Date: Thu, 29 Apr 2021 04:06:38 -0600 (MDT)
From: Ariadne Conill <ariadne@dereferenced.org>
To: Nir Ben-Eliezer <nir.ben-eliezer@aquasec.com>
cc: Ariadne Conill <ariadne@dereferenced.org>, 
    "~alpine/devel@lists.alpinelinux.org" <~alpine/devel@lists.alpinelinux.org>
Subject: RE: Security dispute over nodejs vulnerability in Alpine - Help!
In-Reply-To: <AM6PR03MB4711BCBD47528BC3DECA7EEDB35F9@AM6PR03MB4711.eurprd03.prod.outlook.com>
Message-ID: <5f129c7d-b379-5f4-e129-b761f99e5e0@dereferenced.org>
References: <AM6PR03MB471180AD19195D25E1BC462AB3409@AM6PR03MB4711.eurprd03.prod.outlook.com>  <AM6PR03MB47117F359009F8F9A1231595B3409@AM6PR03MB4711.eurprd03.prod.outlook.com> <617756a6-b38c-aa47-86bd-269661b85522@dereferenced.org> 
 <AM6PR03MB47116AB82476787EBC7881F0B3409@AM6PR03MB4711.eurprd03.prod.outlook.com> <f45f3555-d68b-fc8a-17a6-d19e63f734c5@dereferenced.org> <1933c278-6817-4ff3-13d9-bbaaaa91da1@dereferenced.org> 
 <AM6PR03MB4711BCBD47528BC3DECA7EEDB35F9@AM6PR03MB4711.eurprd03.prod.outlook.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII; format=flowed

Hello,

On Thu, 29 Apr 2021, Nir Ben-Eliezer wrote:

> Hey,
>
> I checked https://secdb.alpinelinux.org/v3.13/main.json and https://secdb.alpinelinux.org/v3.13/community.json. As you said, this data should be the most reliable source. Note we are talking about Alpine 3.13.
>
> Here's what I found:
> 1. "main.json" lists package "nodejs" and lists CVE-2020-8265 as fixed in version 14.15.4-r0. This CVE does not appear anywhere else in this json.
> 2. "community.json" lists package "nodejs-current" and lists CVE-2020-8265 as fixed in version 15.5.1-r0.

The nodejs-current package tracks whatever the development branch of Node 
was at the time.  Stable branches of Node are even-numbered, while 
development branches are odd-numbered.

So, the development branch (Node 15) fixed that CVE in 15.5.1-r0, which 
also agrees with the CPE data.

> Do you know the reason for the difference?
>
> So... I'm a bit confused. At the beginning you said that the fact we find CVE-2020-8265 on an Alpine 3.13 image, running nodejs v12.20.1 - is a false positive. In your latest message, however, you mention that Alpine 3.13 does not credit v12.20.1 with the fix for CVE-2020-8265  because that version was never published in Alpine 3.13, only Alpine 3.12.
>
> And finally, when looking at the Alpine 3.13 branch in secdb, which is supposed to be reliable, I see information which indicates that the scanners are working correctly. This is what they all do:
> 1. They identify the OS as Alpine 3.13 - correct. This is the OS the customer is running.
> 2. They identify a nodejs v12.20.1 APK installed on the machine - correct. This is the package the customer installed.
> 3. They identify it is vulnerable to CVE-2020-8265. Should be correct because Alpine doesn't credit v12.20.1 with the fix for this CVE, as you said before.
> 4. They identify Alpine's recommendation to upgrade nodejs to 14.15.4-r0 in order to fix the problem. This is correct according to secdb.alpinelinux.org/v3.13/main.json
>
> I am failing to see what the scanners are doing incorrectly and why you consider this a false positive.

Based on this, I don't consider that a false positive.

Ariadne