blog: path validation vulnerability blog

build.js

@@ -284,7 +284,7 @@ function getSource (callback) {
         },
         banner: {
           visible: true,
-          content: 'Important <a href="https://nodejs.org/en/blog/vulnerability/july-2017-security-releases/">security releases</a>, please update now!'
+          content: 'Important <a href="https://nodejs.org/en/blog/vulnerability/september-2017-path-validation/">security release for 8.x</a>, please update now!'
         }
       }
     }

locale/en/blog/vulnerability/september-2017-path-validation.md

@@ -0,0 +1,42 @@
+---
+date: 2017-09-27T17:15:00.617Z
+category: vulnerability
+title: Path validation vulnerability, September 2017
+slug: sep-2017-path-validation
+layout: blog-post.hbs
+author: Michael Dawson
+---
+# Path Validation Vulnerability
+
+The Node.js project released a new version of 8.x this week which incorporates
+a security fix.
+
+# Impact
+
+Version 8.5.0 of Node.js is vulnerable.
+4.x and 6.x versions are **NOT** vulnerable.
+
+# Downloads
+[Node.js 8 (Current)](https://nodejs.org/en/blog/release/v8.6.0/)
+
+# Node.js-specific security flaws
+
+Node.js version 8.5.0 included a change which caused a security vulnerability
+in the checks on paths made by some community modules. As a result, an
+attacker may be able to access file system paths other than those intended.
+
+This problem was resolved within Node.js by partially reverting
+https://github.com/nodejs/node/commit/b98e8d995efb426bbdee56ce503017bdcbbc6332.
+
+A CVE will be requested and the number will be posted once available.
+
+# Contact and future updates
+
+The current Node.js security policy can be found at https://nodejs.org/en/security/.
+
+Please contact security@nodejs.org if you wish to report a vulnerability in Node.js.
+
+Subscribe to the low-volume announcement-only nodejs-sec mailing list at
+https://groups.google.com/forum/#!forum/nodejs-sec to stay up to date
+on security vulnerabilities and security-related releases of Node.js
+and the projects maintained in the [nodejs GitHub organisation](https://github.com/nodejs/).