Log4js, a popular logging library for Node.js, saw a minor version bump from 3.0.5 to 3.0.6. Both versions share the same core dependencies like circular-json, date-format, debug, rfdc, and streamroller, indicating no fundamental changes to how the library handles data serialization, date formatting, debugging, deep cloning, or stream rolling. Similarly, the development dependencies for tasks such as sandboxing modules, code coverage, changelog generation, linting with ESLint (including Airbnb's style guide), commit message validation, and TypeScript compilation remain consistent. This suggests a focus on stability and maintenance rather than introducing radical new features.
A key difference lies in the release date: version 3.0.6 was released on October 8, 2018, while 3.0.5 came out on August 12, 2018. This two-month gap implies that 3.0.6 likely includes bug fixes, performance improvements, or minor adjustments identified since the previous release. Developers should upgrade to 3.0.6 to benefit from these enhancements. Also, unpacked size differs slightly: 86682 vs 87456. This change in the unpacked size could indicate adjustments to internal code structure, resource utilization, or potentially the removal of some unused assets, making newer version slightly smaller. While the file count remains constant at 30, the reduced unpacked size of version 3.0.6 suggests a more optimized package.
All the vulnerabilities related to the version 3.0.6 of the package
Incorrect Default Permissions in log4js
Default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause problems if log files contain sensitive information. This would affect any users that have not supplied their own permissions for the files via the mode parameter in the config.
Fixed by:
Released to NPM in log4js@6.4.0
Every version of log4js published allows passing the mode parameter to the configuration of file appenders, see the documentation for details.
Thanks to ranjit-git for raising the issue, and to @lamweili for fixing the problem.
If you have any questions or comments about this advisory: