blog: Sep 2020 sec release post announcement (#3379)

Signed-off-by: Michael Dawson <[email protected]>

Author: mhdawson

build.js

@@ -278,7 +278,7 @@ function getSource (callback) {
         },
         banner: {
           visible: true,
-          text: 'New security releases to be made available Sep 15, 2020',
+          text: 'New security releases are available',
           link: '/en/blog/vulnerability/september-2020-security-releases/'
         }
       }

locale/en/blog/vulnerability/september-2020-security-releases.md

@@ -1,12 +1,53 @@
 ---
-date: 2020-09-08T18:00:00.000Z
+date: 2020-09-15T21:50:00.000Z
 category: vulnerability
 title: September 2020 Security Releases
 slug: september-2020-security-releases
 layout: blog-post.hbs
 author: Michael Dawson
 ---
 
+## _(Update 15-Sept-2020)_ Security releases available
+
+Updates are now available for v10,x, v12.x and v14.x Node.js release lines for the following issues.
+
+### HTTP Request Smuggling due to CR-to-Hyphen conversion (High) (CVE-2020-8201)
+
+Affected Node.js versions converted carriage returns in HTTP request headers to a hyphen before parsing. This can lead to HTTP Request Smuggling as it is a non-standard interpretation of the header.
+
+Impacts:
+* All versions of the 14.x and 12.x releases line
+
+Thank you to Amit Klein who works at Safebreach for reporting this vulnerability.
+
+### Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests (Critical) (CVE-2020-8251)
+
+Node.js is vulnerable to HTTP denial of service (DOS) attacks based on delayed requests submission which can make the server unable to accept new connections. The fix a new http.Server option called requestTimeout
+with a default value of 0 which means it is disabled by default. This should be set when Node.js is used as an edge server, for more details refer to the documentation.
+
+Impacts:
+* All versions of the 14.x release line
+
+Thank you to Paolo Insogna and Matteo Collina who work at NearFom for reporting and fixing this vulnerability.
+
+### fs.realpath.native on may cause buffer overflow (Medium) (CVE-2020-8252)
+
+libuv's realpath implementation incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.
+
+Impacts:
+
+* All versions of the 10.x release line
+* All versions of the 12.x release line
+* All versions of the 14.x release line before 14.9.0
+
+## Downloads and release details
+
+* [Node.js v10.22.1 (LTS)](https://nodejs.org/en/blog/release/v10.22.1/)
+* [Node.js v12.18.4 (LTS)](https://nodejs.org/en/blog/release/v12.18.4/)
+* [Node.js v14.11.0 (Current)](https://nodejs.org/en/blog/release/v14.11.0/)
+
+--------------------------------------
+
 ## Summary
 
 The Node.js project will release new versions of all supported release lines on or shortly after Tuesday, September 15, 2020.