From 24b34c2ec66390787ae31af69cf035ba0062c264 Mon Sep 17 00:00:00 2001 From: RafaelGSS Date: Thu, 12 Oct 2023 12:14:20 -0300 Subject: [PATCH 1/4] blog: add october 13th pre-announcement security release --- .../october-2023-security-releases.md | 37 +++++++++++++++++++ site.json | 8 ++-- 2 files changed, 41 insertions(+), 4 deletions(-) create mode 100644 pages/en/blog/vulnerability/october-2023-security-releases.md diff --git a/pages/en/blog/vulnerability/october-2023-security-releases.md b/pages/en/blog/vulnerability/october-2023-security-releases.md new file mode 100644 index 0000000000000..c3637b1c7b4db --- /dev/null +++ b/pages/en/blog/vulnerability/october-2023-security-releases.md @@ -0,0 +1,37 @@ +--- +date: 2023-10-12:30:00.000Z +category: vulnerability +title: Friday October 13 2023 Security Releases +slug: october-2023-security-releases +layout: blog-post.hbs +author: Rafael Gonzaga +--- + +## Summary + +The Node.js project will release new versions of the 18.x and 20.x +releases lines on or shortly after, Friday October 13 2023 in order to address: + +- 2 high severity issues. +- 1 medium severity issues. +- 1 low severity issues. +- undici October security updates +- nghttp2 October security updates + +## Impact + +All the active release lines are affected by undici and nghttp2 security patches, which are rated as high severity issues. + +In addition, the 20.x release line of Node.js is vulnerable to 2 high severity issues, 1 medium severity issue, and 1 low severity issue. + +In addition, the 18.x release line of Node.js is vulnerable to 1 medium severity issue, and 1 low severity issue. + +## Release timing + +Releases will be available on, or shortly after, Friday October 13 2023. + +## Contact and future updates + +The current Node.js security policy can be found at . Please follow the process outlined in if you wish to report a vulnerability in Node.js. + +Subscribe to the low-volume announcement-only nodejs-sec mailing list at to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the nodejs GitHub organization. diff --git a/site.json b/site.json index 0c400f45e4a70..4f78cc9410a18 100644 --- a/site.json +++ b/site.json @@ -33,10 +33,10 @@ ], "websiteBanners": { "index": { - "startDate": "2023-07-31T14:30:00.000Z", - "endDate": "2023-08-16:00:00.000Z", - "text": "Security releases now available", - "link": "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases/" + "startDate": "2023-10-12T14:30:00.000Z", + "endDate": "2023-10-13:00:00.000Z", + "text": "New security releases to be made available October 13th, 2023", + "link": "https://nodejs.org/en/blog/vulnerability/october-2023-security-releases/" } } } From 0161149a7b720a5df402bf795337dab35f8b7345 Mon Sep 17 00:00:00 2001 From: Michael Dawson Date: Thu, 12 Oct 2023 11:38:47 -0400 Subject: [PATCH 2/4] Update pages/en/blog/vulnerability/october-2023-security-releases.md Signed-off-by: Michael Dawson --- pages/en/blog/vulnerability/october-2023-security-releases.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pages/en/blog/vulnerability/october-2023-security-releases.md b/pages/en/blog/vulnerability/october-2023-security-releases.md index c3637b1c7b4db..359bddd20a7ce 100644 --- a/pages/en/blog/vulnerability/october-2023-security-releases.md +++ b/pages/en/blog/vulnerability/october-2023-security-releases.md @@ -1,5 +1,6 @@ --- -date: 2023-10-12:30:00.000Z + +date: 2023-10-12T13:30:00.000Z category: vulnerability title: Friday October 13 2023 Security Releases slug: october-2023-security-releases From 90a3c180d7ab1bd35d33688bc328a3c55738d6db Mon Sep 17 00:00:00 2001 From: Michael Dawson Date: Thu, 12 Oct 2023 11:41:53 -0400 Subject: [PATCH 3/4] Update site.json Signed-off-by: Michael Dawson --- site.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/site.json b/site.json index 4f78cc9410a18..3b27522d310c9 100644 --- a/site.json +++ b/site.json @@ -33,8 +33,8 @@ ], "websiteBanners": { "index": { - "startDate": "2023-10-12T14:30:00.000Z", - "endDate": "2023-10-13:00:00.000Z", + "startDate": "2023-10-12T13:30:00.000Z", + "endDate": "2023-10-19T13:30:00.000Z", "text": "New security releases to be made available October 13th, 2023", "link": "https://nodejs.org/en/blog/vulnerability/october-2023-security-releases/" } From 8602a02f14f1330ac3acb67128de27223d09bf8e Mon Sep 17 00:00:00 2001 From: Matt Cowley Date: Thu, 12 Oct 2023 16:43:00 +0100 Subject: [PATCH 4/4] Update pages/en/blog/vulnerability/october-2023-security-releases.md Signed-off-by: Matt Cowley --- pages/en/blog/vulnerability/october-2023-security-releases.md | 1 - 1 file changed, 1 deletion(-) diff --git a/pages/en/blog/vulnerability/october-2023-security-releases.md b/pages/en/blog/vulnerability/october-2023-security-releases.md index 359bddd20a7ce..5875ac325e3c7 100644 --- a/pages/en/blog/vulnerability/october-2023-security-releases.md +++ b/pages/en/blog/vulnerability/october-2023-security-releases.md @@ -1,5 +1,4 @@ --- - date: 2023-10-12T13:30:00.000Z category: vulnerability title: Friday October 13 2023 Security Releases