|
1 | 1 | --- |
2 | | -date: 2021-08-27T16:00:00.000Z |
| 2 | +date: 2021-08-31T16:00:00.000Z |
3 | 3 | category: vulnerability |
4 | 4 | title: August 31 2021 Security Releases |
5 | 5 | slug: aug-2021-security-releases2 |
6 | 6 | layout: blog-post.hbs |
7 | 7 | author: Daniel Bevenius |
8 | 8 | --- |
9 | 9 |
|
| 10 | +## _(Update 31-Aug-2021)_ Security releases available |
| 11 | +Updates are now available for v14.x, and v12.x Node.js release lines for the |
| 12 | +following issues. |
| 13 | + |
| 14 | +### npm 6 update - node-tar, arborist, npm cli modules |
| 15 | +These are vulnerabilities in the node-tar, arborist, and npm cli modules which |
| 16 | +are related to the initial reports and subsequent remediation of node-tar |
| 17 | +vulnerabilities [CVE-2021-32803](https://github.com/advisories/GHSA-r628-mhmh-qjhw) |
| 18 | +and [CVE-2021-32804](https://github.com/advisories/GHSA-3jfq-g458-7qm9). |
| 19 | +Subsequent internal security review of node-tar and additional external bounty |
| 20 | +reports have resulted in another 5 CVE being remediated in core npm CLI |
| 21 | +dependencies including node-tar, and npm arborist. |
| 22 | + |
| 23 | +You can read more about it in: |
| 24 | +* [CVE-2021-37701](https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc) |
| 25 | +* [CVE-2021-37712](https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p) |
| 26 | +* [CVE-2021-37713](https://github.com/npm/node-tar/security/advisories/GHSA-5955-9wpr-37jh) |
| 27 | +* [CVE-2021-39134](https://github.com/npm/arborist/security/advisories/GHSA-2h3h-q99f-3fhc) |
| 28 | +* [CVE-2021-39135](https://github.com/npm/arborist/security/advisories/GHSA-gmw6-94gg-2rc2) |
| 29 | + |
| 30 | +Impacts: |
| 31 | +* All versions of the 14.x, and 12.x releases lines |
| 32 | + |
| 33 | +## Downloads and release details |
| 34 | + |
| 35 | +* [Node.js v12.22.6 (LTS)](https://nodejs.org/en/blog/release/v12.22.6/) |
| 36 | +* [Node.js v14.17.6 (LTS)](https://nodejs.org/en/blog/release/v14.17.6/) |
| 37 | + |
| 38 | +--------------- |
| 39 | + |
10 | 40 | # Summary |
11 | 41 |
|
12 | 42 | The Node.js project will release new versions of 12.x, and 14.x releases lines on or shortly after Tuesday |
|
0 commit comments