Date: Thu, 29 Apr 2021 06:24:45 -0600 (MDT)
From: Ariadne Conill <ariadne@dereferenced.org>
To: Nir Ben-Eliezer <nir.ben-eliezer@aquasec.com>
cc: "~alpine/devel@lists.alpinelinux.org" <~alpine/devel@lists.alpinelinux.org>
Subject: RE: Re: Security dispute over nodejs vulnerability in Alpine -
 Help!
In-Reply-To: <AM6PR03MB471174AA1EC7B02D9F56C687B35F9@AM6PR03MB4711.eurprd03.prod.outlook.com>
Message-ID: <a5278b98-db1f-eba2-50ba-1cfae99a8542@dereferenced.org>
References: <AM6PR03MB4711B475D15586303F7AD1B8B35F9@AM6PR03MB4711.eurprd03.prod.outlook.com>  <AM6PR03MB471174AA1EC7B02D9F56C687B35F9@AM6PR03MB4711.eurprd03.prod.outlook.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII; format=flowed

Hello,

On Thu, 29 Apr 2021, Nir Ben-Eliezer wrote:

> Thanks Ariadne.
>
> But one thing still bugs me here. Consider the following scenario: I install Alpine 3.13. I then install nodejs V12.20.1 through APK - this is possible. Bottom line - Am I vulnerable to CVE-2020-8265?

If you install Alpine 3.13, it is not possible for this scenario to 
happen.  Alpine 3.13 shipped from day 1 with Node 14, as Node 14 was 
pushed to Alpine edge in October 2020, which predated the Alpine 3.13 
release.

> Per Alpine's security advisory - I am, because Alpine indicates CVE-2020-8265 is only fixed on nodejs V14.15.4-r0.

Our security advisory indicates that CVE-2020-8265 was fixed in Alpine 
edge (and therefore later in 3.13 release) by nodejs 14.15.4-r0.

It also indicates that CVE-2020-8265 was fixed in Alpine 3.12 by 
12.20.1-r0, because Alpine 3.12 follows the Node 12.x branch.

> But per the node community, I'm not, because they fixed this vulnerability in V12.20.1 (according to their release notes).

As previously stated, it depends on what version of the distribution you 
are using.  Alpine 3.13 never shipped a node package that was vulnerable 
to CVE-2020-8265, because we fixed it in edge before Alpine 3.13 shipped.

But we still record security fix data for edge, as users do use Alpine 
edge (which is like Debian sid, or Fedora rawhide).

> What I'm asking ultimately, is this: If the node community indicated a certain CVE is fixed in version X, why would Alpine indicate a different version? Is it merely an issue of testing, and the fact that version X was not certified to be used with a certain branch of Alpine, or is there a different reason?

We record the version that we published which resolved the CVE.  That is 
not necessarily the same version upstream.  And as I have said before, 
different Node branches will have CVE fixes in different versions.

> Furthermore, if I compared nodejs V12.20.1 source which I downloaded from the node project on github, to nodejs V12.20.1 which I downloaded using APK, will they be the same?

Generally speaking, yes.  However, Alpine, like other distributions, does 
occasionally make modifications to what upstream has shipped.  The source 
of truth, therefore, is the Alpine aports repository, which contains all 
of the build recipe (APKBUILD) files for every package in the 
distribution.

Ariadne