From: Nir Ben-Eliezer <nir.ben-eliezer@aquasec.com>
To: "~alpine/devel@lists.alpinelinux.org"
	<~alpine/devel@lists.alpinelinux.org>
Subject: Security dispute over nodejs vulnerability in Alpine - Help!
Thread-Topic: Security dispute over nodejs vulnerability in Alpine - Help!
Thread-Index: Adc8ZJoE1wXjMpkARyK94xZIcwCv1wADeZLg
Date: Wed, 28 Apr 2021 21:08:04 +0000
Message-ID: 
 <AM6PR03MB47117F359009F8F9A1231595B3409@AM6PR03MB4711.eurprd03.prod.outlook.com>
References: 
 <AM6PR03MB471180AD19195D25E1BC462AB3409@AM6PR03MB4711.eurprd03.prod.outlook.com>
In-Reply-To: 
 <AM6PR03MB471180AD19195D25E1BC462AB3409@AM6PR03MB4711.eurprd03.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 6e69a9e9-9879-43cd-1c6b-08d90a89b708
X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Apr 2021 21:08:04.6175
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: bc034cf3-566b-41ca-9f24-5dc49474b05e
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 92jntKKTKg8gYUOG/JPw2GrM96B7YOO6Umd2MSQQoKTb7Xno68jXQwBUJxL6K76pOerNYZc+rXLDvXkWh7R7zQuDILj5WLIYuC48f6NPuCU=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR03MB6901

Hello,
I've encountered a security dispute while working with nodejs and I'd appre=
ciate the opinions of the Alpine community and maintainers on this importan=
t subject.

I've recently upgraded my nodejs package version to v12.20.1 on my Alpine i=
mage, through Alpine's package manager (release notes of node community:=A0=
https://nodejs.org/en/blog/release/v12.20.1/). As you will see in the relea=
se notes, one of the vulnerabilities that is fixed in this version, is CVE-=
2020-8265.

I've also upgraded my Alpine image to Alpine v3.13. However, looking into A=
lpine's v3.13 release notes (here:=A0https://git.alpinelinux.org/aports/bla=
me/main/nodejs/APKBUILD?h=3D3.13-stable) you'll see that this same vulnerab=
ility appears to be fixed only in nodejs v14.15.4-r0.

I am running a vulnerability scanner on my Alpine 3.13 image, and it identi=
fies CVE-2020-8265, even though it was supposed to be fixed in as early as =
nodejs v12.20.1, according to the node community.

And therefore - the dispute.

My question: Should I consider this vulnerability a false positive, and fol=
low the release notes of node? Or should I use Alpine's determination and u=
pgrade my nodejs version to v14.15.4-r0, where Alpine claim it to be fixed?=
 Why does Alpine state the fix for said vulnerability exists in v14.15.4-r0=
 of nodejs, whereas the node maintainers indicate the fix is present in an =
earlier version?=20

Thank you very much!
Nir