From: Nir Ben-Eliezer <nir.ben-eliezer@aquasec.com>
To: "~alpine/devel@lists.alpinelinux.org"
	<~alpine/devel@lists.alpinelinux.org>
Subject: RE: Re: Security dispute over nodejs vulnerability in Alpine - Help!
Thread-Topic: Re: Security dispute over nodejs vulnerability in Alpine - Help!
Thread-Index: Adc84Wah4na/ptoZQ7+FKoL+ctu62wAAjIIw
Date: Thu, 29 Apr 2021 10:37:21 +0000
Message-ID: 
 <AM6PR03MB471174AA1EC7B02D9F56C687B35F9@AM6PR03MB4711.eurprd03.prod.outlook.com>
References: 
 <AM6PR03MB4711B475D15586303F7AD1B8B35F9@AM6PR03MB4711.eurprd03.prod.outlook.com>
In-Reply-To: 
 <AM6PR03MB4711B475D15586303F7AD1B8B35F9@AM6PR03MB4711.eurprd03.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 98cef9c4-e482-4b58-6e47-08d90afac52c
X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Apr 2021 10:37:21.5421
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: bc034cf3-566b-41ca-9f24-5dc49474b05e
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 66xXS5tkJPAYEDYGSeTy3fDGsroCR7hjjDwFnq9NbgH/tBcla1Pfjl2LPoNPT0Ks9nmTTyndzBp4JGuO4LCvV/5GhTFpic7WhOQd2iIUSfI=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM6PR03MB4309

Thanks Ariadne.

But one thing still bugs me here. Consider the following scenario: I instal=
l Alpine 3.13. I then install nodejs V12.20.1 through APK - this is possibl=
e. Bottom line - Am I vulnerable to CVE-2020-8265?=20

Per Alpine's security advisory - I am, because Alpine indicates CVE-2020-82=
65 is only fixed on nodejs V14.15.4-r0.=20

But per the node community, I'm not, because they fixed this vulnerability =
in V12.20.1 (according to their release notes).

What I'm asking ultimately, is this: If the node community indicated a cert=
ain CVE is fixed in version X, why would Alpine indicate a different versio=
n? Is it merely an issue of testing, and the fact that version X was not ce=
rtified to be used with a certain branch of Alpine, or is there a different=
 reason?

Furthermore, if I compared nodejs V12.20.1 source which I downloaded from t=
he node project on github, to nodejs V12.20.1 which I downloaded using APK,=
 will they be the same?

Again I thank you for your time and effort, and your help in sorting this o=
ut for us.
Nir