Log4js, a popular Node.js logging library, saw a minor version update from 0.5.5 to 0.5.6 in late 2012. Both versions share identical dependency and development dependency lists. Async version 0.1.15 is necessary for asynchronous operations, while development dependencies like Vows, Sandboxed-module, Hook.io, and Underscore are used for testing and development purposes. The core functionality, described as a port of Log4js, remains consistent between the versions, providing developers with a familiar logging framework for their Node.js applications. The repository URL on Github also remained unchanged.
The key difference lies in the release date. Version 0.5.6 was released on December 2, 2012, whereas version 0.5.5 was released on November 9, 2012. This suggests that version 0.5.6 likely contains bug fixes, minor improvements, or dependency updates that do not fundamentally alter the API. Developers should consider upgrading to the newer version (0.5.6) to benefit from these potential improvements. The packages, authored by Gareth Jones, are accessible via npm, with their respective tarballs available on the npm registry. For developers already using Log4js, the transition to 0.5.6 should be seamless, providing a potentially more stable and refined logging experience without requiring significant code changes.
All the vulnerabilities related to the version 0.5.6 of the package
Incorrect Default Permissions in log4js
Default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause problems if log files contain sensitive information. This would affect any users that have not supplied their own permissions for the files via the mode parameter in the config.
Fixed by:
Released to NPM in log4js@6.4.0
Every version of log4js published allows passing the mode parameter to the configuration of file appenders, see the documentation for details.
Thanks to ranjit-git for raising the issue, and to @lamweili for fixing the problem.
If you have any questions or comments about this advisory: