Skip to content

Commit 105997f

Browse files
committed
doc: update Apr 2021 security releases blog
1 parent a8fcdf0 commit 105997f

2 files changed

Lines changed: 25 additions & 15 deletions

File tree

build.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -278,7 +278,7 @@ function getSource (callback) {
278278
},
279279
banner: {
280280
visible: true,
281-
text: 'New security releases to be made available April 6, 2021',
281+
text: 'New security releases now available for 15.x, 14.x, 12.x and 10.x release lines',
282282
link: '/en/blog/vulnerability/april-2021-security-releases/'
283283
}
284284
}
Lines changed: 24 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,44 @@
11
---
2-
date: 2021-03-31T16:00:00.000Z
2+
date: 2021-04-06T16:00:00.000Z
33
category: vulnerability
44
title: April 2021 Security Releases
55
slug: april-2021-security-releases
66
layout: blog-post.hbs
77
author: Daniel Bevenius
88
---
99

10-
# Summary
10+
## _(Update 6-Apr-2021)_ Security releases available
1111

12-
The Node.js project will release new versions of all supported release lines on or shortly after Tuesday, April 6th, 2021.
12+
Updates are now available for v10,x, v12.x, v14.x and v15.x Node.js release lines for the following issues.
1313

14-
* Three High severity issues
14+
### OpenSSL - CA certificate check bypass with X509_V_FLAG_X509_STRICT (High) (CVE-2021-3450)
1515

16-
## Impact
16+
This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in
17+
https://www.openssl.org/news/secadv/20210325.txt
1718

18-
The 15.x release line of Node.js is vulnerable to two high severity issues.
19+
Impacts:
20+
* All versions of the 15.x, 14.x, 12.x and 10.x releases lines
1921

20-
The 14.x release line of Node.js is vulnerable to three high severity issues.
22+
### OpenSSL - NULL pointer deref in signature_algorithms processing (High) (CVE-2021-3449)
2123

22-
The 12.x release line of Node.js is vulnerable to three high severity issues.
24+
This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in
25+
https://www.openssl.org/news/secadv/20210325.txt
2326

24-
The 10.x release line of Node.js is vulnerable to three high severity issues.
27+
Impacts:
28+
* All versions of the 15.x, 14.x, 12.x and 10.x releases lines
2529

26-
## Release timing
30+
### npm upgrade - Update y18n to fix Prototype-Pollution (High) (CVE-2020-7774)
2731

28-
Releases will be available at, or shortly after, Tuesday, April 6th, 2021.
32+
This is a vulnerability in the y18n npm module which may be exploited by prototype pollution.
33+
You can read more about it in
34+
https://github.com/advisories/GHSA-c4w7-xm78-47vh
2935

30-
## Contact and future updates
36+
Impacts:
37+
* All versions of the 14.x, 12.x and 10.x releases lines
3138

32-
The current Node.js security policy can be found at https://nodejs.org/en/security/. Please follow the process outlined in https://github.com/nodejs/node/blob/master/SECURITY.md if you wish to report a vulnerability in Node.js.
39+
## Downloads and release details
3340

34-
Subscribe to the low-volume announcement-only nodejs-sec mailing list at https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date on security vulnerabilities and security-related releases of Node.js and the projects maintained in the nodejs GitHub organization.
41+
* [Node.js v10.24.1 (LTS)](https://nodejs.org/en/blog/release/v10.24.1/)
42+
* [Node.js v12.21.1 (LTS)](https://nodejs.org/en/blog/release/v12.21.1/)
43+
* [Node.js v14.16.1 (LTS)](https://nodejs.org/en/blog/release/v14.16.1/)
44+
* [Node.js v15.13.1 (Current)](https://nodejs.org/en/blog/release/v15.13.1/)

0 commit comments

Comments
 (0)