Fedora 30 Security Update: Node.js Handlebars Critical Code Execution Risk

Handlebars.js is an extension to the Mustache templating language created by

Chris Wanstrath. Handlebars.js and Mustache are both logicless templating

languages that keep the view and the code separated like we all know they should

be.

Security fix for https://github.com/advisories/GHSA-q42p-pg8m-cqh6

[ 1 ] Bug #1685824 - nodejs-handlebars: prototype pollution in object's prototype leading to arbitrary code execution on the server

https://bugzilla.redhat.com/show_bug.cgi?id=1685824

su -c 'dnf upgrade --advisory FEDORA-2019-c1213f866c' at the command

line. For more information, refer to the dnf documentation available at

https://dnf.readthedocs.io/en/latest/command_ref.html

All packages are signed with the Fedora Project GPG key. More details on the

GPG keys used by the Fedora Project can be found at

https://fedoraproject.org/security/

package-announce mailing list -- package-announce@lists.fedoraproject.org

To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org

Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/

List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines

List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/