Skip to content
Closed
Changes from 1 commit
Commits
Show all changes
24 commits
Select commit Hold shift + click to select a range
c161dfe
chore(github issue): fit with nodejs.dev
AugustinMauroy Jan 24, 2023
507ea02
Merge branch 'main' into main
Jan 25, 2023
8071ea8
Merge branch 'main' into main
Feb 5, 2023
3d1bc0a
doc: announce Feb security release (#5042)
mhdawson Feb 7, 2023
cb1e39c
fix banner start date for security release announce (#5043)
mhdawson Feb 7, 2023
d548a3c
docs(security): typo-squirting => typosquatting (#5044)
ferdnyc Feb 12, 2023
9476a8c
doc: share new target for security releases (#5047)
mhdawson Feb 14, 2023
5006544
doc: update banner for new security release date (#5048)
mhdawson Feb 14, 2023
3cc96a6
Blog: v14.21.3 release post (#5051)
richardlau Feb 16, 2023
f745585
Blog: v16.19.1 release post (#5052)
richardlau Feb 16, 2023
7dbb7c1
Blog: v18.14.1 release post (#5054)
RafaelGSS Feb 16, 2023
7ea374d
Blog: v19.6.1 release post (#5053)
RafaelGSS Feb 16, 2023
6469baf
doc: update security annouce for binaries ready (#5055)
mhdawson Feb 16, 2023
96525c8
blog: release notes for v19.7.0 and v18.14.2 (#5064)
MylesBorins Feb 21, 2023
adade26
doc: fix typos in security release announcement (#5056)
tniessen Feb 22, 2023
abe8aa9
fix(docs): misspelled words (#5049)
CodytTorgerson Feb 27, 2023
903c1c6
ru:replace jargon in Russian text (#5027)Co-authored-by: Claudio Wund…
gurugray Feb 27, 2023
78c1867
doc: added example for Readable stream back-pressure (#5066)Co-author…
RishabhKodes Feb 27, 2023
7315680
ru: correct translation for index.md (#5045)Co-authored-by: Alexandr …
KruASe76 Feb 27, 2023
5f9862c
Blog: v18.15.0 release post (#5073)
juanarbol Mar 7, 2023
ec1ebcc
feat(infra): migrate to next.js infrastructure (#4991)Co-authored-by:…
ovflowd Mar 8, 2023
93407da
chore(i18n): removed unused hebrew language (#5074)
ovflowd Mar 8, 2023
80dbb74
chore(readme): add nodejs logo
AugustinMauroy Mar 8, 2023
f79046b
Merge branch 'main' of https://github.com/AugustinMauroy/nodejs.org
AugustinMauroy Mar 8, 2023
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
doc: fix typos in security release announcement (#5056)
Co-authored-by: Claudio Wunder <[email protected]>
  • Loading branch information
tniessen and ovflowd authored Feb 22, 2023
commit adade260ab9c0ce240e4ffe1f291ad2d2c8d80b1
14 changes: 7 additions & 7 deletions locale/en/blog/vulnerability/february-2023-security-releases.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,11 +21,11 @@ Impacts:

* All versions of the 19.x, 18.x, 16.x, and 14.x release lines.

## Node.js Permissions policies can be bypassed via process.mainModule (High) ([CVE-2023-23918](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23918))
## Node.js Permissions policies can be bypassed via process.mainModule (High) ([CVE-2023-23918](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23918))

It was possible to bypass [Permissions](https://nodejs.org/api/permissions.html) and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.
It was possible to bypass [Permissions](https://nodejs.org/api/permissions.html) and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with `--experimental-policy`.

Thank you, to [@goums](https://github.com/goums) for reporting this vulnerability and thank you [Rafael Gonzaga](https://github.com/RafaelGSS) for fixing it.
Thank you, to [@goums](https://github.com/goums) for reporting this vulnerability and thank you [Rafael Gonzaga](https://github.com/RafaelGSS) for fixing it.

Impacts:

Expand All @@ -35,7 +35,7 @@ Impacts:

In some cases Node.js did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.

"Thank you, to Morgan Jones and Ryan Dorrity from Viasat Secure Mobile for reporting and discovering this vulnerability and thank you [Rafael Gonzaga](https://github.com/RafaelGSS) for fixing it.
Thank you, to Morgan Jones and Ryan Dorrity from Viasat Secure Mobile for reporting and discovering this vulnerability and thank you [Rafael Gonzaga](https://github.com/RafaelGSS) for fixing it.

Impacts:

Expand All @@ -56,7 +56,7 @@ Impacts:
## Regular Expression Denial of Service in Headers in Node.js fetch API(Low) ([CVE-2023-24807](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24807))

The Headers.set() and Headers.append() methods in the
[fetch API](https://nodejs.org/dist/latest/docs/api/globals.html#fetch) in Node.js where vulnerable to Regular a Expression Denial of Service (ReDoS) attacks.
[fetch API](https://nodejs.org/dist/latest/docs/api/globals.html#fetch) in Node.js were vulnerable to a Regular Expression Denial of Service (ReDoS) attacks.

Thank you, to Carter Snook for reporting this vulnerability and thank you Rich Trott for fixing it.

Expand All @@ -67,9 +67,9 @@ Impacts:
## Node.js insecure loading of ICU data through ICU_DATA environment variable (Low) ([CVE-2023-23920](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23920))

Node.js would search and potentially load ICU data when running with elevated priviledges. Node.js
was modified to build with ICU_NO_USER_DATA_OVERRIDE to avoid this.
was modified to build with `ICU_NO_USER_DATA_OVERRIDE` to avoid this.

Thank you, to Ben Noordhuis for reporting this vulnerability and thank you [Rafael Gonzaga](https://github.com/RafaelGSS) for fixing it.
Thank you, to Ben Noordhuis for reporting this vulnerability and thank you [Rafael Gonzaga](https://github.com/RafaelGSS) for fixing it.

Impacts:

Expand Down