From: Nir Ben-Eliezer <nir.ben-eliezer@aquasec.com>
To: "~alpine/devel@lists.alpinelinux.org"
	<~alpine/devel@lists.alpinelinux.org>
Subject: Security dispute over nodejs vulnerability in Alpine - Help!
Thread-Topic: Security dispute over nodejs vulnerability in Alpine - Help!
Thread-Index: Adc8ZJoE1wXjMpkARyK94xZIcwCv1w==
Date: Wed, 28 Apr 2021 19:32:38 +0000
Message-ID: 
 <AM6PR03MB471180AD19195D25E1BC462AB3409@AM6PR03MB4711.eurprd03.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: multipart/alternative;
	boundary="_000_AM6PR03MB471180AD19195D25E1BC462AB3409AM6PR03MB4711eurp_"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 2bf8e1a0-65c5-40b5-0e17-08d90a7c622c
X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Apr 2021 19:32:38.8023
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: bc034cf3-566b-41ca-9f24-5dc49474b05e
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 5i+gHSOpx+r7lmctUuCRCWr4OH5GOKAGpeaUELoSnH53mAwWnR/kSXhycyeFEnMxDdQ7df7xNF0mjss8QCPXisI85LWO6X1uHXq83l9P+2w=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5PR03MB2995

--_000_AM6PR03MB471180AD19195D25E1BC462AB3409AM6PR03MB4711eurp_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hello,
I've encountered a security dispute while working with nodejs and I'd appre=
ciate the opinions of the Alpine community and maintainers on this importan=
t subject.

I've recently upgraded my nodejs package version to v12.20.1 on my Alpine i=
mage, through Alpine's package manager (release notes of node community: ht=
tps://nodejs.org/en/blog/release/v12.20.1/). As you will see in the release=
 notes, one of the vulnerabilities that is fixed in this version, is CVE-20=
20-8265.

I've also upgraded my Alpine image to Alpine v3.13. However, looking into A=
lpine's v3.13 release notes (here: https://git.alpinelinux.org/aports/blame=
/main/nodejs/APKBUILD?h=3D3.13-stable) you'll see that this same vulnerabil=
ity appears to be fixed only in nodejs v14.15.4-r0.

I am running a vulnerability scanner on my Alpine 3.13 image, and it identi=
fies CVE-2020-8265, even though it was supposed to be fixed in as early as =
nodejs v12.20.1, according to the node community.

And therefore - the dispute.

My question: Should I consider this vulnerability a false positive, and fol=
low the release notes of node? Or should I use Alpine's determination and u=
pgrade my nodejs version to v14.15.4-r0, where Alpine claim it to be fixed?=
 Why does Alpine state the fix for said vulnerability exists in v14.15.4-r0=
 of nodejs, whereas the node maintainers indicate the fix is present in an =
earlier version?

Thank you very much!
Nir


--_000_AM6PR03MB471180AD19195D25E1BC462AB3409AM6PR03MB4711eurp_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	font-size:11.0pt;
	font-family:"Calibri",sans-serif;}
span.EmailStyle17
	{mso-style-type:personal-compose;
	font-family:"Calibri",sans-serif;
	color:windowtext;}
.MsoChpDefault
	{mso-style-type:export-only;
	font-family:"Calibri",sans-serif;}
@page WordSection1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3D"EN-US" link=3D"#0563C1" vlink=3D"#954F72" style=3D"word-wrap:=
break-word">
<div class=3D"WordSection1">
<p class=3D"MsoNormal">Hello,<o:p></o:p></p>
<p class=3D"MsoNormal" style=3D"box-sizing: border-box;font-variant-ligatur=
es: normal;font-variant-caps: normal;orphans: 2;text-align:start;widows: 2;=
-webkit-text-stroke-width: 0px;text-decoration-thickness: initial;text-deco=
ration-style: initial;text-decoration-color: initial;word-spacing:0px">
I've encountered a security dispute while working with nodejs and I'd appre=
ciate the opinions of the Alpine community and maintainers on this importan=
t subject.<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal" style=3D"box-sizing: border-box;font-variant-ligatur=
es: normal;font-variant-caps: normal;orphans: 2;text-align:start;widows: 2;=
-webkit-text-stroke-width: 0px;text-decoration-thickness: initial;text-deco=
ration-style: initial;text-decoration-color: initial;word-spacing:0px">
I've recently upgraded my nodejs package version to v12.20.1 on my Alpine i=
mage, through Alpine's package manager (release notes of node community:&nb=
sp;<a href=3D"https://nodejs.org/en/blog/release/v12.20.1/"><span style=3D"=
color:windowtext;text-decoration:none">https://nodejs.org/en/blog/release/v=
12.20.1/</span></a>).
 As you will see in the release notes, one of the vulnerabilities that is f=
ixed in this version, is CVE-2020-8265.<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal" style=3D"box-sizing: border-box;font-variant-ligatur=
es: normal;font-variant-caps: normal;orphans: 2;text-align:start;widows: 2;=
-webkit-text-stroke-width: 0px;text-decoration-thickness: initial;text-deco=
ration-style: initial;text-decoration-color: initial;word-spacing:0px">
I've also upgraded my Alpine image to Alpine v3.13. However, looking into A=
lpine's v3.13 release notes (here:&nbsp;<a href=3D"https://git.alpinelinux.=
org/aports/blame/main/nodejs/APKBUILD?h=3D3.13-stable"><span style=3D"color=
:windowtext;text-decoration:none">https://git.alpinelinux.org/aports/blame/=
main/nodejs/APKBUILD?h=3D3.13-stable</span></a>)
 you'll see that this same vulnerability appears to be fixed only in nodejs=
 v14.15.4-r0.<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal" style=3D"box-sizing: border-box;font-variant-ligatur=
es: normal;font-variant-caps: normal;orphans: 2;text-align:start;widows: 2;=
-webkit-text-stroke-width: 0px;text-decoration-thickness: initial;text-deco=
ration-style: initial;text-decoration-color: initial;word-spacing:0px">
I am running a vulnerability scanner on my Alpine 3.13 image, and it identi=
fies CVE-2020-8265, even though it was supposed to be fixed in as early as =
nodejs v12.20.1, according to the node community.<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal" style=3D"box-sizing: border-box;font-variant-ligatur=
es: normal;font-variant-caps: normal;orphans: 2;text-align:start;widows: 2;=
-webkit-text-stroke-width: 0px;text-decoration-thickness: initial;text-deco=
ration-style: initial;text-decoration-color: initial;word-spacing:0px">
And therefore - the dispute.<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal" style=3D"box-sizing: border-box;font-variant-ligatur=
es: normal;font-variant-caps: normal;orphans: 2;text-align:start;widows: 2;=
-webkit-text-stroke-width: 0px;text-decoration-thickness: initial;text-deco=
ration-style: initial;text-decoration-color: initial;word-spacing:0px">
My question: Should I consider this vulnerability a false positive, and fol=
low the release notes of node? Or should I use Alpine's determination and u=
pgrade my nodejs version to v14.15.4-r0, where Alpine claim it to be fixed?=
 Why does Alpine state the fix for
 said vulnerability exists in v14.15.4-r0 of nodejs, whereas the node maint=
ainers indicate the fix is present in an earlier version?
<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal" style=3D"box-sizing: border-box;font-variant-ligatur=
es: normal;font-variant-caps: normal;orphans: 2;text-align:start;widows: 2;=
-webkit-text-stroke-width: 0px;text-decoration-thickness: initial;text-deco=
ration-style: initial;text-decoration-color: initial;word-spacing:0px">
Thank you very much!<o:p></o:p></p>
<p class=3D"MsoNormal">Nir<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
</div>
</body>
</html>

--_000_AM6PR03MB471180AD19195D25E1BC462AB3409AM6PR03MB4711eurp_--