From: Nir Ben-Eliezer <nir.ben-eliezer@aquasec.com>
To: "~alpine/devel@lists.alpinelinux.org"
	<~alpine/devel@lists.alpinelinux.org>
CC: Nir Ben-Eliezer <nir.ben-eliezer@aquasec.com>
Subject: Re: Security dispute over nodejs vulnerability in Alpine - Help!
Thread-Topic: Re: Security dispute over nodejs vulnerability in Alpine - Help!
Thread-Index: Adc84Wah4na/ptoZQ7+FKoL+ctu62w==
Date: Thu, 29 Apr 2021 10:34:29 +0000
Message-ID: 
 <AM6PR03MB4711B475D15586303F7AD1B8B35F9@AM6PR03MB4711.eurprd03.prod.outlook.com>
Accept-Language: en-US
Content-Language: en-US
Content-Type: multipart/alternative;
	boundary="_000_AM6PR03MB4711B475D15586303F7AD1B8B35F9AM6PR03MB4711eurp_"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: e3ffdc66-99b0-4cc5-3ffb-08d90afa5ec3
X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Apr 2021 10:34:29.6962
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: bc034cf3-566b-41ca-9f24-5dc49474b05e
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: RZsxWLpiJXzrbADVpMHdbh3LfmTJxxqsfJa2Qg780moyRLO0R96FBcnapj71LSTmEQXbBp+rY2uJWrEk3e+ik4ZUcN89ilJPpe8hU+FNDeg=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR03MB7304

--_000_AM6PR03MB4711B475D15586303F7AD1B8B35F9AM6PR03MB4711eurp_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Thanks Ariadne.

But one thing still bugs me here. Consider the following scenario: I instal=
l Alpine 3.13. I then install nodejs V12.20.1 through APK - this is possibl=
e. Bottom line - Am I vulnerable to CVE-2020-8265?

Per Alpine's security advisory - I am, because Alpine indicates CVE-2020-82=
65 is only fixed on nodejs V14.15.4-r0.

But per the node community, I'm not, because they fixed this vulnerability =
in V12.20.1 (according to their release notes).

What I'm asking ultimately, is this: If the node community indicated a cert=
ain CVE is fixed in version X, why would Alpine indicate a different versio=
n? Is it merely an issue of testing, and the fact that version X was not ce=
rtified to be used with a certain branch of Alpine, or is there a different=
 reason?

Furthermore, if I compared nodejs V12.20.1 source which I downloaded from t=
he node project on github, to nodejs V12.20.1 which I downloaded using APK,=
 will they be the same?

Again I thank you for your time and effort, and your help in sorting this o=
ut for us.
Nir

--_000_AM6PR03MB4711B475D15586303F7AD1B8B35F9AM6PR03MB4711eurp_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
	{font-family:"Cambria Math";
	panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
	{font-family:Calibri;
	panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	font-size:11.0pt;
	font-family:"Calibri",sans-serif;}
span.EmailStyle17
	{mso-style-type:personal-compose;
	font-family:"Calibri",sans-serif;
	color:windowtext;}
.MsoChpDefault
	{mso-style-type:export-only;}
@page WordSection1
	{size:8.5in 11.0in;
	margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
	{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3D"EN-US" link=3D"#0563C1" vlink=3D"#954F72" style=3D"word-wrap:=
break-word">
<div class=3D"WordSection1">
<p class=3D"MsoNormal">Thanks Ariadne.<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">But one thing still bugs me here. Consider the follo=
wing scenario: I install Alpine 3.13. I then install nodejs V12.20.1 throug=
h APK - this is possible. Bottom line - Am I vulnerable to CVE-2020-8265?
<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">Per Alpine&#8217;s security advisory - I am, because=
 Alpine indicates CVE-2020-8265 is only fixed on nodejs V14.15.4-r0.
<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">But per the node community, I&#8217;m not, because t=
hey fixed this vulnerability in V12.20.1 (according to their release notes)=
.<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">What I&#8217;m asking ultimately, is this: If the no=
de community indicated a certain CVE is fixed in version X, why would Alpin=
e indicate a different version? Is it merely an issue of testing, and the f=
act that version X was not certified to
 be used with a certain branch of Alpine, or is there a different reason?<o=
:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">Furthermore, if I compared nodejs V12.20.1 source wh=
ich I downloaded from the node project on github, to nodejs V12.20.1 which =
I downloaded using APK, will they be the same?<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p>&nbsp;</o:p></p>
<p class=3D"MsoNormal">Again I thank you for your time and effort, and your=
 help in sorting this out for us.<o:p></o:p></p>
<p class=3D"MsoNormal">Nir<o:p></o:p></p>
</div>
</body>
</html>

--_000_AM6PR03MB4711B475D15586303F7AD1B8B35F9AM6PR03MB4711eurp_--