Date: Wed, 28 Apr 2021 16:44:09 -0600 (MDT)
From: Ariadne Conill <ariadne@dereferenced.org>
To: Ariadne Conill <ariadne@dereferenced.org>
cc: Nir Ben-Eliezer <nir.ben-eliezer@aquasec.com>, 
    "~alpine/devel@lists.alpinelinux.org" <~alpine/devel@lists.alpinelinux.org>
Subject: RE: Security dispute over nodejs vulnerability in Alpine - Help!
In-Reply-To: <f45f3555-d68b-fc8a-17a6-d19e63f734c5@dereferenced.org>
Message-ID: <1933c278-6817-4ff3-13d9-bbaaaa91da1@dereferenced.org>
References: <AM6PR03MB471180AD19195D25E1BC462AB3409@AM6PR03MB4711.eurprd03.prod.outlook.com>  <AM6PR03MB47117F359009F8F9A1231595B3409@AM6PR03MB4711.eurprd03.prod.outlook.com> <617756a6-b38c-aa47-86bd-269661b85522@dereferenced.org> 
 <AM6PR03MB47116AB82476787EBC7881F0B3409@AM6PR03MB4711.eurprd03.prod.outlook.com> <f45f3555-d68b-fc8a-17a6-d19e63f734c5@dereferenced.org>
MIME-Version: 1.0
Content-Type: text/plain; format=flowed; charset=US-ASCII

Hello,

On Wed, 28 Apr 2021, Ariadne Conill wrote:

> Hello,
>
> On Wed, 28 Apr 2021, Nir Ben-Eliezer wrote:
>
>> Hi Ariadne, and thank you very much for your quick response.
>> 
>> I am asking this on behalf of one of our customers. I've used three 
>> different scanners, all yield the same result, identifying nodejs v12.20.1 
>> as vulnerable in Alpine 3.13, and recommending to upgrade it to 
>> v14.15.4-r0, where it is fixed.
>> 
>> The reason why the scanners behave this way is due to the information 
>> listed on this 
>> page:https://git.alpinelinux.org/aports/blame/main/nodejs/APKBUILD?h=3.13-stable. 
>> If you scroll down to rows 18-19, you'll see this:
>> +#   14.15.4-r0:
>> +#     - CVE-2020-8265
>> +#     - CVE-2020-8287
>> 
>> Indicating that CVE-2020-8265 is fixed in nodejs 14.15.4-r0 on Alpine's 
>> 3.13 branch. I did not find any place indicating that nodejs v12.20.1 also 
>> contains the fix in Alpine branch 3.13.
>
> It appears that your scanners are probably using our security databases 
> incorrectly, or at least making the wrong assumptions about how the version 
> lifecycle works in secfixes land.
>
> To explain: we publish security databases for every branch of Alpine, these 
> can be fetched at https://secdb.alpinelinux.org/.  These databases are 
> compiled from the perspective of each branch.  Or in other words, they only 
> describe versions that are published in that branch.
>
> Incidentally, one or more security companies are presently scraping our cgit 
> instance for this information.  It may be that you have stale information 
> about the v3.13 branch if your security scanners were doing
> this, as we have recently taken action to stop abuse of our cgit instance for 
> this purpose.  In that case, see the above note about secdb.alpinelinux.org 
> and you will have more reliable data.
>
> Anyway, Alpine 3.13 does not credit v12.20.1 with the fix for CVE-2020-8265 
> because that version was never published in Alpine 3.13, only Alpine 3.12.
>
> Each security database publishes information based on what packages have been 
> published in that branch.
>
> You may also wish to look at our security database viewer at 
> https://security.alpinelinux.org/vuln/CVE-2020-8265, which shows both Alpine 
> 3.12 and 3.13 having fixes in their respective versions of Node.

Or they would if the CPE rules matched the actual package name... :)

But you can at least view the CPE rules for that one.

Ariadne