Incorrect Default Permissions in log4js

Description

Default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause problems if log files contain sensitive information. This would affect any users that have not supplied their own permissions for the files via the mode parameter in the config.

Recommendation

Update the log4js package to the latest compatible version. Followings are version details:

• Affected version(s): < 6.4.0
• Patched version(s): 6.4.0

References

• GHSA-82v2-mx6x-wq7q
• lists.debian.org
• CVE-2022-21704
• CWE-276
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Incorrect Authorization in cross-fetch - CVE-2022-1365
• Incorrect Authorization in @uppy/companion - CVE-2022-0528
• Incorrect protocol extraction via \r, \n and \t characters - CVE-2022-1243
• Incorrect default cookie name and recommendation - Vulnerability

Tags:

npm

log4js