Incorrect Default Permissions in log4js

Description

Default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause problems if log files contain sensitive information. This would affect any users that have not supplied their own permissions for the files via the mode parameter in the config.

Recommendation

Update the log4js package to the latest compatible version. Followings are version details:

• Affected version(s): < 6.4.0
• Patched version(s): 6.4.0

References

• GHSA-82v2-mx6x-wq7q
• lists.debian.org
• CVE-2022-21704
• CWE-276
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Incorrect protocol extraction via \r, \n and \t characters - CVE-2022-1243
• Incorrect Authorization in @uppy/companion - CVE-2022-0528
• jplayer Cross Site Scripting vulnerability - CVE-2013-2022
• Server-Side Request Forgery in @peertube/embed-api - CVE-2022-0508

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

log4js