From: Nir Ben-Eliezer <nir.ben-eliezer@aquasec.com>
To: Ariadne Conill <ariadne@dereferenced.org>
CC: "~alpine/devel@lists.alpinelinux.org"
	<~alpine/devel@lists.alpinelinux.org>
Subject: RE: Security dispute over nodejs vulnerability in Alpine - Help!
Thread-Topic: Security dispute over nodejs vulnerability in Alpine - Help!
Thread-Index: Adc8ZJoE1wXjMpkARyK94xZIcwCv1wADeZLgAABMCYAAAOd0QA==
Date: Wed, 28 Apr 2021 21:56:58 +0000
Message-ID: 
 <AM6PR03MB47116AB82476787EBC7881F0B3409@AM6PR03MB4711.eurprd03.prod.outlook.com>
References: 
 <AM6PR03MB471180AD19195D25E1BC462AB3409@AM6PR03MB4711.eurprd03.prod.outlook.com>
  <AM6PR03MB47117F359009F8F9A1231595B3409@AM6PR03MB4711.eurprd03.prod.outlook.com>
 <617756a6-b38c-aa47-86bd-269661b85522@dereferenced.org>
In-Reply-To: <617756a6-b38c-aa47-86bd-269661b85522@dereferenced.org>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 2ccae2fc-7844-4b87-ab46-08d90a908c05
X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Apr 2021 21:56:58.9576
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: bc034cf3-566b-41ca-9f24-5dc49474b05e
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: UftS9xJ42yzpfPC6n0F+9Is4Y+cSi7LCUp98Cj8FL2HdQ33IEMxEg0pNy7HuUT1BvPKP0WU3Fn38msQnbX8oEFOTX+3ay4crTCSAo8uMjCg=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR03MB6966

Hi Ariadne, and thank you very much for your quick response.

I am asking this on behalf of one of our customers. I've used three differe=
nt scanners, all yield the same result, identifying nodejs v12.20.1 as vuln=
erable in Alpine 3.13, and recommending to upgrade it to v14.15.4-r0, where=
 it is fixed.

The reason why the scanners behave this way is due to the information liste=
d on this page:https://git.alpinelinux.org/aports/blame/main/nodejs/APKBUIL=
D?h=3D3.13-stable. If you scroll down to rows 18-19, you'll see this:
+#   14.15.4-r0:
+#     - CVE-2020-8265
+#     - CVE-2020-8287

Indicating that CVE-2020-8265 is fixed in nodejs 14.15.4-r0 on Alpine's 3.1=
3 branch. I did not find any place indicating that nodejs v12.20.1 also con=
tains the fix in Alpine branch 3.13.=20

I'd appreciate your clarification on this issue.

Thank you,
Nir

-----Original Message-----
From: Ariadne Conill <ariadne@dereferenced.org>=20
Sent: Thursday, April 29, 2021 12:16 AM
To: Nir Ben-Eliezer <nir.ben-eliezer@aquasec.com>
Cc: ~alpine/devel@lists.alpinelinux.org
Subject: Re: Security dispute over nodejs vulnerability in Alpine - Help!

Hello,

On Wed, 28 Apr 2021, Nir Ben-Eliezer wrote:

> Hello,
> I've encountered a security dispute while working with nodejs and I'd app=
reciate the opinions of the Alpine community and maintainers on this import=
ant subject.
>
> I've recently upgraded my nodejs package version to v12.20.1 on my Alpine=
 image, through Alpine's package manager (release notes of node community:=
=A0https://eur02.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fnode=
js.org%2Fen%2Fblog%2Frelease%2Fv12.20.1%2F&amp;data=3D04%7C01%7Cnir.ben-eli=
ezer%40aquasec.com%7C8902f1029435429727b208d90a8ad5e0%7Cbc034cf3566b41ca9f2=
45dc49474b05e%7C0%7C0%7C637552414283503706%7CUnknown%7CTWFpbGZsb3d8eyJWIjoi=
MC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=
=3DHhFHpnK9noQ%2BL7Gd2In1JEtcyNnzEa14DsDzt4%2Bj8xQ%3D&amp;reserved=3D0). As=
 you will see in the release notes, one of the vulnerabilities that is fixe=
d in this version, is CVE-2020-8265.
>
> I've also upgraded my Alpine image to Alpine v3.13. However, looking into=
 Alpine's v3.13 release notes (here:=A0https://eur02.safelinks.protection.o=
utlook.com/?url=3Dhttps%3A%2F%2Fgit.alpinelinux.org%2Faports%2Fblame%2Fmain=
%2Fnodejs%2FAPKBUILD%3Fh%3D3.13-stable&amp;data=3D04%7C01%7Cnir.ben-eliezer=
%40aquasec.com%7C8902f1029435429727b208d90a8ad5e0%7Cbc034cf3566b41ca9f245dc=
49474b05e%7C0%7C0%7C637552414283503706%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4w=
LjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=3Dz=
QqwWBOA%2Bw3EcOSZSttypGnNCF4VJKitFW2w6wsCIxw%3D&amp;reserved=3D0) you'll se=
e that this same vulnerability appears to be fixed only in nodejs v14.15.4-=
r0.
>
> I am running a vulnerability scanner on my Alpine 3.13 image, and it iden=
tifies CVE-2020-8265, even though it was supposed to be fixed in as early a=
s nodejs v12.20.1, according to the node community.
>
> And therefore - the dispute.
>
> My question: Should I consider this vulnerability a false positive, and f=
ollow the release notes of node? Or should I use Alpine's determination and=
 upgrade my nodejs version to v14.15.4-r0, where Alpine claim it to be fixe=
d? Why does Alpine state the fix for said vulnerability exists in v14.15.4-=
r0 of nodejs, whereas the node maintainers indicate the fix is present in a=
n earlier version?

Please see my previous response:=20
https://eur02.safelinks.protection.outlook.com/?url=3Dhttps:%2F%2Flists.alp=
inelinux.org%2F~alpine%2Fdevel%2F%253CAM6PR03MB471180AD19195D25E1BC462AB340=
9%2540AM6PR03MB4711.eurprd03.prod.outlook.com%253E%23%253Ccabebb1a-591d-efd=
1-31da-e690dad14%40dereferenced.org%253E&amp;data=3D04%7C01%7Cnir.ben-eliez=
er%40aquasec.com%7C8902f1029435429727b208d90a8ad5e0%7Cbc034cf3566b41ca9f245=
dc49474b05e%7C0%7C0%7C637552414283503706%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC=
4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&amp;sdata=
=3DI2De9GsoeaeY2yqAQvIy%2FiFFs83U32%2BRpTBiTDM%2Bvfg%3D&amp;reserved=3D0

Thanks,
Ariadne