diff --git a/CHANGELOG.md b/CHANGELOG.md index 847c9b4..e1e21e6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -77,6 +77,7 @@ For major (breaking) changes - **version 4, 3 and 2** - see end of page. | Version | Date | Comment | | -------------- | -------------- | -------- | +| 5.6.13 | 2021-05-04 | `dockerImagesInspect()`, `dockerContainerInspect()`, `dockerContainerProcesses()` security updates | | 5.6.12 | 2021-04-09 | `networkinterfaces()` windows detection fix | | 5.6.11 | 2021-04-08 | `versions()` parameter sanitation | | 5.6.10 | 2021-03-29 | `vboxInfo()` fixed windows bug | diff --git a/docs/history.html b/docs/history.html index 1dcabcb..8606ee8 100644 --- a/docs/history.html +++ b/docs/history.html @@ -56,6 +56,11 @@ + + 5.6.13 + 2021-05-04 + dockerImagesInspect() dockerContainerInspect() dockerContainerProcesses() parameter sanitation + 5.6.12 2021-04-09 @@ -2277,4 +2282,4 @@ - + \ No newline at end of file diff --git a/docs/index.html b/docs/index.html index 5d33c09..7bd7d1e 100644 --- a/docs/index.html +++ b/docs/index.html @@ -166,11 +166,11 @@
- Security advisory:
Update to v5.6.11 + Security advisory:
Update to v5.6.13
systeminformation
 
-
New Version: 5.6.12
+
New Version: 5.6.13
@@ -211,7 +211,7 @@
Downloads last month
-
410
+
413
Dependents
@@ -398,4 +398,4 @@ - + \ No newline at end of file diff --git a/docs/security.html b/docs/security.html index b2b9336..e8e1b3b 100644 --- a/docs/security.html +++ b/docs/security.html @@ -48,6 +48,23 @@

This can lead to serious impact on your servers!

We highly recommend to always upgrade to the latest version of our package. We maintain security updates for version 5 AND also version 4. For version 4 you can install latest version by placing "systeminformation": "^4" in your package.json (dependencies) and run npm install

+

Command Injection Vulnerability

+

Affected versions: + < 5.6.13 and < 4.34.21
+ Date: 2021-05-04
+ CVE indentifier - +

+ +

Impact

+

We had an issue that there was a possibility to perform a potential command injection possibility by passing a non string values as a parameter to the dockerImagesInspect(), dockerContainerInspect(), dockerContainerProcesses().

+ +

Patch

+

Problem was fixed with parameter checking. Please upgrade to version >= 5.6.13 (or >= 4.34.21 if you are using version 4).

+ +

Workarround

+

If you cannot upgrade, be sure to check or sanitize parameter strings that are passed to dockerImagesInspect(), dockerContainerInspect(), dockerContainerProcesses() (string only)

+
+

Command Injection Vulnerability

Affected versions: < 5.6.11 and < 4.34.20
@@ -236,4 +253,4 @@ - + \ No newline at end of file diff --git a/docs/v4/history.html b/docs/v4/history.html index 2aedaf7..948bb0f 100644 --- a/docs/v4/history.html +++ b/docs/v4/history.html @@ -83,6 +83,16 @@ + + 4.34.21 + 2021-05-04 + dockerContainerInspect() dockerContainerProcesses() parameter validation fix + + + 4.34.20 + 2021-05-04 + versions() parameter sanitation + 4.34.19 2021-03-16 @@ -2132,4 +2142,4 @@ - + \ No newline at end of file diff --git a/docs/v4/index.html b/docs/v4/index.html index 7e7f2d5..0378a53 100644 --- a/docs/v4/index.html +++ b/docs/v4/index.html @@ -165,12 +165,12 @@

- Security advisory:
Update to v4.34.20 + Security advisory:
Update to v4.34.21
systeminformation
 
Version 4 documentation
-
Current Version: 4.34.20
+
Current Version: 4.34.21
@@ -369,4 +369,4 @@ - + \ No newline at end of file diff --git a/docs/v4/security.html b/docs/v4/security.html index 17e939c..224ec98 100644 --- a/docs/v4/security.html +++ b/docs/v4/security.html @@ -47,6 +47,23 @@

This can lead to serious impact on your servers!

We highly recommend to always upgrade to the latest version of our package. We maintain security updates for version 5 AND also version 4. For version 4 you can install latest version by placing "systeminformation": "^4" in your package.json (dependencies) and run npm install

+

Command Injection Vulnerability

+

Affected versions: + < 4.34.21
+ Date: 2021-05-04
+ CVE indentifier - +

+ +

Impact

+

We had an issue that there was a possibility to perform a potential command injection possibility by passing a non string values as a parameter to the dockerContainerInspect(), dockerContainerProcesses().

+ +

Patch

+

Problem was fixed with parameter checking. Please upgrade to version >= 4.34.21 if you are using version 4.

+ +

Workarround

+

If you cannot upgrade, be sure to check or sanitize parameter strings that are passed to dockerContainerInspect(), dockerContainerProcesses() (string only)

+
+

Command Injection Vulnerability

Affected versions: < 4.34.20
@@ -231,4 +248,4 @@ - + \ No newline at end of file