|
1 | 1 | --- |
2 | | -date: 2021-03-31T16:00:00.000Z |
| 2 | +date: 2021-04-06T16:00:00.000Z |
3 | 3 | category: vulnerability |
4 | 4 | title: April 2021 Security Releases |
5 | 5 | slug: april-2021-security-releases |
6 | 6 | layout: blog-post.hbs |
7 | 7 | author: Daniel Bevenius |
8 | 8 | --- |
9 | 9 |
|
10 | | -# Summary |
| 10 | +## _(Update 6-Apr-2021)_ Security releases available |
11 | 11 |
|
12 | | -The Node.js project will release new versions of all supported release lines on or shortly after Tuesday, April 6th, 2021. |
| 12 | +Updates are now available for v10,x, v12.x, v14.x and v15.x Node.js release lines for the following issues. |
13 | 13 |
|
14 | | -* Three High severity issues |
| 14 | +### OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (High) (CVE-2021-3450) |
15 | 15 |
|
16 | | -## Impact |
| 16 | +This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in |
| 17 | +https://www.openssl.org/news/secadv/20210325.txt |
17 | 18 |
|
18 | | -The 15.x release line of Node.js is vulnerable to two high severity issues. |
| 19 | +Impacts: |
| 20 | +* All versions of the 15.x, 14.x, 12.x and 10.x releases lines |
19 | 21 |
|
20 | | -The 14.x release line of Node.js is vulnerable to three high severity issues. |
| 22 | +### OpenSSL - NULL pointer deref in signature_algorithms processing (High) (CVE-2021-3449) |
21 | 23 |
|
22 | | -The 12.x release line of Node.js is vulnerable to three high severity issues. |
| 24 | +This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in |
| 25 | +https://www.openssl.org/news/secadv/20210325.txt |
23 | 26 |
|
24 | | -The 10.x release line of Node.js is vulnerable to three high severity issues. |
| 27 | +Impacts: |
| 28 | +* All versions of the 15.x, 14.x, 12.x and 10.x releases lines |
25 | 29 |
|
26 | | -## Release timing |
| 30 | +### npm upgrade - Update y18n to fix Prototype-Pollution (High) (CVE-2020-7774) |
27 | 31 |
|
28 | | -Releases will be available at, or shortly after, Tuesday, April 6th, 2021. |
| 32 | +This is a vulnerability in the y18n npm module which may be exploited by prototype pollution. |
| 33 | +You can read more about it in |
| 34 | +https://github.com/advisories/GHSA-c4w7-xm78-47vh |
29 | 35 |
|
30 | | -## Contact and future updates |
| 36 | +Impacts: |
| 37 | +* All versions of the 14.x, 12.x and 10.x releases lines |
31 | 38 |
|
32 | | -The current Node.js security policy can be found at https://nodejs.org/en/security/. Please follow the process outlined in https://github.com/nodejs/node/blob/master/SECURITY.md if you wish to report a vulnerability in Node.js. |
| 39 | +## Downloads and release details |
33 | 40 |
|
34 | | -Subscribe to the low-volume announcement-only nodejs-sec mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the nodejs GitHub organization. |
| 41 | +* [Node.js v10.24.1 (LTS)](https://nodejs.org/en/blog/release/v10.24.1/) |
| 42 | +* [Node.js v12.21.1 (LTS)](https://nodejs.org/en/blog/release/v12.21.1/) |
| 43 | +* [Node.js v14.16.1 (LTS)](https://nodejs.org/en/blog/release/v14.16.1/) |
| 44 | +* [Node.js v15.13.1 (Current)](https://nodejs.org/en/blog/release/v15.13.1/) |
0 commit comments