System administrators running Bitfocus Buttons are advised to immediately schedule maintenance windows following the discovery of a high-risk Node.js vulnerability capable of triggering arbitrary code execution and denial-of-service conditions. Affected release lines including 1.4, 1.6, 1.8, and 1.9 Beta, have dedicated patches available today via the Bitfocus user portal, while 1.0 and 1.2 is end of life.
A high level security vulnerability has been identified in Node.js, the third-party runtime used by Bitfocus Buttons. We are providing Buttons updates that include the patched runtime and recommend updating your installations as soon as possible.
Vulnerability impact depends on your current release line
- v1.8.0 and above
The vulnerability can be triggered by incoming network requests, as well as outgoing connections to a compromised server. - Before v1.4.19 and 1.6.11
The vulnerability is only triggered during outgoing connections if Buttons connects to a malicious or compromised remote endpoint.
In both cases, the vulnerability may allow an attacker to interrupt services or compromise your computer.
Update version for your release line
- Beta 1.9.0: update to Beta 1.9.1
- 1.8: Update to 1.8.10
- 1.6: Update to 1.6.11
- 1.4: Update to 1.4.19
- 1.2: End of Life (>= 1.4.19)
- 1.0: End of Life (>= 1.4.19)
Enterprise
All enterprise users have been, or will be, contacted directly by our support team.
Remember to back up your configuration before updating, and schedule the update at the earliest practical maintenance window. Prioritize installations reachable from the internet or other untrusted networks.
If you need help choosing or installing an update, please contact our support team.
Thank you,
The Bitfocus team
