December 2019 Security Releases
Node.js security releases update npm to address vulnerabilities involving global binary overwrites, symlinks outside node_modules, and arbitrary file writes. The announcement says all current release lines were affected.
Announced
Machine-extracted · Revision 1Original source
Evidence and details
These are machine-extracted claims. Quotations show the recorded source text; verify the original announcement before acting.
Security context
These releases update npm to v6.13.4 to address three vulnerabilities described below. All current release lines were affected.
npm CLI
Versions of the npm CLI prior to 6.13.4 are vulnerable to a Global node_modules Binary Overwrite.
- Affected versions
- prior to 6.13.4
Versions of the npm CLI prior to 6.13.4 are vulnerable to a Global node_modules Binary Overwrite.
prior to 6.13.3Versions of the npm CLI prior to 6.13.3 are vulnerable to a symlink reference outside of node_modules.
- Fixed versions
- v6.13.4
These releases update npm to v6.13.4 to address three vulnerabilities described below.
- Prerequisites
- Not stated in this extraction
Node.js
All versions of Node.js are vulnerable including the LTS and current releases:
- Affected versions
- Node.js 8
Node.js 8 (LTS "Carbon"), Node.js 10 (LTS "Dubnium") , Node.js 12 (LTS "Erbium"), and Node.js 13.
Node.js 10Node.js 8 (LTS "Carbon"), Node.js 10 (LTS "Dubnium") , Node.js 12 (LTS "Erbium"), and Node.js 13.
Node.js 12Node.js 8 (LTS "Carbon"), Node.js 10 (LTS "Dubnium") , Node.js 12 (LTS "Erbium"), and Node.js 13.
Node.js 13Node.js 8 (LTS "Carbon"), Node.js 10 (LTS "Dubnium") , Node.js 12 (LTS "Erbium"), and Node.js 13.
- Fixed versions
- Node.js v13.4.0
Node.js v13.4.0
Node.js v12.14.0Node.js v12.14.0
Node.js v10.18.0Node.js v10.18.0
Node.js v8.17.0Node.js v8.17.0
- Prerequisites
- Not stated in this extraction
Publisher severity
No explicit severity was extracted.