Bug 23025 - security vulnerability detected in fstream < 1.0.12 defined in yarn.lock
Summary: security vulnerability detected in fstream < 1.0.12 defined in yarn.lock
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major (vote)
Assignee: Owen Leonard
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-05-31 16:12 UTC by Jonathan Druart
Modified: 2021-06-14 21:28 UTC (History)
8 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
19.11.00


Attachments
Bug 23025: security vulnerability detected in fstream < 1.0.12 defined in yarn.lock (168.41 KB, patch)
2019-06-03 14:52 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 23025: security vulnerability detected in fstream < 1.0.12 defined in yarn.lock (169.48 KB, patch)
2019-06-14 13:21 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 23025: security vulnerability detected in fstream < 1.0.12 defined in yarn.lock (169.54 KB, patch)
2019-06-24 14:27 UTC, Mark Tompsett
Details | Diff | Splinter Review
Bug 23025: (follow-up) yarn.lock updated itself (4.98 KB, patch)
2019-06-24 14:27 UTC, Mark Tompsett
Details | Diff | Splinter Review
Bug 23025: security vulnerability detected in fstream < 1.0.12 defined in yarn.lock (169.65 KB, patch)
2019-06-25 10:06 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 23025: security vulnerability detected in fstream < 1.0.12 defined in yarn.lock (172.36 KB, patch)
2019-11-20 13:18 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 23025: security vulnerability detected in fstream < 1.0.12 defined in yarn.lock (172.41 KB, patch)
2019-11-22 08:39 UTC, Martin Renvoize
Details | Diff | Splinter Review
Bug 23025: Update yarn.lock (3.01 KB, patch)
2019-11-22 08:46 UTC, Martin Renvoize
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2019-05-31 16:12:09 UTC
Github detected a vulnerability in fstream < 1.0.12:

"""
Known moderate severity security vulnerability detected in fstream < 1.0.12 defined in yarn.lock.
yarn.lock update suggested: fstream ~> 1.0.12.
"""

https://snyk.io/vuln/npm:fstream@1.0.11
Comment 1 Owen Leonard 2019-06-03 14:52:44 UTC Comment hidden (obsolete)
Comment 2 Jonathan Druart 2019-06-03 16:05:08 UTC
Without the patch:

% yarn build # will generate changes, like:

 [-no-repeat;height:125px;padding:0;width:80%}.patronimage-controls{left:50%;opacity:0;position:absolute;text-align:center;top:80%;transform:translate(-50%,-50%);transition:.5s-]{+no-repeat;height:125px;padding:0;width:80%}.patronimage-controls{left:50%;opacity:0;position:absolute;text-align:center;top:80%;-webkit-transform:translate(-50%,-50%);transform:translate(-50%,-50%);transition:.5s+}


transform vs -webkit-transform
Comment 3 Katrin Fischer 2019-06-10 09:15:40 UTC
I receieved another email from github on this:

 This automated pull request fixes a security vulnerability (High severity).

Learn more about automated security fixes.

Bumps tar from 2.2.1 to 2.2.2.
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can view, comment on, or merge this pull request online at:

  https://github.com/Koha-Community/Koha/pull/27
Commit Summary

    Bump tar from 2.2.1 to 2.2.2

File Changes

    M yarn.lock (46)

Patch Links:

    https://github.com/Koha-Community/Koha/pull/27.patch
    https://github.com/Koha-Community/Koha/pull/27.diff
Comment 4 Katrin Fischer 2019-06-10 09:18:48 UTC
Owen, could we get your blessing for this change?
Comment 5 Katrin Fischer 2019-06-14 06:01:59 UTC
There is another related to yarn now:

Known high severity security vulnerability detected in macaddress < 0.2.9 defined in yarn.lock.
yarn.lock update suggested: macaddress ~> 0.2.9.
Comment 6 Owen Leonard 2019-06-14 13:21:08 UTC
Created attachment 90598 [details] [review]
Bug 23025: security vulnerability detected in fstream < 1.0.12 defined in yarn.lock

This patch updates the version requirements for modules used by yarn.
The new version of yarn.lock was created by running the command "yarn
upgrade"

Upgrading yarn.lock should allow for the installation of newer versions
of npm modules in new installations. I believe it is necessary to run
"yarn upgrade" on existing installations in order to bring dependencies
up to versions matching those on existing installations.

To test, run the yarn commands we use to compile SCSS in the staff
client and the opac:

yarn build
yarn build --view opac

They should complete without error.
Comment 7 Mark Tompsett 2019-06-24 14:13:40 UTC
postcss-filter-plugins no longer depends on uniqid which depends on macaddress, so the dependency of macaddress is removed. (comment #5)

The other two are updated to the versions (comment #1, comment #3) mentioned.
Comment 8 Mark Tompsett 2019-06-24 14:24:35 UTC
before the patch
yarn install
yarn build
yarn build --view opac

There are differences, which I believe are like comment #2, but it's too scrolly to tell.

after the patch
git bz apply 23025
yarn upgrade
yarn build
yarn build --view opac

only the lock file is different.
Comment 9 Mark Tompsett 2019-06-24 14:27:17 UTC
Created attachment 90947 [details] [review]
Bug 23025: security vulnerability detected in fstream < 1.0.12 defined in yarn.lock

This patch updates the version requirements for modules used by yarn.
The new version of yarn.lock was created by running the command "yarn
upgrade"

Upgrading yarn.lock should allow for the installation of newer versions
of npm modules in new installations. I believe it is necessary to run
"yarn upgrade" on existing installations in order to bring dependencies
up to versions matching those on existing installations.

To test, run the yarn commands we use to compile SCSS in the staff
client and the opac:

yarn build
yarn build --view opac

They should complete without error.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Comment 10 Mark Tompsett 2019-06-24 14:27:19 UTC
Created attachment 90948 [details] [review]
Bug 23025: (follow-up) yarn.lock updated itself

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Comment 11 Nick Clemens 2019-06-25 10:06:37 UTC
Created attachment 90984 [details] [review]
Bug 23025: security vulnerability detected in fstream < 1.0.12 defined in yarn.lock

This patch updates the version requirements for modules used by yarn.
The new version of yarn.lock was created by running the command "yarn
upgrade"

Upgrading yarn.lock should allow for the installation of newer versions
of npm modules in new installations. I believe it is necessary to run
"yarn upgrade" on existing installations in order to bring dependencies
up to versions matching those on existing installations.

To test, run the yarn commands we use to compile SCSS in the staff
client and the opac:

yarn build
yarn build --view opac

They should complete without error.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

https://bugs.koha-community.org/show_bug.cgi?id=20325
Comment 12 Nick Clemens 2019-06-25 10:08:36 UTC
(In reply to M. Tompsett from comment #10)
> Created attachment 90948 [details] [review] [review]
> Bug 23025: (follow-up) yarn.lock updated itself
> 
> Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

I didn't SO this one, if I run 'yarn upgrade' I get a whole new set of modules than this patch.

I think we only need Owen's initial upgrade - to test I just ran 'yarn install' and it worked as expected

I didn't obsolete, left for the RM
Comment 13 Martin Renvoize 2019-07-11 14:56:51 UTC
I think we should leave the followup for a distinct bug.. yes we should update all our dependencies regularly, but I don't believe doing it inline in this security bug is the best idea.
Comment 14 Owen Leonard 2019-11-20 13:18:19 UTC
Created attachment 95612 [details] [review]
Bug 23025: security vulnerability detected in fstream < 1.0.12 defined in yarn.lock

This patch updates the version requirements for modules used by yarn.
Running "yarn upgrade" will upgrade the project's direct dependencies as
listed in package.json. However, the output of "yarn audit" will
identify more vulnerabilities with libraries further down the dependency
tree.

Adding a "resolutions" list in package.json seems to be the way to
include these upgrades in an installation.

After making these changes I ran "yarn install" and "yarn audit" again.
The audit reported no vulnerabilities.

Upgrading yarn.lock should allow for the installation of newer versions
of npm modules in new installations. I believe it is necessary to run
"yarn upgrade" on existing installations in order to bring dependencies
up to versions matching those on existing installations.

To test, run the yarn commands we use to compile SCSS in the staff
client and the opac:

yarn build
yarn build --view opac

They should complete without error.
Comment 15 Martin Renvoize 2019-11-22 08:39:57 UTC
Created attachment 95713 [details] [review]
Bug 23025: security vulnerability detected in fstream < 1.0.12 defined in yarn.lock

This patch updates the version requirements for modules used by yarn.
Running "yarn upgrade" will upgrade the project's direct dependencies as
listed in package.json. However, the output of "yarn audit" will
identify more vulnerabilities with libraries further down the dependency
tree.

Adding a "resolutions" list in package.json seems to be the way to
include these upgrades in an installation.

After making these changes I ran "yarn install" and "yarn audit" again.
The audit reported no vulnerabilities.

Upgrading yarn.lock should allow for the installation of newer versions
of npm modules in new installations. I believe it is necessary to run
"yarn upgrade" on existing installations in order to bring dependencies
up to versions matching those on existing installations.

To test, run the yarn commands we use to compile SCSS in the staff
client and the opac:

yarn build
yarn build --view opac

They should complete without error.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 16 Martin Renvoize 2019-11-22 08:46:11 UTC
Signing off and Passing QA in one hit.. I've thoroughly tested this and can confirm our existing build tool all continue to work after applying the patch and running the requisite updates to pull the new dependancies.

As these are all just dev side build tools at this point anyway I believe we are safe.
Comment 17 Martin Renvoize 2019-11-22 08:46:58 UTC
Created attachment 95714 [details] [review]
Bug 23025: Update yarn.lock
Comment 18 Martin Renvoize 2019-11-27 10:33:29 UTC
Nice work!

Pushed to master for 19.11.00