diff --git a/build.js b/build.js index 5156a12158e9a..0719df516f8de 100755 --- a/build.js +++ b/build.js @@ -284,7 +284,7 @@ function getSource (callback) { }, banner: { visible: true, - content: 'Important security releases, please update now!' + content: 'Important security release for 8.x, please update now!' } } } diff --git a/locale/en/blog/vulnerability/september-2017-path-validation.md b/locale/en/blog/vulnerability/september-2017-path-validation.md new file mode 100644 index 0000000000000..9d7e12891c0db --- /dev/null +++ b/locale/en/blog/vulnerability/september-2017-path-validation.md @@ -0,0 +1,42 @@ +--- +date: 2017-09-27T17:15:00.617Z +category: vulnerability +title: Path validation vulnerability, September 2017 +slug: sep-2017-path-validation +layout: blog-post.hbs +author: Michael Dawson +--- +# Path Validation Vulnerability + +The Node.js project released a new version of 8.x this week which incorporates +a security fix. + +# Impact + +Version 8.5.0 of Node.js is vulnerable. +4.x and 6.x versions are **NOT** vulnerable. + +# Downloads +[Node.js 8 (Current)](https://nodejs.org/en/blog/release/v8.6.0/) + +# Node.js-specific security flaws + +Node.js version 8.5.0 included a change which caused a security vulnerability +in the checks on paths made by some community modules. As a result, an +attacker may be able to access file system paths other than those intended. + +This problem was resolved within Node.js by partially reverting +https://github.com/nodejs/node/commit/b98e8d995efb426bbdee56ce503017bdcbbc6332. + +A CVE will be requested and the number will be posted once available. + +# Contact and future updates + +The current Node.js security policy can be found at https://nodejs.org/en/security/. + +Please contact security@nodejs.org if you wish to report a vulnerability in Node.js. + +Subscribe to the low-volume announcement-only nodejs-sec mailing list at +https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date +on security vulnerabilities and security-related releases of Node.js +and the projects maintained in the [nodejs GitHub organisation](https://github.com/nodejs/).