CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium) +- CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium) +- undici version 5.28.3 +- npm version 10.2.4 + +### Commits + +- \[[`69e0a1dba8`](https://github.com/nodejs/node/commit/69e0a1dba8)] - **crypto**: update root certificates to NSS 3.95 (Node.js GitHub Bot) [#50805](https://github.com/nodejs/node/pull/50805) +- \[[`d3d357ab09`](https://github.com/nodejs/node/commit/d3d357ab09)] - **crypto**: disable PKCS#1 padding for privateDecrypt (Michael Dawson) [nodejs-private/node-private#525](https://github.com/nodejs-private/node-private/pull/525) +- \[[`3d27175c42`](https://github.com/nodejs/node/commit/3d27175c42)] - **deps**: fix GHSA-f74f-cvh7-c6q6/CVE-2024-24806 (Santiago Gimeno) [#51614](https://github.com/nodejs/node/pull/51614) +- \[[`331558b8ab`](https://github.com/nodejs/node/commit/331558b8ab)] - **deps**: update archs files for openssl-3.0.13+quic1 (Node.js GitHub Bot) [#51614](https://github.com/nodejs/node/pull/51614) +- \[[`99b77dfb9c`](https://github.com/nodejs/node/commit/99b77dfb9c)] - **deps**: upgrade openssl sources to quictls/openssl-3.0.13+quic1 (Node.js GitHub Bot) [#51614](https://github.com/nodejs/node/pull/51614) +- \[[`6cdc71bff1`](https://github.com/nodejs/node/commit/6cdc71bff1)] - **deps**: upgrade npm to 10.2.4 (npm team) [#50751](https://github.com/nodejs/node/pull/50751) +- \[[`911cb33cda`](https://github.com/nodejs/node/commit/911cb33cda)] - **http**: add maximum chunk extension size (Paolo Insogna) [nodejs-private/node-private#520](https://github.com/nodejs-private/node-private/pull/520) +- \[[`f48b89689d`](https://github.com/nodejs/node/commit/f48b89689d)] - **lib**: update undici to v5.28.3 (Matteo Collina) [nodejs-private/node-private#536](https://github.com/nodejs-private/node-private/pull/536) +- \[[`e6b4c105e0`](https://github.com/nodejs/node/commit/e6b4c105e0)] - **src**: fix HasOnly(capability) in node::credentials (Tobias Nießen) [nodejs-private/node-private#505](https://github.com/nodejs-private/node-private/pull/505) +- \[[`97c49076cd`](https://github.com/nodejs/node/commit/97c49076cd)] - **test**: skip test-child-process-stdio-reuse-readable-stdio on Windows (Joyee Cheung) [#49621](https://github.com/nodejs/node/pull/49621) +- \[[`60affdde8e`](https://github.com/nodejs/node/commit/60affdde8e)] - **tools**: add macOS notarization verification step (Ulises Gascón) [#50833](https://github.com/nodejs/node/pull/50833) +- \[[`ccc676a327`](https://github.com/nodejs/node/commit/ccc676a327)] - **tools**: use macOS keychain to notarize the releases (Ulises Gascón) [#50715](https://github.com/nodejs/node/pull/50715) +- \[[`31f1ceb380`](https://github.com/nodejs/node/commit/31f1ceb380)] - **tools**: remove unused file (Ulises Gascon) [#50622](https://github.com/nodejs/node/pull/50622) +- \[[`bd5f6fb92a`](https://github.com/nodejs/node/commit/bd5f6fb92a)] - **tools**: add macOS notarization stapler (Ulises Gascón) [#50625](https://github.com/nodejs/node/pull/50625) +- \[[`4168c4f71b`](https://github.com/nodejs/node/commit/4168c4f71b)] - **tools**: improve macOS notarization process output readability (Ulises Gascón) [#50389](https://github.com/nodejs/node/pull/50389) +- \[[`4622f775aa`](https://github.com/nodejs/node/commit/4622f775aa)] - **tools**: remove unused `version` function (Ulises Gascón) [#50390](https://github.com/nodejs/node/pull/50390) +- \[[`b90804b1e7`](https://github.com/nodejs/node/commit/b90804b1e7)] - **win,tools**: upgrade Windows signing to smctl (Stefan Stojanovic) [#50956](https://github.com/nodejs/node/pull/50956) +- \[[`f31d47e135`](https://github.com/nodejs/node/commit/f31d47e135)] - **zlib**: pause stream if outgoing buffer is full (Matteo Collina) [nodejs-private/node-private#542](https://github.com/nodejs-private/node-private/pull/542) + +Windows 32-bit Installer: https://nodejs.org/dist/v18.19.1/node-v18.19.1-x86.msi \ +Windows 64-bit Installer: https://nodejs.org/dist/v18.19.1/node-v18.19.1-x64.msi \ +Windows 32-bit Binary: https://nodejs.org/dist/v18.19.1/win-x86/node.exe \ +Windows 64-bit Binary: https://nodejs.org/dist/v18.19.1/win-x64/node.exe \ +macOS 64-bit Installer: https://nodejs.org/dist/v18.19.1/node-v18.19.1.pkg \ +macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v18.19.1/node-v18.19.1-darwin-arm64.tar.gz \ +macOS Intel 64-bit Binary: https://nodejs.org/dist/v18.19.1/node-v18.19.1-darwin-x64.tar.gz \ +Linux 64-bit Binary: https://nodejs.org/dist/v18.19.1/node-v18.19.1-linux-x64.tar.xz \ +Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v18.19.1/node-v18.19.1-linux-ppc64le.tar.xz \ +Linux s390x 64-bit Binary: https://nodejs.org/dist/v18.19.1/node-v18.19.1-linux-s390x.tar.xz \ +AIX 64-bit Binary: https://nodejs.org/dist/v18.19.1/node-v18.19.1-aix-ppc64.tar.gz \ +ARMv7 32-bit Binary: https://nodejs.org/dist/v18.19.1/node-v18.19.1-linux-armv7l.tar.xz \ +ARMv8 64-bit Binary: https://nodejs.org/dist/v18.19.1/node-v18.19.1-linux-arm64.tar.xz \ +Source Code: https://nodejs.org/dist/v18.19.1/node-v18.19.1.tar.gz \ +Other release files: https://nodejs.org/dist/v18.19.1/ \ +Documentation: https://nodejs.org/docs/v18.19.1/api/ + +### SHASUMS + +``` +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA256 + +747a958008620f96a030c44a7fd6be96f4b6cce7c250e25b57e71d856df1f466 node-v18.19.1-aix-ppc64.tar.gz +0c7249318868877032ed21cc0ed450015ee44b31b9b281955521cd3fc39fbfa3 node-v18.19.1-darwin-arm64.tar.gz +11a9782062a4ba438d24fc290a45611b267a0886e57009fe1c80c3979b6896f0 node-v18.19.1-darwin-arm64.tar.xz +ab67c52c0d215d6890197c951e1bd479b6140ab630212b96867395e21d813016 node-v18.19.1-darwin-x64.tar.gz +5bd94f20a24d5ec5292a020e80dbc41877d97b5ccd9ac632dd11e725bcf4cbf0 node-v18.19.1-darwin-x64.tar.xz +26b9d26623ee9c96bf49f12af2ddf80ad51f74ee219a1efc4cebc297ef7cde9b node-v18.19.1-headers.tar.gz +a184cabc7462773a484c0a24962c4bfa4a3e752f61049e17b74665ade391a4f7 node-v18.19.1-headers.tar.xz +2913e8544d95c8be9e6034c539ec0584014532166a088bf742629756c3ec42e2 node-v18.19.1-linux-arm64.tar.gz +228ad1eee660fba3f9fd2cccf02f05b8ebccc294d27f22c155d20b233a9d76b3 node-v18.19.1-linux-arm64.tar.xz +bbe61134fb41d96a335ad36a6dbfd0a05cfcb14b31046263de72a7e487b348d5 node-v18.19.1-linux-armv7l.tar.gz +7cebb39fc38db5f0b472a4ab6664b502b35901e92a452c72ea230416219f4f29 node-v18.19.1-linux-armv7l.tar.xz +1dee4b0c95ee00ab81b01db908eff22c51fb8da91cab6e71e3f48fd1b3fd9d16 node-v18.19.1-linux-ppc64le.tar.gz +2e5812b8fc00548e2e8ab9daa88ace13974c16b6ba5595a7a50c35f848f7d432 node-v18.19.1-linux-ppc64le.tar.xz +3d06ceb2be850f3d0e72e7bb6402c058f8dcc809fb3f9458400e93967c433ec5 node-v18.19.1-linux-s390x.tar.gz +15106acf4c9e3aca02416dd89fb5c71af77097042455a73f9caa064c1988ead5 node-v18.19.1-linux-s390x.tar.xz +724802c45237477dbe5777923743e6c77906830cae03a82b5653ebd75b301dda node-v18.19.1-linux-x64.tar.gz +f35f24edd4415cd609a2ebc03be03ed2cfe211d7333d55c752d831754fb849f0 node-v18.19.1-linux-x64.tar.xz +e8d383fc81ed2ee4c980f829e8687542ffda436eb4258636d2d628e83c9dff1c node-v18.19.1-win-x64.7z +ff08f8fe253fba9274992d7052e9d9a70141342d7b36ddbd6e84cbe823e312c6 node-v18.19.1-win-x64.zip +e0e949da689ef06b98b97668ec8f41268c89f74b03c564bc929d88486512db8d node-v18.19.1-win-x86.7z +179b642fede02bcd8009235b3608416117315429b58634fc918ae4d3d07435b6 node-v18.19.1-win-x86.zip +4bd88b56fe9147c778674f24a4a0c8693378454558ee2205036b15cb502bea73 node-v18.19.1-x64.msi +cc39f4d3556dc13139d76dfd22e3ee9350bf3d197b738664b171bf6893eaf1a1 node-v18.19.1-x86.msi +a7bded4becd7db897e1c196facd7877f5b0dfdb044d14f546dc8e14757a393c6 node-v18.19.1.pkg +637aa3f779a5a733657d4dde220747b82ab699075635990a9a611b00d2c20b09 node-v18.19.1.tar.gz +090f96a2ecde080b6b382c6d642bca5d0be4702a78cb555be7bf02b20bd16ded node-v18.19.1.tar.xz +ae958dbb83f4753931599090875edc2c9d1d7a56f9e864340813fdf949a28b8e win-x64/node.exe +834663bcd36a8aca80b89e2a711aa20811eb5560b6598c236b5f46724b7f8dfb win-x64/node.lib +5d44933090c151dab8ddf627d4a78a5bb074c779ba6b1358310bd4e539fece0e win-x64/node_pdb.7z +fd7b5400d210ec71545cf26a082c630cb679d9f8310d9e3e1b9a2051d34f1061 win-x64/node_pdb.zip +ccde023ef93f691c64cc1ff33b6c57d65bc293feb54ceab9601499618fc8eafa win-x86/node.exe +2b92b61e4507a95f00bf7788ba156077cbf432857d17ac1da9d994cae75fe987 win-x86/node.lib +179a6ce7da7add02e601b73107c5da00137ed0f68121cb67ecb740ba990649bd win-x86/node_pdb.7z +5e918a9c770e3d7d149c8e7dea33b32de5067385591c5f323dd43196e7b2401e win-x86/node_pdb.zip +-----BEGIN PGP SIGNATURE----- + +iQGzBAEBCAAdFiEEiQwI24V5Fi/uDfnbi+q0389VXvQFAmXM+PMACgkQi+q0389V +XvT/XAv+KG6Cm00Hme0gGvcJy2J2SB8vdChnXVHAu3lCptdvH+/CqyaygTAn9Yub +29kzzot0f16v8gjnxNe04gzLP8yvI15P309hgjJKMfsJ/BeyZtTjbtVqx04u1z72 +pMRLcvjDM45VGr67N5A/Kxal9pDdSDgr5+hEQpHkvro89hMaJwMwXJzZqTwgdWTI +k37EaGnrHqmVZyqxjUc97Ithr5oJFWmhH2vlBlazRnsMhv/LU+K5O21RfAou804m +Aw2CmsSoT4qlnk1NCtxXzxZjOVmz/5+86z8qIkjDDCWBUNMxRU77OXNYcHrpUwMi +R1UrUoePk/yUm9gkVDU0vELm4X0MoZOGcDrZvDhxO9IaHffSPjG0RljSsWRHxdce +T60srlDPYzXqSIEWzzU5y5lWnHG7eKy4ryTkswRjwGwuoPAfv/iSo2F0qvtXG7iC +qVCDCzmYOHeGn4nazusbqveh89KUvoxvfAcNp+YgPRc7F6lIWyfAuVlegjfWFlSR +3O/80Xum +=Y4eF +-----END PGP SIGNATURE----- +``` diff --git a/pages/en/blog/release/v20.11.1.md b/pages/en/blog/release/v20.11.1.md new file mode 100644 index 0000000000000..9587acb925c14 --- /dev/null +++ b/pages/en/blog/release/v20.11.1.md @@ -0,0 +1,126 @@ +--- +date: '2024-02-14T17:35:59.309Z' +category: release +title: Node v20.11.1 (LTS) +layout: blog-post.hbs +author: Rafael Gonzaga +--- + +## 2024-02-14, Version 20.11.1 'Iron' (LTS), @RafaelGSS prepared by @marco-ippolito + +### Notable changes + +This is a security release. + +### Notable changes + +- CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High) +- CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High) +- CVE-2024-21896 - Path traversal by monkey-patching Buffer internals- (High) +- CVE-2024-22017 - setuid() does not drop all privileges due to io_uring - (High) +- CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium) +- CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium) +- CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium) +- CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium) +- undici version 5.28.3 +- libuv version 1.48.0 +- OpenSSL version 3.0.13+quic1 + +### Commits + +- \[[`7079c062bb`](https://github.com/nodejs/node/commit/7079c062bb)] - **crypto**: disable PKCS#1 padding for privateDecrypt (Michael Dawson) [nodejs-private/node-private#525](https://github.com/nodejs-private/node-private/pull/525) +- \[[`186a6e1ffb`](https://github.com/nodejs/node/commit/186a6e1ffb)] - **deps**: fix GHSA-f74f-cvh7-c6q6/CVE-2024-24806 (Santiago Gimeno) [#51737](https://github.com/nodejs/node/pull/51737) +- \[[`686da19abb`](https://github.com/nodejs/node/commit/686da19abb)] - **deps**: disable io_uring support in libuv by default (Tobias Nießen) [nodejs-private/node-private#529](https://github.com/nodejs-private/node-private/pull/529) +- \[[`f7b44bfbce`](https://github.com/nodejs/node/commit/f7b44bfbce)] - **deps**: update archs files for openssl-3.0.13+quic1 (Node.js GitHub Bot) [#51614](https://github.com/nodejs/node/pull/51614) +- \[[`7a30fecea2`](https://github.com/nodejs/node/commit/7a30fecea2)] - **deps**: upgrade openssl sources to quictls/openssl-3.0.13+quic1 (Node.js GitHub Bot) [#51614](https://github.com/nodejs/node/pull/51614) +- \[[`480fc169a8`](https://github.com/nodejs/node/commit/480fc169a8)] - **fs**: protect against modified Buffer internals in possiblyTransformPath (Tobias Nießen) [nodejs-private/node-private#497](https://github.com/nodejs-private/node-private/pull/497) +- \[[`77ac7c3153`](https://github.com/nodejs/node/commit/77ac7c3153)] - **http**: add maximum chunk extension size (Paolo Insogna) [nodejs-private/node-private#519](https://github.com/nodejs-private/node-private/pull/519) +- \[[`ed7d149675`](https://github.com/nodejs/node/commit/ed7d149675)] - **lib**: use cache fs internals against path traversal (RafaelGSS) [nodejs-private/node-private#516](https://github.com/nodejs-private/node-private/pull/516) +- \[[`89bd5fc38f`](https://github.com/nodejs/node/commit/89bd5fc38f)] - **lib**: update undici to v5.28.3 (Matteo Collina) [nodejs-private/node-private#539](https://github.com/nodejs-private/node-private/pull/539) +- \[[`d01dd4291d`](https://github.com/nodejs/node/commit/d01dd4291d)] - **permission**: fix wildcard when children > 1 (Rafael Gonzaga) [#51209](https://github.com/nodejs/node/pull/51209) +- \[[`40ff37dfcc`](https://github.com/nodejs/node/commit/40ff37dfcc)] - **src**: fix HasOnly(capability) in node::credentials (Tobias Nießen) [nodejs-private/node-private#505](https://github.com/nodejs-private/node-private/pull/505) +- \[[`3f6addd590`](https://github.com/nodejs/node/commit/3f6addd590)] - **src,deps**: disable setuid() etc if io_uring enabled (Tobias Nießen) [nodejs-private/node-private#529](https://github.com/nodejs-private/node-private/pull/529) +- \[[`d6da413aa4`](https://github.com/nodejs/node/commit/d6da413aa4)] - **test,doc**: clarify wildcard usage (RafaelGSS) [nodejs-private/node-private#517](https://github.com/nodejs-private/node-private/pull/517) +- \[[`c213910aea`](https://github.com/nodejs/node/commit/c213910aea)] - **zlib**: pause stream if outgoing buffer is full (Matteo Collina) [nodejs-private/node-private#541](https://github.com/nodejs-private/node-private/pull/541) + +Windows 32-bit Installer: https://nodejs.org/dist/v20.11.1/node-v20.11.1-x86.msi \ +Windows 64-bit Installer: https://nodejs.org/dist/v20.11.1/node-v20.11.1-x64.msi \ +Windows ARM 64-bit Installer: https://nodejs.org/dist/v20.11.1/node-v20.11.1-arm64.msi \ +Windows 32-bit Binary: https://nodejs.org/dist/v20.11.1/win-x86/node.exe \ +Windows 64-bit Binary: https://nodejs.org/dist/v20.11.1/win-x64/node.exe \ +Windows ARM 64-bit Binary: https://nodejs.org/dist/v20.11.1/win-arm64/node.exe \ +macOS 64-bit Installer: https://nodejs.org/dist/v20.11.1/node-v20.11.1.pkg \ +macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v20.11.1/node-v20.11.1-darwin-arm64.tar.gz \ +macOS Intel 64-bit Binary: https://nodejs.org/dist/v20.11.1/node-v20.11.1-darwin-x64.tar.gz \ +Linux 64-bit Binary: https://nodejs.org/dist/v20.11.1/node-v20.11.1-linux-x64.tar.xz \ +Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v20.11.1/node-v20.11.1-linux-ppc64le.tar.xz \ +Linux s390x 64-bit Binary: https://nodejs.org/dist/v20.11.1/node-v20.11.1-linux-s390x.tar.xz \ +AIX 64-bit Binary: https://nodejs.org/dist/v20.11.1/node-v20.11.1-aix-ppc64.tar.gz \ +ARMv7 32-bit Binary: https://nodejs.org/dist/v20.11.1/node-v20.11.1-linux-armv7l.tar.xz \ +ARMv8 64-bit Binary: https://nodejs.org/dist/v20.11.1/node-v20.11.1-linux-arm64.tar.xz \ +Source Code: https://nodejs.org/dist/v20.11.1/node-v20.11.1.tar.gz \ +Other release files: https://nodejs.org/dist/v20.11.1/ \ +Documentation: https://nodejs.org/docs/v20.11.1/api/ + +### SHASUMS + +``` +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA256 + +43a881788549e1b3425eb5f2b92608f438f146e08213de09c5bd5ff841cae7ae node-v20.11.1-aix-ppc64.tar.gz +3f8e77b775372c0b27d2b85ce899d80339691f480e64dde43d4eb01504a58679 node-v20.11.1-arm64.msi +e0065c61f340e85106a99c4b54746c5cee09d59b08c5712f67f99e92aa44995d node-v20.11.1-darwin-arm64.tar.gz +fd771bf3881733bfc0622128918ae6baf2ed1178146538a53c30ac2f7006af5b node-v20.11.1-darwin-arm64.tar.xz +c52e7fb0709dbe63a4cbe08ac8af3479188692937a7bd8e776e0eedfa33bb848 node-v20.11.1-darwin-x64.tar.gz +ed69f1f300beb75fb4cad45d96aacd141c3ddca03b6d77c76b42cb258202363d node-v20.11.1-darwin-x64.tar.xz +0aa42c91b441e945ff43bd3a837759c58b436de57dcd033d02e5cbcd2fba1f87 node-v20.11.1-headers.tar.gz +edce238817acf5adce3123366b55304aff2a1f0849231d1b49f42370e454b6f8 node-v20.11.1-headers.tar.xz +e34ab2fc2726b4abd896bcbff0250e9b2da737cbd9d24267518a802ed0606f3b node-v20.11.1-linux-arm64.tar.gz +c957f29eb4e341903520caf362534f0acd1db7be79c502ae8e283994eed07fe1 node-v20.11.1-linux-arm64.tar.xz +e42791f76ece283c7a4b97fbf716da72c5128c54a9779f10f03ae74a4bcfb8f6 node-v20.11.1-linux-armv7l.tar.gz +28e0120d2d150a8f41717899d33167b8b32053778665583d49ff971bfd188d1b node-v20.11.1-linux-armv7l.tar.xz +9823305ac3a66925a9b61d8032f6bbb4c3e33c28e7f957ebb27e49732feffb23 node-v20.11.1-linux-ppc64le.tar.gz +51343cacf5cdf5c4b5e93e919d19dd373d6ef43d5f2c666eae299f26e31d08b5 node-v20.11.1-linux-ppc64le.tar.xz +4c66b2f247fdd8720853321526d7cda483018fcb32014b75c30f3a54ecacaea7 node-v20.11.1-linux-s390x.tar.gz +b32616b705cd0ddbb230b95c693e3d7a37becc2ced9bcadea8dc824cceed6be0 node-v20.11.1-linux-s390x.tar.xz +bf3a779bef19452da90fb88358ec2c57e0d2f882839b20dc6afc297b6aafc0d7 node-v20.11.1-linux-x64.tar.gz +d8dab549b09672b03356aa2257699f3de3b58c96e74eb26a8b495fbdc9cf6fbe node-v20.11.1-linux-x64.tar.xz +f1cd449fcbeb1b948e8498cb8edd9655fa319d109a7f4c5bd96a9b122b91538a node-v20.11.1-win-arm64.7z +e85461ec124956a2853c4ee6e13c4f4889d63c88beb3d530c1ee0c4b51dc10e7 node-v20.11.1-win-arm64.zip +fb9b5348259988a562a48eed7349e7e716c0bec78d98ad0a336b2993a8b3bf34 node-v20.11.1-win-x64.7z +bc032628d77d206ffa7f133518a6225a9c5d6d9210ead30d67e294ff37044bda node-v20.11.1-win-x64.zip +c2b1863d8979546804a39fc63d0a9bc9c6e49cb2f6c9d1e52844a24629b24765 node-v20.11.1-win-x86.7z +b98e95f78416d1359b647cfa09ba2a48b76d41b56a776df822bf36ffe8e76a2d node-v20.11.1-win-x86.zip +c54f5f7e2416e826fd84e878f28e3b53363ae9c3f60a140af4434b2453b5ae89 node-v20.11.1-x64.msi +63e2aed4dabb96eed6903a3974e006d3c29c218472aac60ae3c3c7de00df13b1 node-v20.11.1-x86.msi +c46019a095a1549d000e85da13f17972a448e0be5854a51786ecccde7278a012 node-v20.11.1.pkg +4af1ba6ea848cc05908b8a62b02fb27684dd52b2a7988ee82b0cfa72deb90b94 node-v20.11.1.tar.gz +77813edbf3f7f16d2d35d3353443dee4e61d5ee84d9e3138c7538a3c0ca5209e node-v20.11.1.tar.xz +a5a9d30a8f7d56e00ccb27c1a7d24c8d0bc96a2689ebba8eb7527698793496f1 win-arm64/node.exe +93529170cebe57c0f4830a4cc6a261b6cc9bcf0cd8b3e88ac4995a5015031d79 win-arm64/node.lib +c14c6e927406b8683cbfb8a67ca4c8fd5093ca7812b5b1627e3d6a53d3674565 win-arm64/node_pdb.7z +68034cd09d8dfaa755d1b280da13e20388cc486ac57b037b3e11dfe2d6b74284 win-arm64/node_pdb.zip +bc585910690318aaebe3c57669cb83ca9d1e5791efd63195e238f54686e6c2ec win-x64/node.exe +53a982d490cb9fcc4b231a8b95147de423b36186bc6f4ba5697b20117fdcbd5d win-x64/node.lib +ccac9f2f5219ed858aeddb306d6493478ba9675c7cbf009e83742437d6752c4f win-x64/node_pdb.7z +bec5da4035c84580843978a59ef9bcc1c0eaca881cf9e1c94e63a1862cf14421 win-x64/node_pdb.zip +3829137e062b1e2eb9947ef05e4b717ae578a8fce1c5c60fe4f6ae7ef2ec0240 win-x86/node.exe +c5321bb65dcecb3989f9b8f6ec56369c16627ca4bade0c78afb6b88f7dde50e4 win-x86/node.lib +20ca60ced1fc21f15ea952b4406aec6bde39d20eab11cf042040628841b2249e win-x86/node_pdb.7z +bef05cebedce5949ae35e87e7d4789c16fa73caf478483fcf92e5dbb9ba5d774 win-x86/node_pdb.zip +-----BEGIN PGP SIGNATURE----- + +iQGzBAEBCAAdFiEEiQwI24V5Fi/uDfnbi+q0389VXvQFAmXM+TcACgkQi+q0389V +XvQl3AwAqqm2uBMDzd+BlR1sG7y/eUtUYPVdwmCh0DeFXPHxuaIbFf0PGMEgcV8u +kn3OBF4pnSCPZNbJYJsLO1S+b/5Vk+Vlkq1WkOxqQHUHmM9GcJUuShadl0YaDNen +WXXMoYKWqMRJ6fQ3tRRh+vbMSXtsLqXT8TMVJq+Qb7a7yj4QRjw/Dd+8uKGGIhBY +U04HWsz33RJLu6AUnhF03eO1N8E1V48JptklDx5ZkY8GYa3F6jQsFld+jhmkZ9tg +4q9NDNijVpj56UsUhLAYD0J9IKS18tvQxNrKmBGUSZjFOByVhbUdLXnSMtW1i1U9 +cYhP6Q5wg/fnjqCfQ90TauoJZOblKIL/PHlf6cQGPrrRa1bz3xGyCAIve5KFhLxf +Vfj1ctk2ktzmuNhjAu5G/1VALQUNpiTm4Yz433JpoMMZ3mTHN+fuALOX4TQbdLRz +HKphTz02436348XC9bNz2cvjm74cy9fqwjQ/y84AmxiTJMFPg0XqICg4tu9rd49d +8FJc4TLZ +=r/CD +-----END PGP SIGNATURE----- +``` diff --git a/pages/en/blog/release/v21.6.2.md b/pages/en/blog/release/v21.6.2.md new file mode 100644 index 0000000000000..69997e45c3e49 --- /dev/null +++ b/pages/en/blog/release/v21.6.2.md @@ -0,0 +1,125 @@ +--- +date: '2024-02-14T17:36:06.168Z' +category: release +title: Node v21.6.2 (Current) +layout: blog-post.hbs +author: Rafael Gonzaga +--- + +## 2024-02-14, Version 21.6.2 (Current), @RafaelGSS + +### Notable changes + +This is a security release. + +### Notable changes + +- CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High) +- CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High) +- CVE-2024-21896 - Path traversal by monkey-patching Buffer internals- (High) +- CVE-2024-22017 - setuid() does not drop all privileges due to io_uring - (High) +- CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium) +- CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium) +- CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium) +- CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium) +- undici version 5.28.3 +- libuv version 1.48.0 +- OpenSSL version 3.0.13+quic1 + +### Commits + +- \[[`8344719369`](https://github.com/nodejs/node/commit/8344719369)] - **crypto**: disable PKCS#1 padding for privateDecrypt (Michael Dawson) [nodejs-private/node-private#525](https://github.com/nodejs-private/node-private/pull/525) +- \[[`d093600ac4`](https://github.com/nodejs/node/commit/d093600ac4)] - **deps**: update archs files for openssl-3.0.13+quic1 (Node.js GitHub Bot) [#51614](https://github.com/nodejs/node/pull/51614) +- \[[`6cd930e5e8`](https://github.com/nodejs/node/commit/6cd930e5e8)] - **deps**: upgrade openssl sources to quictls/openssl-3.0.13+quic1 (Node.js GitHub Bot) [#51614](https://github.com/nodejs/node/pull/51614) +- \[[`9590c15d3d`](https://github.com/nodejs/node/commit/9590c15d3d)] - **deps**: upgrade libuv to 1.48.0 (Santiago Gimeno) [#51698](https://github.com/nodejs/node/pull/51698) +- \[[`666096298c`](https://github.com/nodejs/node/commit/666096298c)] - **deps**: disable io_uring support in libuv by default (Tobias Nießen) [nodejs-private/node-private#528](https://github.com/nodejs-private/node-private/pull/528) +- \[[`a4edd22e30`](https://github.com/nodejs/node/commit/a4edd22e30)] - **fs**: protect against modified Buffer internals in possiblyTransformPath (Tobias Nießen) [nodejs-private/node-private#497](https://github.com/nodejs-private/node-private/pull/497) +- \[[`6155a1ffaf`](https://github.com/nodejs/node/commit/6155a1ffaf)] - **http**: add maximum chunk extension size (Paolo Insogna) [nodejs-private/node-private#518](https://github.com/nodejs-private/node-private/pull/518) +- \[[`777509495e`](https://github.com/nodejs/node/commit/777509495e)] - **lib**: use cache fs internals against path traversal (RafaelGSS) [nodejs-private/node-private#516](https://github.com/nodejs-private/node-private/pull/516) +- \[[`9d2ac2b3fc`](https://github.com/nodejs/node/commit/9d2ac2b3fc)] - **lib**: update undici to v5.28.3 (Matteo Collina) [nodejs-private/node-private#538](https://github.com/nodejs-private/node-private/pull/538) +- \[[`208b3940c7`](https://github.com/nodejs/node/commit/208b3940c7)] - **src**: fix HasOnly(capability) in node::credentials (Tobias Nießen) [nodejs-private/node-private#505](https://github.com/nodejs-private/node-private/pull/505) +- \[[`fc2454f29c`](https://github.com/nodejs/node/commit/fc2454f29c)] - **src,deps**: disable setuid() etc if io_uring enabled (Tobias Nießen) [nodejs-private/node-private#528](https://github.com/nodejs-private/node-private/pull/528) +- \[[`ef3eea20be`](https://github.com/nodejs/node/commit/ef3eea20be)] - **test,doc**: clarify wildcard usage (RafaelGSS) [nodejs-private/node-private#517](https://github.com/nodejs-private/node-private/pull/517) +- \[[`8547196964`](https://github.com/nodejs/node/commit/8547196964)] - **zlib**: pause stream if outgoing buffer is full (Matteo Collina) [nodejs-private/node-private#540](https://github.com/nodejs-private/node-private/pull/540) + +Windows 32-bit Installer: https://nodejs.org/dist/v21.6.2/node-v21.6.2-x86.msi \ +Windows 64-bit Installer: https://nodejs.org/dist/v21.6.2/node-v21.6.2-x64.msi \ +Windows ARM 64-bit Installer: https://nodejs.org/dist/v21.6.2/node-v21.6.2-arm64.msi \ +Windows 32-bit Binary: https://nodejs.org/dist/v21.6.2/win-x86/node.exe \ +Windows 64-bit Binary: https://nodejs.org/dist/v21.6.2/win-x64/node.exe \ +Windows ARM 64-bit Binary: https://nodejs.org/dist/v21.6.2/win-arm64/node.exe \ +macOS 64-bit Installer: https://nodejs.org/dist/v21.6.2/node-v21.6.2.pkg \ +macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v21.6.2/node-v21.6.2-darwin-arm64.tar.gz \ +macOS Intel 64-bit Binary: https://nodejs.org/dist/v21.6.2/node-v21.6.2-darwin-x64.tar.gz \ +Linux 64-bit Binary: https://nodejs.org/dist/v21.6.2/node-v21.6.2-linux-x64.tar.xz \ +Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v21.6.2/node-v21.6.2-linux-ppc64le.tar.xz \ +Linux s390x 64-bit Binary: https://nodejs.org/dist/v21.6.2/node-v21.6.2-linux-s390x.tar.xz \ +AIX 64-bit Binary: https://nodejs.org/dist/v21.6.2/node-v21.6.2-aix-ppc64.tar.gz \ +ARMv7 32-bit Binary: https://nodejs.org/dist/v21.6.2/node-v21.6.2-linux-armv7l.tar.xz \ +ARMv8 64-bit Binary: https://nodejs.org/dist/v21.6.2/node-v21.6.2-linux-arm64.tar.xz \ +Source Code: https://nodejs.org/dist/v21.6.2/node-v21.6.2.tar.gz \ +Other release files: https://nodejs.org/dist/v21.6.2/ \ +Documentation: https://nodejs.org/docs/v21.6.2/api/ + +### SHASUMS + +``` +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA256 + +e06dff53a5e2a88caff9735c076165a6a53f4c45960a8887410684e1fea6c7cb node-v21.6.2-aix-ppc64.tar.gz +c7fa8788001eaac4bb250a84f6b3a918ebaa8016111ece95d59b513cf4a394dc node-v21.6.2-arm64.msi +120c8205654c640865864dc464389b3ffe6d7ebe310dffdbe3fd8718a512e14f node-v21.6.2-darwin-arm64.tar.gz +f8aa996b4e7700069892bc9ff28ddef3b3b3c8c952b929d1b148c943995970e3 node-v21.6.2-darwin-arm64.tar.xz +0f75d9b46b986100c6faeec040ee46adf4981eb6abb5dd63e7a6ca4868d280f4 node-v21.6.2-darwin-x64.tar.gz +5944de39bc7b8af229b0024d583ced7c76cee194ee9068a07d67372a606c5105 node-v21.6.2-darwin-x64.tar.xz +55d9a03dcfce682583eb5e7eec15f32ae95b28b6e805f31688b22a7bd71581b1 node-v21.6.2-headers.tar.gz +976500ffa659108fa2eb30daae2f1b96a34a97b2caa1db30802ac56edc2b237a node-v21.6.2-headers.tar.xz +b8431985c53cc14e02cddf4c128d043c62af19023f908ebcdc1c6a683ee995f3 node-v21.6.2-linux-arm64.tar.gz +2606765f95262bcebb323e56a39b3be8db89863fbd83e06d2b5a08e41dc78f29 node-v21.6.2-linux-arm64.tar.xz +d6127be538ae57447fd40bac6ea124ad71cfd5a50b9343b781830cc92bc1a0c2 node-v21.6.2-linux-armv7l.tar.gz +ae33085c3d635f9488f47c56ee90fdf0dc9c1d0a520cfbe281c5b08d69e64da0 node-v21.6.2-linux-armv7l.tar.xz +2e265d86f9d20ba223d65ceadc0589b156439a5521cd9da6e34de5460a0d2195 node-v21.6.2-linux-ppc64le.tar.gz +b951f52db17b75a7bff0a2da2cefca3ba1e4dd7368b2b1280f39fcbecde0555c node-v21.6.2-linux-ppc64le.tar.xz +7cba8c2b2338aaa05f5dec5d953d61cdf5219881a7c8d420f215e920a33c06fa node-v21.6.2-linux-s390x.tar.gz +167bb0595478bae4c46b2248cae16890d24c2a9c92de7d0e27f9d1cafcad21ba node-v21.6.2-linux-s390x.tar.xz +d4504dcbcd1a9ded42d86bc20a7e72d6d631e49dcf3f9c849c3b51b12f3f4544 node-v21.6.2-linux-x64.tar.gz +593dd28f5c78d797e76b730937b95fcdfc594f053a8756b1d0860a4555bed58e node-v21.6.2-linux-x64.tar.xz +a0cdada31786f6ff1f82e8fd91bda23cd4f615a56acd3c9605cd468b60b8437a node-v21.6.2-win-arm64.7z +a201948e5f0df6de6c4b42dbcb42d7a10d3cb5b6dbb7a40e3f4244644d3b3d1a node-v21.6.2-win-arm64.zip +d450d170009d272c98765af3abf2bbc2903c1c08856f9e3730be03cc9d9b2bc5 node-v21.6.2-win-x64.7z +99bac3a930bd487e53c5a35b3e2f5ec102053316d7eb89f93273d916d57353a2 node-v21.6.2-win-x64.zip +44dee171378d7ac9967e772a8f114be5fdf59a163f65ec5faa7411c8be3bc961 node-v21.6.2-win-x86.7z +1701b32ba5315c794c2a64ef4a71e93ad2a6c109acf5b577d628413a7dc5cd04 node-v21.6.2-win-x86.zip +e081647df79c833e9d62e7edff5e9e01dbd5b78417dff6ef149e6384e8327bcf node-v21.6.2-x64.msi +12960661f83a1618adf57e84eddcd1886edec452d74f27318efde8b92a25c91a node-v21.6.2-x86.msi +6b5d7153dffec20487cbcb81d5ebaf97e6678eb463337e8429ba4e7b60754505 node-v21.6.2.pkg +9020fb36ec7e04f5032944c8422c2004350e9bfcd5e835ac3c90b74981c1f3e0 node-v21.6.2.tar.gz +191294d445d1e6800359acc8174529b1e18e102147dc5f596030d3dce96931e5 node-v21.6.2.tar.xz +ae7ccd1298e8871e61c1223a929ff482fa43d29aa284118798f01a73e40b2b29 win-arm64/node.exe +cf6082f3ffb45335d41566805c7b844082f36042fa7dc2dc6aecdc3ce0e7c79a win-arm64/node.lib +8cb47e9ebda0efb8578382db82001308bcb2de95e0275e0bca3ff4f03de140b1 win-arm64/node_pdb.7z +cdb3d760f9aca9578135c25f299b382e074bfcb56b2d321acf278a0a76ec2eb4 win-arm64/node_pdb.zip +3f06d98986b4ddf7e9d258936bb7b8907c44c6e9a29c645a5aca04e5a26c0b53 win-x64/node.exe +cacf06da3d7f04d0a0a5a901bfbdbaf0950cc5f73febf7b2f451b27c7f6265b1 win-x64/node.lib +077739fded97d02d026db839aca840622c34b7e584efe294d40fc8d1bd9dc19a win-x64/node_pdb.7z +54c3a6fea6f832716bfe5d918a56ca1767ae89163729c34d866c2623c0a90edf win-x64/node_pdb.zip +0aaa0f4635253afe9660f64a862786db555961ecc7217b68fa120817c0c56a00 win-x86/node.exe +ca6545afa230d2abdbf8ba19065f77b727bde72dfa253c466d876d0b3a7ea4ee win-x86/node.lib +cf24de1e7157ac4bac77fccb255fe295e8639a349d5c9f8726fe3e6b5ccf8afc win-x86/node_pdb.7z +99f2345e0e737fbd7f8d94b4118d9dc820ebc198823de29324e1f1754f84c9e0 win-x86/node_pdb.zip +-----BEGIN PGP SIGNATURE----- + +iQGzBAEBCAAdFiEEiQwI24V5Fi/uDfnbi+q0389VXvQFAmXM+XcACgkQi+q0389V +XvRIBQv+J+9C/N2aHF7mJJajSMJ67YZ1DjCwVt91loxcjnmt5aVx7LvluXkI3fBd +qzjx31Mvb45XeduyQaWgSzRgzanOJbXoQEQSqeeL4ubQV1Rq8UtTWl7/NZQQt6lX +ZY9Icg1BS577NwayCyKhoRjViq7waWkh07EfLZvMvl5Y85x/rIN6EF7YiscwhN10 +oUEgNBS1txHy9grCHU42iNqKzI2jguPYLauvcj6QebZxFg1OhWp5q2lVDGckW5Sh +2pLKkvIRru+6oFZ848fu8sxxWxLZSbWSumVBbxmmoWGjWMK8zdCf3PbKBXkgm66y +yn4jnk5iDquottcf3BMcDBivcXcNv+x0DdWMq27YjVHfgxwhYYcDOBXlDtSY2zhd +njX2t3/96GrDIgZMNoBgGre7WWvInLYr7r5ejPoXVGbRd9AtOd65TbzsoKsJzrwG +LcVZ7ppfIGaV8T76q2tdMmfbvmGDOyJ6sXF2U4VzcqRVnfyIuIkM74S06BJIywBI +BvL6HeBI +=loKR +-----END PGP SIGNATURE----- +``` diff --git a/pages/en/blog/vulnerability/february-2024-security-releases.md b/pages/en/blog/vulnerability/february-2024-security-releases.md index f3a652b7b6bc3..617cd93ba1ff9 100644 --- a/pages/en/blog/vulnerability/february-2024-security-releases.md +++ b/pages/en/blog/vulnerability/february-2024-security-releases.md @@ -1,12 +1,135 @@ --- -date: '2024-01-30T17:30:00.617Z' +date: '2024-02-14T15:30:00.617Z' category: vulnerability -title: Tuesday February 13 2024 Security Releases +title: Wednesday February 14 2024 Security Releases layout: blog-post.hbs -author: Rafael Gonzaga +author: Rafael Gonzaga & Marco Ippolito --- -## _(Update 14-February-2024)_ Security Release target Wednesday 14th +## _(Update 14-February-2024)_ Security releases available + +Updates are now available for the v18.x, v20.x and v21.x Node.js release lines for the +following issues. + +This security release includes the following dependency updates to address public vulnerabilities: + +- libuv 1.48.0 v21.x (CVE-2024-24806). +- libuv on v18.x and v20.x has been patched to address CVE-2024-24806. +- undici 5.28.3 on all release lines (CVE-2024-24758, GHSA-3787-6prv-h9w3). + +## OpenSSL Security updates + +This security release includes an OpenSSL update to version 3.0.13+quic1 on all release lines to address advisories: + +- [OpenSSL security advisory 6th November](https://mta.openssl.org/pipermail/openssl-announce/2023-November/000284.html) +- [OpenSSL security advisory 9th January](https://mta.openssl.org/pipermail/openssl-announce/2024-January/000288.html). +- [OpenSSL security advisory 15th January](https://mta.openssl.org/pipermail/openssl-announce/2024-January/000289.html). +- [OpenSSL security advisory 25th January](https://mta.openssl.org/pipermail/openssl-announce/2024-January/000292.html). + +## Code injection and privilege escalation through Linux capabilities (CVE-2024-21892) - (High) + +On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with elevated privileges with the only exception of CAP_NET_BIND_SERVICE. + +Due to a bug in the implementation of this exception, Node.js incorrectly applies this exception even when certain other capabilities have been set. + +This allows unprivileged users to inject code that inherits the process's elevated privileges. + +Impacts: + +- This vulnerability affects all users in all active release lines: 18.x, 20.x, and 21.x. + +Thank you, to [Tobias Nießen](https://github.com/tniessen) for reporting this vulnerability and for fixing it. + +## Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (CVE-2024-22019) - (High) + +A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, +leading to resource exhaustion and denial of service (DoS). + +The server reads an unbounded number of bytes from a single connection, exploiting the lack of limitations on chunk extension bytes. + +The issue can cause CPU and network bandwidth exhaustion, bypassing standard safeguards like timeouts and body size limits. + +Impacts: + +- This vulnerability affects all users in all active release lines: 18.x, 20.x, and 21.x. + +Thank you, to Bartek Nowotarski for reporting this vulnerability and thank you [Paolo Insogna](https://github.com/ShogunPanda) +for fixing it. + +## Path traversal by monkey-patching Buffer internals (CVE-2024-21896) - (High) + +The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. +If the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve(). + +By monkey-patching Buffer internals, namely, Buffer.prototype.utf8Write, the application can modify the result of path.resolve(), which leads to a path traversal vulnerability. + +Impacts: + +- This vulnerability affects all users using the experimental permission model in active release + lines: 20.x and 21.x. + +Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. +Thank you, to [Tobias Nießen](https://github.com/tniessen) for reporting this vulnerability and for fixing it. + +## setuid() does not drop all privileges due to io_uring (CVE-2024-22017) - (High) + +setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). + +This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). + +Impacts: + +- This vulnerability affects all users in active release lines: 20.x, and 21.x. + +Thank you, to valette for reporting this vulnerability and thank you [Tobias Nießen](https://github.com/tniessen) +for fixing it. + +## Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (CVE-2023-46809) - (Medium) + +A vulnerability in the privateDecrypt() API of the crypto library, allowed a covert timing side-channel during PKCS#1 v1.5 padding error handling. + +The vulnerability revealed significant timing differences in decryption for valid and invalid ciphertexts. + +This poses a serious threat as attackers could remotely exploit the vulnerability to decrypt captured RSA ciphertexts or forge signatures, especially in scenarios involving API endpoints processing Json Web Encryption messages. + +Impacts: + +- This vulnerability affects all users in all active release lines: 18.x, 20.x, and 21.x. + +Thank you, to hkario for reporting this vulnerability and thank you [Michael Dawson](https://github.com/mhdawson) +for fixing it. + +## Multiple permission model bypasses due to improper path traversal sequence sanitization (CVE-2024-21891) - (Medium) + +Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack. + +Impacts: + +- This vulnerability affects all users using the experimental permission model in active release + lines: 20.x and 21.x. + +Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. + +Thank you, to xion for reporting this vulnerability and thank you [Rafael Gonzaga](https://github.com/RafaelGSS) +for fixing it. + +## Improper handling of wildcards in --allow-fs-read and --allow-fs-write (CVE-2024-21890) - (Medium) + +The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. + +For example: `--allow-fs-read=/home/node/.ssh/*.pub` will ignore pub and give access to everything after .ssh/. + +Impacts: + +- This misleading documentation affects all users using the experimental permission model in active release + lines: 20.x and 21.x. + +Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js. + +Thank you, to [Tobias Nießen](https://github.com/tniessen) for reporting this vulnerability and thank you [Rafael Gonzaga](https://github.com/RafaelGSS) +for fixing it. + +## _(Update 13-February-2024)_ Security Release target Wednesday 14th Due to a long pipeline test on this security release, additional time was required. Therefore, the new target date is Wednesday 14th. diff --git a/site.json b/site.json index e161db67b4cd4..eb0a1792908f1 100644 --- a/site.json +++ b/site.json @@ -28,9 +28,9 @@ ], "websiteBanners": { "index": { - "startDate": "2024-02-13T17:30:00.000Z", - "endDate": "2024-02-20T17:30:00.000Z", - "text": "New security releases to be made available February 14th, 2024", + "startDate": "2024-02-14T15:30:00.000Z", + "endDate": "2024-02-21T17:30:00.000Z", + "text": "New security releases available", "link": "https://nodejs.org/en/blog/vulnerability/february-2024-security-releases/" } },