Security Update for node-log4js
Summary
DLA-3229-1: node-log4js - security update. Affects node-log4js versions < 4.0.2-2+deb10u1. Fixed in 4.0.2-2+deb10u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-log4js is a port of log4js in Node.js, providing logging capabilities for Node.js applications. It offers various appenders, including file, fileSync, and dateFile, which allow logging to files. By default, the log files created by these appenders have world-readable permissions. This can pose a security risk if the log files contain sensitive information. The vulnerability affects users who have not specified their own file permissions via the mode parameter in the configuration.
Vulnerability Detail
The default file permissions for log files created by the file, fileSync, and dateFile appenders in node-log4js are set to world-readable. This means that anyone with access to the file system can read the log files, potentially exposing sensitive information. The vulnerability arises from the lack of proper file permission configuration in the default behavior of node-log4js. Attackers with access to the log files can gather sensitive data, such as passwords or other confidential information, leading to potential misuse or unauthorized access.
How To Fix
Minimum fixed version
4.0.2-2+deb10u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-log4jsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the package is not feasible immediately, a workaround is to manually set the file permissions for the log files created by the file, fileSync, and dateFile appenders. This can be done by specifying the desired file permissions using the mode parameter in the configuration. For example, setting the mode to 0600 would restrict access to the owner only.
Conclusion
The default file permissions in node-log4js for log files created by certain appenders can lead to a security risk if the log files contain sensitive information. It is recommended to upgrade to the fixed version of the package or manually set the file permissions to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for node-log4js →
FAQ
node-log4js is a logging library for Node.js applications, providing various appenders for logging to different destinations.
The vulnerability allows anyone with access to the file system to read the log files created by node-log4js, potentially exposing sensitive information.
Users of node-log4js who have not specified their own file permissions via the mode parameter in the configuration are affected by this vulnerability.
To fix this vulnerability, upgrade to version 4.0.2-2+deb10u1 of the node-log4js package.
Yes, a workaround is to manually set the file permissions for the log files by specifying the desired permissions using the mode parameter in the configuration.
Related vulnerabilities
Recent vulnerabilities recorded for node-log4js.
