Skip to content

Commit

Permalink
Blog: add security release blog posts (#6642)
Browse files Browse the repository at this point in the history 
* Blog: v18.20.2 release post

Refs: nodejs-private/node-private#578

* Blog: v20.12.2 release post

Refs: nodejs-private/node-private#579

* Blog: v21.7.3 release post

Refs: nodejs-private/node-private#580

* Blog: add post security release

* Update pages/en/blog/vulnerability/april-2024-security-releases-2.md

Co-authored-by: Matt Cowley <me@mattcowley.co.uk>
Signed-off-by: Rafael Gonzaga <rafael.nunu@hotmail.com>

* Update pages/en/blog/vulnerability/april-2024-security-releases-2.md

Co-authored-by: Augustin Mauroy <augustin.mauroy@outlook.fr>
Signed-off-by: Rafael Gonzaga <rafael.nunu@hotmail.com>

* Update pages/en/blog/vulnerability/april-2024-security-releases-2.md

Co-authored-by: Matt Cowley <me@mattcowley.co.uk>
Signed-off-by: Rafael Gonzaga <rafael.nunu@hotmail.com>

* Update pages/en/blog/vulnerability/april-2024-security-releases-2.md

Co-authored-by: Matt Cowley <me@mattcowley.co.uk>
Signed-off-by: Rafael Gonzaga <rafael.nunu@hotmail.com>

---------

Signed-off-by: Rafael Gonzaga <rafael.nunu@hotmail.com>
Co-authored-by: Matt Cowley <me@mattcowley.co.uk>
Co-authored-by: Augustin Mauroy <augustin.mauroy@outlook.fr>
  • Loading branch information
@RafaelGSS @MattIPv4 @AugustinMauroy
3 people authored Apr 10, 2024
1 parent 727df84 commit 8c03467
Show file tree
Hide file tree
Showing 5 changed files with 317 additions and 6 deletions.
92 changes: 92 additions & 0 deletions pages/en/blog/release/v18.20.2.md
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,92 @@
---
date: '2024-04-10T16:36:35.678Z'
category: release
title: Node v18.20.2 (LTS)
layout: blog-post
author: Rafael Gonzaga
---

## 2024-04-10, Version 18.20.2 'Hydrogen' (LTS), @RafaelGSS

This is a security release.

### Notable Changes

- CVE-2024-27980 - Command injection via args parameter of `child_process.spawn` without shell option enabled on Windows

### Commits

- \[[`6627222409`](https://github.com/nodejs/node/commit/6627222409)] - **src**: disallow direct .bat and .cmd file spawning (Ben Noordhuis) [nodejs-private/node-private#564](https://github.com/nodejs-private/node-private/pull/564)

Windows 32-bit Installer: https://nodejs.org/dist/v18.20.2/node-v18.20.2-x86.msi \
Windows 64-bit Installer: https://nodejs.org/dist/v18.20.2/node-v18.20.2-x64.msi \
Windows 32-bit Binary: https://nodejs.org/dist/v18.20.2/win-x86/node.exe \
Windows 64-bit Binary: https://nodejs.org/dist/v18.20.2/win-x64/node.exe \
macOS 64-bit Installer: https://nodejs.org/dist/v18.20.2/node-v18.20.2.pkg \
macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v18.20.2/node-v18.20.2-darwin-arm64.tar.gz \
macOS Intel 64-bit Binary: https://nodejs.org/dist/v18.20.2/node-v18.20.2-darwin-x64.tar.gz \
Linux 64-bit Binary: https://nodejs.org/dist/v18.20.2/node-v18.20.2-linux-x64.tar.xz \
Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v18.20.2/node-v18.20.2-linux-ppc64le.tar.xz \
Linux s390x 64-bit Binary: https://nodejs.org/dist/v18.20.2/node-v18.20.2-linux-s390x.tar.xz \
AIX 64-bit Binary: https://nodejs.org/dist/v18.20.2/node-v18.20.2-aix-ppc64.tar.gz \
ARMv7 32-bit Binary: https://nodejs.org/dist/v18.20.2/node-v18.20.2-linux-armv7l.tar.xz \
ARMv8 64-bit Binary: https://nodejs.org/dist/v18.20.2/node-v18.20.2-linux-arm64.tar.xz \
Source Code: https://nodejs.org/dist/v18.20.2/node-v18.20.2.tar.gz \
Other release files: https://nodejs.org/dist/v18.20.2/ \
Documentation: https://nodejs.org/docs/v18.20.2/api/

### SHASUMS

```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
f335733f4ae95fdb1c1011a59d79194768ad9d29c12fd07409163439944ee5dd node-v18.20.2-aix-ppc64.tar.gz
2647d831f16b3dc7857ed4ee721d3c378194918ecda80b9471590250d328fa3c node-v18.20.2-darwin-arm64.tar.gz
726e87689ac033ef73cb8041cc5e96c904a6e59971258008f17ee74c6ff4854b node-v18.20.2-darwin-arm64.tar.xz
e26d8074da6d22ed23140e0ba964cba9c694f9b839ce48835d692a7a7e36421e node-v18.20.2-darwin-x64.tar.gz
81d58aaadca73637ded8c6944980e4a66a1dc2b0eeaa7c380252912907fd8ccd node-v18.20.2-darwin-x64.tar.xz
b31e5d82fb327373f7119fef3d1ee67b140a23c198e0f44f44b2e4ff9b3f29e5 node-v18.20.2-headers.tar.gz
6f3be52bfb4a8ecaea29ed8dbdb86694cdbae19334dc65cc2c982243b102978a node-v18.20.2-headers.tar.xz
0b21ad5a11dd6c59a62eb34d1a0c2af28fe29187fa60da2c993b7cdf2a5a2f28 node-v18.20.2-linux-arm64.tar.gz
be36d2ad5842a7a9456b7de32fcc9656a6e0a79edab5f14ac05479d2eef2aa0e node-v18.20.2-linux-arm64.tar.xz
adc55a8a594882b72967b05a4e47b4911879eeb44477f9447e05c84d420797ac node-v18.20.2-linux-armv7l.tar.gz
19f0964f36a88546f73d4eb95e40b047d08205ed078061d2e4e9078e802231e8 node-v18.20.2-linux-armv7l.tar.xz
40193c181756789bb53130d5c96cfacb2e90dff3a5ef196014d4df8d9cecd6ba node-v18.20.2-linux-ppc64le.tar.gz
7844f4d19174826b3c5162a92a0f6c7f028d324df4d59684e3e7ae40980358ed node-v18.20.2-linux-ppc64le.tar.xz
3c56d6addf76802c5f4e28dfccf4919c1affdf7d47937b4df902250e72eeca89 node-v18.20.2-linux-s390x.tar.gz
08cb2f45228d9d812b107a15656316da99a79b0b4e69c7b33635ed96b5565647 node-v18.20.2-linux-s390x.tar.xz
a222595d353a7d1e48994a7d9c25e61ab1b8a1b0ce0652029f5cf999978b2e49 node-v18.20.2-linux-x64.tar.gz
d0584a21d83d710f947b210434449f6d2a65d14975d6fe9aaf430aae79dc312b node-v18.20.2-linux-x64.tar.xz
9d2e3bcf978c511e8e635686623da2ea59efe1b9111e58ba8f23e531ffa65028 node-v18.20.2-win-x64.7z
1b7dde318fad3110db1d597184e78d327816e61eef340323765d86f7481babe6 node-v18.20.2-win-x64.zip
6327b08558db40b5426f814dc24afdc4e290ec29ca6f3dd36b8b43dd1862e2af node-v18.20.2-win-x86.7z
7fde182306cb446dbecb732b897fe740d935d848810fed2aa87f56e2e31ea32b node-v18.20.2-win-x86.zip
e2ea83c8a392bb46e1841eca510f600cfa8c5dc0750d29d42fcf67b5672ac86b node-v18.20.2-x64.msi
e7a46aba0fe62db5fe3a81a85561e2a202bc90d637fc2eb7569ad68ad50d383a node-v18.20.2-x86.msi
7cc83750a77ff2d4666c75d08e01f3027a4ab412894fe077e62e675fac739b11 node-v18.20.2.pkg
68c165b9ceb7bc69dcdc75c6099723edb5ff0509215959af0775ed426174c404 node-v18.20.2.tar.gz
8aaea7c9c7e927fb09d91498da311b6e4d18233390e23c723a53b891fad4c73f node-v18.20.2.tar.xz
797de9af018be0ad307cdd22ce4451c17c2dfb27e154b4ad475147d42872bdde win-x64/node.exe
64d93225aaece04e3cd45177d6dea2b22df49e127281fefa3ade43ac46a36cc6 win-x64/node.lib
cffbcf594d0006eaad4045d7bc4995a09a8003843f95fda44b59802a136e1e99 win-x64/node_pdb.7z
0017d7b5ea6faa281b559a002f8b52042099cad98c82e6b22b5767f6b0f15015 win-x64/node_pdb.zip
adb9e06c6f51b6eab819abd92b345d372b432a38ea130b698f81aab7c57641f1 win-x86/node.exe
df34047e8ae646e6f43d76ecbec9709a185f29e01f49b377c4c46070cacc2859 win-x86/node.lib
2316a8b568e4d30201faf627026f008d112482bb04308e1b86acea6c9a886b5c win-x86/node_pdb.7z
c35ab3d6ca6500988b326817c8921d89b1eccc5d11cef0cc9b6cd672030744a4 win-x86/node_pdb.zip
-----BEGIN PGP SIGNATURE-----
iQGzBAEBCAAdFiEEiQwI24V5Fi/uDfnbi+q0389VXvQFAmYWvnAACgkQi+q0389V
XvRMkQv/f3bvkK2Q1jjsBGN+STmkeOrusk2zykA5ypDxMookxZwFFPHQxGqVJY4D
hNsoYEYEbhnPcM+cHp4ba4GKfYtjJyUACStwDRzO6lFI6nLZs0FrSSIjmc/2Q5Rp
IKuW2PQ5iAZz8M5PjI8Y4OMCDj1e4JChRgh1uLSkSLYg/G7YF/rcUDuVj4dHFdPb
61UTCqkI8kHVwTG4vMxJjCJYlHMkXmQ4VJ2ku8NHzPzBW3Vshdy0fISpImCGcSSJ
Bc995Roeh2hO5takxZ84m64YUxSGHDcBHow8i1uhpfIo8Ryow2ngDXjqsjXeiUbH
eqKz8tKd76/GQvGdWk/fKBDOEnLN5LTnu+aBQCCfSLSGjwIJErZ4+FZwaFqN+Dnq
y9+RRUYBKOgnZirOmzBqmMwJsSMq8MMKJxkSOWpb4RSQLsMNBNT9mHmB3v7GXFvt
JcSzij7LI/9cbmjdvACUJXAKY2eVkIhU36kpgJ1G12w2Kv06uts4uMNWj2ImEU9c
/i6OcSNN
=LyPd
-----END PGP SIGNATURE-----
```
101 changes: 101 additions & 0 deletions pages/en/blog/release/v20.12.2.md
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,101 @@
---
date: '2024-04-10T16:38:15.626Z'
category: release
title: Node v20.12.2 (LTS)
layout: blog-post
author: Rafael Gonzaga
---

## 2024-04-10, Version 20.12.2 'Iron' (LTS), @RafaelGSS

This is a security release.

### Notable Changes

- CVE-2024-27980 - Command injection via args parameter of `child_process.spawn` without shell option enabled on Windows

### Commits

- \[[`69ffc6d50d`](https://github.com/nodejs/node/commit/69ffc6d50d)] - **src**: disallow direct .bat and .cmd file spawning (Ben Noordhuis) [nodejs-private/node-private#563](https://github.com/nodejs-private/node-private/pull/563)

Windows 32-bit Installer: https://nodejs.org/dist/v20.12.2/node-v20.12.2-x86.msi \
Windows 64-bit Installer: https://nodejs.org/dist/v20.12.2/node-v20.12.2-x64.msi \
Windows ARM 64-bit Installer: https://nodejs.org/dist/v20.12.2/node-v20.12.2-arm64.msi \
Windows 32-bit Binary: https://nodejs.org/dist/v20.12.2/win-x86/node.exe \
Windows 64-bit Binary: https://nodejs.org/dist/v20.12.2/win-x64/node.exe \
Windows ARM 64-bit Binary: https://nodejs.org/dist/v20.12.2/win-arm64/node.exe \
macOS 64-bit Installer: https://nodejs.org/dist/v20.12.2/node-v20.12.2.pkg \
macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v20.12.2/node-v20.12.2-darwin-arm64.tar.gz \
macOS Intel 64-bit Binary: https://nodejs.org/dist/v20.12.2/node-v20.12.2-darwin-x64.tar.gz \
Linux 64-bit Binary: https://nodejs.org/dist/v20.12.2/node-v20.12.2-linux-x64.tar.xz \
Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v20.12.2/node-v20.12.2-linux-ppc64le.tar.xz \
Linux s390x 64-bit Binary: https://nodejs.org/dist/v20.12.2/node-v20.12.2-linux-s390x.tar.xz \
AIX 64-bit Binary: https://nodejs.org/dist/v20.12.2/node-v20.12.2-aix-ppc64.tar.gz \
ARMv7 32-bit Binary: https://nodejs.org/dist/v20.12.2/node-v20.12.2-linux-armv7l.tar.xz \
ARMv8 64-bit Binary: https://nodejs.org/dist/v20.12.2/node-v20.12.2-linux-arm64.tar.xz \
Source Code: https://nodejs.org/dist/v20.12.2/node-v20.12.2.tar.gz \
Other release files: https://nodejs.org/dist/v20.12.2/ \
Documentation: https://nodejs.org/docs/v20.12.2/api/

### SHASUMS

```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
b1e8241fb06f3f27a3336b4beb193f1cb92f05f1aaaa904e5c62df1cd4f599f5 node-v20.12.2-aix-ppc64.tar.gz
2d05b1cc83d3ecfd52624b3d2a99909f1219510ce63cc0967f8c9bfa9284044f node-v20.12.2-arm64.msi
98eb624b52efec2530079e1d11296ec0ac20771b94b087d21649250339cf5332 node-v20.12.2-darwin-arm64.tar.gz
37a0cf0d1ea5067040586b34c76d4e2b78bd2246c51106218489e60008475209 node-v20.12.2-darwin-arm64.tar.xz
cd5e9a80a38ccffc036a87b232a5402339c7bf8fa9a494ae0731a1a671687718 node-v20.12.2-darwin-x64.tar.gz
226c2d475091da92892c46e40d058668cf236eb298c1769a3b27151352932b42 node-v20.12.2-darwin-x64.tar.xz
e41474f0db0c63f55e8137fd3836ccb9d9bbcffefaac88a51e0cd61494b503ac node-v20.12.2-headers.tar.gz
643992acac9f0a80b184d5c4a6144abea7822fbbdac5b97365136e4e6df29eeb node-v20.12.2-headers.tar.xz
2dc8ffa0da135bf493f881d2d38aac610772c801bb7b6208fcc5de9350f119f7 node-v20.12.2-linux-arm64.tar.gz
b5fc7983fb9506b8c3de53dfa85ff63f9f49cedc94984e29e4c89328536ba4b9 node-v20.12.2-linux-arm64.tar.xz
5861b891815ae8d42835db52bc57191858f348e0521b162c670c8ed4df417f1c node-v20.12.2-linux-armv7l.tar.gz
b470878c1a0d656805e6d1b9d97883f5cd25b895d573ccee9779950a56198733 node-v20.12.2-linux-armv7l.tar.xz
c33968d78e06af64bd8d89a74781fef71ff126f862f7ed0ff2417d612dd64abb node-v20.12.2-linux-ppc64le.tar.gz
b48351a23685a85884a2cc69a274b684243a3be18e8fa520105df2c6368cc116 node-v20.12.2-linux-ppc64le.tar.xz
29fe0d5142a3f3d7957d6ccf03cc08cd1c76c41d0460c92dd5800d46caa08d31 node-v20.12.2-linux-s390x.tar.gz
ce7c180ff62d5ad7f40ccc5ccca0d031c9e56edb8795c9be5378359c81c288f8 node-v20.12.2-linux-s390x.tar.xz
f8f9b6877778ed2d5f920a5bd853f0f8a8be1c42f6d448c763a95625cbbb4b0d node-v20.12.2-linux-x64.tar.gz
595272130310cbe12301430756f23d153f7ab95d00174c02adc11a2e3703d183 node-v20.12.2-linux-x64.tar.xz
ab4b990c2c1d4a55d565813e7a2f71669dc4d1005faa47185d30bde4416975ab node-v20.12.2-win-arm64.7z
010d488af3adad98e44b2d3f61afb7e3d87b5a620f7a406fe75ab0909b72e7ca node-v20.12.2-win-arm64.zip
a92f5bb065bbe7b429e573b83604e8e039de3f0dac37e16674de0dea303c5283 node-v20.12.2-win-x64.7z
66dda1717cae30a13be6bb17ad96ee54b69f2c23c85acd9c3299b095fa26b452 node-v20.12.2-win-x64.zip
de8dd5dde38c3e2d5b4269534360414e4ae853496835226b4b1df567e4bf3d3c node-v20.12.2-win-x86.7z
acf7d7fedf3a50aaa12c4e2bf0aa6220727b22eb24ad1b37264d46e12421d03d node-v20.12.2-win-x86.zip
20c578361911d7b0cf153b293b025970eca383a2c802e0df438ac254aaca165d node-v20.12.2-x64.msi
2655083616f0afc6c7a619069506614c4ef32c12bc31b5c455fe1e4815f03d23 node-v20.12.2-x86.msi
bcd2b4289313640639d9822655b80b2aff4689e189da0bf4f5d9c8ac12dec427 node-v20.12.2.pkg
bc57ee721a12cc8be55bb90b4a9a2f598aed5581d5199ec3bd171a4781bfecda node-v20.12.2.tar.gz
d7cbcc5fbfb31e9001f3f0150bbeda59abe5dd7137aaa6273958cd59ce35ced7 node-v20.12.2.tar.xz
f5e42cbd380a9788bdd86b4316cd1eaaf432777d519b52758ccbe70d1f0f821a win-arm64/node.exe
e780ac993543d4705ba5bffa79a53854fcb5e77b6845464074ca590dab194539 win-arm64/node.lib
ee59a80e5606dd736bb7610de8eb1a195d12fb9995bf8c1ca7d0950f8827e150 win-arm64/node_pdb.7z
91589548ea260794a8f6a141be6e25cd59b3bb32d8c7dfe84f9998890e3cab3b win-arm64/node_pdb.zip
d2cfb2cd6cf37c3a654964f01c1333d5692907d20ca172dfb37025114af742e9 win-x64/node.exe
c6e9da74f78f98a465edfb8b51c84c9d33a047a71c4624a854b2af2b4e6a0d50 win-x64/node.lib
1fa139447711a77c4d16791bf0807210e6e08723f1ba257cf9769fe5c7848a48 win-x64/node_pdb.7z
9554b9bfabad3a46cb580d659cb747f1c1a9816fe5e885337ab1490359fe21d6 win-x64/node_pdb.zip
4f65b294b3071a6e73df7f02ab0c360a3fc9661ce897b823c2c48043fbdcaa70 win-x86/node.exe
08399fc4d42a0ce0bad33dd9a9bcc9c845bfb0d5d1393e8c330b5a243411d8a9 win-x86/node.lib
e89ff44159e90f12ba9ee64e8ce4941b6d9216bd69f012e536e670a973e19a61 win-x86/node_pdb.7z
9406e7b1bbde6e4e6043c72f40e39e8e018d5a7397bdffe34fbc00a4d6f2db71 win-x86/node_pdb.zip
-----BEGIN PGP SIGNATURE-----
iQGzBAEBCAAdFiEEiQwI24V5Fi/uDfnbi+q0389VXvQFAmYWvuEACgkQi+q0389V
XvToVwv8DSHqiPiPIrpV1l7FORBYlfzxGSJ9SprPylQdwoDCskXtF4VlNDk/2rNq
i4MWSK0FwXT8BE5du4XUMkGsL8V+MfEv4DMSdt1oZrSErXzf2Td+bBPsO21Ihgl6
5Vqo0viMgvnmpdZg1f+Rl9GFiGcv6lLM3zgK/agP5J4HFzuRwwPB3QGZ5pZ2j52Z
8QYT6MpZ4eQ27yZbyoYR10EGDixZixL0Ixl90S/WuOvGoCoTczF2BNRjWF69FZaT
tV4kVG6WIadEZjDH/dsVp7Y9c04X+2HcJEWrhozbUN0vkFab7ON302nk7nxO2dd+
JmDvxXWEyH+6W3pjTmQJx6WT2tK9VlqXcQQifWX42skEsg20Q+NWxBtOPoJJ01PJ
iQ5NQIEeAZ0wwVtMweWay6BLEFow/dqzL4IRt95hwXb0k7VPKO5+B6Jj42CmbT/i
UNL3xgHOUzxYqgTOMC6FIpjobdivDVuvHQgb8R110ldzlKPsh2bUeQfwo18nCcYy
XRC8PD8H
=IlUn
-----END PGP SIGNATURE-----
```
101 changes: 101 additions & 0 deletions pages/en/blog/release/v21.7.3.md
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,101 @@
---
date: '2024-04-10T16:38:50.587Z'
category: release
title: Node v21.7.3 (Current)
layout: blog-post
author: Rafael Gonzaga
---

## 2024-04-10, Version 21.7.3 (Current), @RafaelGSS

This is a security release.

### Notable Changes

- CVE-2024-27980 - Command injection via args parameter of `child_process.spawn` without shell option enabled on Windows

### Commits

- \[[`9095c914ed`](https://github.com/nodejs/node/commit/9095c914ed)] - **src**: disallow direct .bat and .cmd file spawning (Ben Noordhuis) [nodejs-private/node-private#562](https://github.com/nodejs-private/node-private/pull/562)

Windows 32-bit Installer: https://nodejs.org/dist/v21.7.3/node-v21.7.3-x86.msi \
Windows 64-bit Installer: https://nodejs.org/dist/v21.7.3/node-v21.7.3-x64.msi \
Windows ARM 64-bit Installer: https://nodejs.org/dist/v21.7.3/node-v21.7.3-arm64.msi \
Windows 32-bit Binary: https://nodejs.org/dist/v21.7.3/win-x86/node.exe \
Windows 64-bit Binary: https://nodejs.org/dist/v21.7.3/win-x64/node.exe \
Windows ARM 64-bit Binary: https://nodejs.org/dist/v21.7.3/win-arm64/node.exe \
macOS 64-bit Installer: https://nodejs.org/dist/v21.7.3/node-v21.7.3.pkg \
macOS Apple Silicon 64-bit Binary: https://nodejs.org/dist/v21.7.3/node-v21.7.3-darwin-arm64.tar.gz \
macOS Intel 64-bit Binary: https://nodejs.org/dist/v21.7.3/node-v21.7.3-darwin-x64.tar.gz \
Linux 64-bit Binary: https://nodejs.org/dist/v21.7.3/node-v21.7.3-linux-x64.tar.xz \
Linux PPC LE 64-bit Binary: https://nodejs.org/dist/v21.7.3/node-v21.7.3-linux-ppc64le.tar.xz \
Linux s390x 64-bit Binary: https://nodejs.org/dist/v21.7.3/node-v21.7.3-linux-s390x.tar.xz \
AIX 64-bit Binary: https://nodejs.org/dist/v21.7.3/node-v21.7.3-aix-ppc64.tar.gz \
ARMv7 32-bit Binary: https://nodejs.org/dist/v21.7.3/node-v21.7.3-linux-armv7l.tar.xz \
ARMv8 64-bit Binary: https://nodejs.org/dist/v21.7.3/node-v21.7.3-linux-arm64.tar.xz \
Source Code: https://nodejs.org/dist/v21.7.3/node-v21.7.3.tar.gz \
Other release files: https://nodejs.org/dist/v21.7.3/ \
Documentation: https://nodejs.org/docs/v21.7.3/api/

### SHASUMS

```
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
3ae059cab0a4f18ce79676bbc37112cd428b2f22ba66277bf12873ef9eb34143 node-v21.7.3-aix-ppc64.tar.gz
e0f70657ad7ee7dac2b2b6e137b319a9967da95676567451f92d7a9f39e4cd65 node-v21.7.3-arm64.msi
165d3ba3500cfc8708f85d3815aaaa21ce418164c933d5419c30825ccad3a99c node-v21.7.3-darwin-arm64.tar.gz
6725de89be5852b403456bba2892e3ef2f12cd533e129705d9f4ffcdfe763e05 node-v21.7.3-darwin-arm64.tar.xz
58d0212e169764c3424d2d5bec73e8a098d34b4e82fca6e1dd54083ea3049c5f node-v21.7.3-darwin-x64.tar.gz
ab6efddd4a83be1be705ae519740d837582acb743bab53a361e5ba804a97a97d node-v21.7.3-darwin-x64.tar.xz
3211b00464b626e3a5890461edbae75488d5f02665834455eb2c019e54488588 node-v21.7.3-headers.tar.gz
bb6a3602b2a2a7f6baaabb2c7a33be15a25cc3c85d1095f8d13c2e9795b894b6 node-v21.7.3-headers.tar.xz
15390ba8509b71c0051e61f75a6fdb0a2eb38318c03a01bf60c93d33d414d138 node-v21.7.3-linux-arm64.tar.gz
d48a76d02c5940a6dc0738bc0af22551d15cb58b30a5ddddb54fe6e00021f3c1 node-v21.7.3-linux-arm64.tar.xz
89e430a705d0855b044ba42d3b48f052cffbd4530cc12029ed2965d299167151 node-v21.7.3-linux-armv7l.tar.gz
5cceefa6803781a3f3fbb52e5e28e99b9bbaf3c7eac26950ea031a8f7c77c5fc node-v21.7.3-linux-armv7l.tar.xz
7421c811185c8b4e349af9eefb7c0d54b6451f82c0935e5207da334f8d00a133 node-v21.7.3-linux-ppc64le.tar.gz
abdca8b36e378cbd7500fa3e839259cfa103db42d2b747948d69e70c28853f91 node-v21.7.3-linux-ppc64le.tar.xz
837b88c7a1bf030ea210cafaa62d378ba464f5849ada47ad7afba9d95c225aec node-v21.7.3-linux-s390x.tar.gz
d4975ba2c87ece52d6d10aee8117b90a2d35412672997645be1b4e4594e9904b node-v21.7.3-linux-s390x.tar.xz
a64cbb12282cb60d35743ef4f51561f8d89946a5f0a484f99168f4de602d7c3d node-v21.7.3-linux-x64.tar.gz
19e17a77e59044de169cd19be3f3bccae686982fba022f9634421b44724ee90c node-v21.7.3-linux-x64.tar.xz
3de6fe25a494ed982adc81a585c88b62147a37d8ca74b26a184ff5959ebd771a node-v21.7.3-win-arm64.7z
686a1ed8ec076ec25e198b0e6e31fdd4198aaabbeb384ff137c1e3bf57664bc3 node-v21.7.3-win-arm64.zip
22e771e992119ef5e6e1553601a301c6fe796a1485dae605ce10a5388834fea2 node-v21.7.3-win-x64.7z
d2314f496782b53ad2fe5fa82fca6ff7f39f07fe59dd007116404ad92179c78e node-v21.7.3-win-x64.zip
17c50f9aaba6fe07f6468888614e36261a5b232333cd31478a6e33f243cddd49 node-v21.7.3-win-x86.7z
e96df935994addbbb51228f1724e8411ea685cb60fa26d84cc7c5d74806c38da node-v21.7.3-win-x86.zip
de33d68e92e8948b96515bafee206d0b5c1f5440eb2e07aa15d6ce2f6493f53b node-v21.7.3-x64.msi
b152d667112572c7293408a6968429f20db117aef2f01d6ca652c0dcae9423b0 node-v21.7.3-x86.msi
b8bccb2ec100c6db213d54deaa5aa064a254ec2f4730ca2810262caf425a9173 node-v21.7.3.pkg
ce1f61347671ef219d9c2925313d629d3fef98fc8d7f5ef38dd4656f7d0f58e7 node-v21.7.3.tar.gz
668b26fb1bfc1cff60622bbcf3d715843e16f50c8f30e9f64fb4141814d79a21 node-v21.7.3.tar.xz
509c04ca7909d2bb715cab80e72da1b19f033eea0e0a84ea5de9145b6d3e75b9 win-arm64/node.exe
0e271f1dff6290e15709869e78160b34277427f905f71afe621e6b22c06c0359 win-arm64/node.lib
cff87c002f27b5d72722539749bc584192bc0f8c01d0d24e11501ee0df1c9e18 win-arm64/node_pdb.7z
e826fdee0df83477d20aa73dbb930dfac03f43d9138b51940a1042cc43e833de win-arm64/node_pdb.zip
37901cb69f7de95891b5e5cead529393a18dc8886a7bb4c6c36e35ac955c70fa win-x64/node.exe
473d2b087bfa76b2746542c6c4bd019b0527545849e04cbc3d0872ebd9335f0a win-x64/node.lib
40f3e3f2bc1885ed318a70ffb4cae58358f09e4bc6da82227251d0133a015ce7 win-x64/node_pdb.7z
2e39aa4be528bdc6182c1629d6ad7ebc57e7188a77963050df988b9116a7a7bc win-x64/node_pdb.zip
823764a39291d2693867c9d3cb953c660995b22f3ae4e5c1d164aa68c67c6609 win-x86/node.exe
3b5733c6ef1ab0e6bc303eb01300c93d7671cb58e5991293bd9da732268b364b win-x86/node.lib
4f72d3d4448c66d71b5d016428ba385462d6e7ddac963c0b5ebb4e41ed0c2ca7 win-x86/node_pdb.7z
a6c2907f9b3d5e6be1c06d8e98cdf20cd87de4481e3c68c71a50c225ecb05692 win-x86/node_pdb.zip
-----BEGIN PGP SIGNATURE-----
iQGzBAEBCAAdFiEEiQwI24V5Fi/uDfnbi+q0389VXvQFAmYWv0YACgkQi+q0389V
XvTKTAwAlEHgCQo5XNCnAC9abgGwd5thgXBBvGz/7lp+DJaGdkxbtjlwtSEzbjH/
torHGIT8t7MfKMDoFvrs88CGwBEajWTUaBAlwJaBuNVCLcIzw/SQhW9XOBDnqQxr
mPKdECK/VEVgJWFl++BvAA9O8T/ttc/ac3ZSgucAPu2Sc6+XHqX/5K1GiY1PksW/
3WsTBfhacS98gMKtu6I4PYwdIQrRMjFzgtJb7CeblzoERQeoHZd++6UZEIv0zHlC
mE/LpV4zYdTk4p27cm1QYtTujp/WUFnJ2Eplx28N9+5mBYXOBo5SWB12eAf52p+0
ztfMkFYFDnLpNzrraPDjyax7/3M5nQqBiDQMBKht+5Csz8x5gvD1Yqt74KUSRhO/
dpNevERHLAhvdIvSIiWP7NPhnLIBPSIkTQit9KRl1mCPm+W6T6Iel3yJ8SzdWfDl
xDSwLujFGpdi2vbNd/IG/IiLT6ZJW5XbQPXfncrpIYRe5uL179Pri0TkxEfi1mgw
RGVwEA6l
=eha0
-----END PGP SIGNATURE-----
```
23 changes: 20 additions & 3 deletions pages/en/blog/vulnerability/april-2024-security-releases-2.md
View file
Original file line number Diff line number Diff line change
@@ -1,10 +1,27 @@
---
date: 2024-04-04T03:00:00.000Z
date: 2024-04-10T00:00:00.000Z
category: vulnerability
title: Tuesday, April 9, 2024 Security Releases
title: Wednesday, April 10, 2024 Security Releases
slug: april-2024-security-releases-2
layout: blog-post
author: The Node.js Project
author: Rafael Gonzaga
---

## Security releases available

Updates are now available for the 18.x, 20.x, 21.x Node.js release lines for the
following issues.

## Command injection via args parameter of child_process.spawn without shell option enabled on Windows (CVE-2024-27980) - (HIGH)

Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.

Impact:

- This vulnerability affects all users in active release lines: 18.x, 20.x, 21.x

Thank you, to ryotak for reporting this vulnerability and thank you Ben Noordhuis for fixing it.

---

# Summary
Expand Down
Loading

0 comments on commit 8c03467

Please sign in to comment.