Date: Wed, 28 Apr 2021 15:16:01 -0600 (MDT)
From: Ariadne Conill <ariadne@dereferenced.org>
To: Nir Ben-Eliezer <nir.ben-eliezer@aquasec.com>
cc: "~alpine/devel@lists.alpinelinux.org" <~alpine/devel@lists.alpinelinux.org>
Subject: Re: Security dispute over nodejs vulnerability in Alpine - Help!
In-Reply-To: <AM6PR03MB47117F359009F8F9A1231595B3409@AM6PR03MB4711.eurprd03.prod.outlook.com>
Message-ID: <617756a6-b38c-aa47-86bd-269661b85522@dereferenced.org>
References: <AM6PR03MB471180AD19195D25E1BC462AB3409@AM6PR03MB4711.eurprd03.prod.outlook.com>  <AM6PR03MB47117F359009F8F9A1231595B3409@AM6PR03MB4711.eurprd03.prod.outlook.com>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-174144465-1619644563=:15938"

  This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.

--0-174144465-1619644563=:15938
Content-Type: text/plain; charset="iso-8859-1"; format="flowed"
Content-Transfer-Encoding: quoted-printable

Hello,

On Wed, 28 Apr 2021, Nir Ben-Eliezer wrote:

> Hello,
> I've encountered a security dispute while working with nodejs and I'd app=
reciate the opinions of the Alpine community and maintainers on this import=
ant subject.
>
> I've recently upgraded my nodejs package version to v12.20.1 on my Alpine=
 image, through Alpine's package manager (release notes of node community:=
=A0https://nodejs.org/en/blog/release/v12.20.1/). As you will see in the re=
lease notes, one of the vulnerabilities that is fixed in this version, is C=
VE-2020-8265.
>
> I've also upgraded my Alpine image to Alpine v3.13. However, looking into=
 Alpine's v3.13 release notes (here:=A0https://git.alpinelinux.org/aports/b=
lame/main/nodejs/APKBUILD?h=3D3.13-stable) you'll see that this same vulner=
ability appears to be fixed only in nodejs v14.15.4-r0.
>
> I am running a vulnerability scanner on my Alpine 3.13 image, and it iden=
tifies CVE-2020-8265, even though it was supposed to be fixed in as early a=
s nodejs v12.20.1, according to the node community.
>
> And therefore - the dispute.
>
> My question: Should I consider this vulnerability a false positive, and f=
ollow the release notes of node? Or should I use Alpine's determination and=
 upgrade my nodejs version to v14.15.4-r0, where Alpine claim it to be fixe=
d? Why does Alpine state the fix for said vulnerability exists in v14.15.4-=
r0 of nodejs, whereas the node maintainers indicate the fix is present in a=
n earlier version?

Please see my previous response:=20
https://lists.alpinelinux.org/~alpine/devel/%3CAM6PR03MB471180AD19195D25E1B=
C462AB3409%40AM6PR03MB4711.eurprd03.prod.outlook.com%3E#%3Ccabebb1a-591d-ef=
d1-31da-e690dad14@dereferenced.org%3E

Thanks,
Ariadne
--0-174144465-1619644563=:15938--