Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

updating to node 18 + updating alpine to latest stable #80

Merged
merged 1 commit into from
Apr 5, 2024

Conversation

ssmirr
Copy link
Contributor

@ssmirr ssmirr commented Apr 1, 2024

These items motivated sending this PR:

  • nodejs@16 stopped receiving security updates in Sep 2023
  • nodejs@16 vulnerability detected
  • several vulnerabilities in older version of Alpine base images used in this repo

See this vuln scan using Trivy tool for how things looked before updates:

dx-https (alpine 3.15.6)

Total: 8 (UNKNOWN: 0, HIGH: 8, CRITICAL: 0)

┌──────────────┬───────────────┬──────────┬────────┬───────────────────┬───────────────┬────────────────────────────────────────────────────────────┐
│   Library    │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │                           Title                            │
├──────────────┼───────────────┼──────────┼────────┼───────────────────┼───────────────┼────────────────────────────────────────────────────────────┤
│ libcrypto1.1 │ CVE-2022-4450 │ HIGH     │ fixed  │ 1.1.1q-r0         │ 1.1.1t-r0     │ openssl: double free after calling PEM_read_bio_ex         │
│              │               │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2022-4450                  │
│              ├───────────────┤          │        │                   │               ├────────────────────────────────────────────────────────────┤
│              │ CVE-2023-0215 │          │        │                   │               │ openssl: use-after-free following BIO_new_NDEF             │
│              │               │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2023-0215                  │
│              ├───────────────┤          │        │                   │               ├────────────────────────────────────────────────────────────┤
│              │ CVE-2023-0286 │          │        │                   │               │ openssl: X.400 address type confusion in X.509 GeneralName │
│              │               │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2023-0286                  │
│              ├───────────────┤          │        │                   ├───────────────┼────────────────────────────────────────────────────────────┤
│              │ CVE-2023-0464 │          │        │                   │ 1.1.1t-r2     │ openssl: Denial of service by excessive resource usage in  │
│              │               │          │        │                   │               │ verifying X509 policy...                                   │
│              │               │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2023-0464                  │
├──────────────┼───────────────┤          │        │                   ├───────────────┼────────────────────────────────────────────────────────────┤
│ libssl1.1    │ CVE-2022-4450 │          │        │                   │ 1.1.1t-r0     │ openssl: double free after calling PEM_read_bio_ex         │
│              │               │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2022-4450                  │
│              ├───────────────┤          │        │                   │               ├────────────────────────────────────────────────────────────┤
│              │ CVE-2023-0215 │          │        │                   │               │ openssl: use-after-free following BIO_new_NDEF             │
│              │               │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2023-0215                  │
│              ├───────────────┤          │        │                   │               ├────────────────────────────────────────────────────────────┤
│              │ CVE-2023-0286 │          │        │                   │               │ openssl: X.400 address type confusion in X.509 GeneralName │
│              │               │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2023-0286                  │
│              ├───────────────┤          │        │                   ├───────────────┼────────────────────────────────────────────────────────────┤
│              │ CVE-2023-0464 │          │        │                   │ 1.1.1t-r2     │ openssl: Denial of service by excessive resource usage in  │
│              │               │          │        │                   │               │ verifying X509 policy...                                   │
│              │               │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2023-0464                  │
└──────────────┴───────────────┴──────────┴────────┴───────────────────┴───────────────┴────────────────────────────────────────────────────────────┘
2024-04-01T16:44:27.466-0400    INFO    Table result includes only package filenames. Use '--format json' option to get the full path to the package file.

Node.js (node-pkg)

Total: 1 (UNKNOWN: 0, HIGH: 1, CRITICAL: 0)

┌─────────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬────────────────────────────────────────────────────────────┐
│               Library               │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                           Title                            │
├─────────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼────────────────────────────────────────────────────────────┤
│ http-cache-semantics (package.json) │ CVE-2022-25881 │ HIGH     │ fixed  │ 4.1.0             │ 4.1.1         │ http-cache-semantics: Regular Expression Denial of Service │
│                                     │                │          │        │                   │               │ (ReDoS) vulnerability                                      │
│                                     │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2022-25881                 │
└─────────────────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴────────────────────────────────────────────────────────────┘

All items above have been resolved in this PR.

Signed-off-by: Samim Mirhosseini <ssmirr@users.noreply.github.com>
@nguyer nguyer merged commit 8ffa8b8 into hyperledger:main Apr 5, 2024
2 checks passed
@nguyer nguyer deleted the updating-deps branch April 5, 2024 13:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants