Summary: | Remove unused vulnerable jszip library file | ||
---|---|---|---|
Product: | Koha | Reporter: | EW1974 <eric.wutzke> |
Component: | Architecture, internals, and plumbing | Assignee: | Jonathan Druart <jonathan.druart> |
Status: | RESOLVED FIXED | QA Contact: | Martin Renvoize (ashimema) <martin.renvoize> |
Severity: | minor | ||
Priority: | P5 - low | CC: | dcook, didier.gautheron, fridolin.somers, jesse, jonathan.druart, katrin.fischer, laurent.ducos, lisette, lucas, m.de.rooy, martin.renvoize, nick, philippe.blouin, tomascohen, wainuiwitikapark |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | --- | Documentation contact: | |
Documentation submission: | Text to go in the release notes: | ||
Version(s) released in: |
24.11.00,24.05.06,23.11.11
|
Circulation function: | |
Attachments: |
Bug 38234: Remove unused jszip.min.js file
Bug 38234: Remove unused jszip.min.js file Bug 38234: Remove unused jszip.min.js file Bug 38234: Remove unused jszip.min.js file |
Description
EW1974
2024-10-23 09:27:57 UTC
I don't think it's used, we could simply remove it. This specific file is not used since Bug 23013 ("Upgrade DataTables in the staff client") There is a version embedded in our DataTables bundle, which is jszip-3.10.1. Created attachment 173204 [details] [review] Bug 38234: Remove unused jszip.min.js file This specific file is not used since Bug 23013 ("Upgrade DataTables in the staff client") This version is vulnerable and should not be used in the future anyway. There is a version embedded in our DataTables bundle, which is jszip-3.10.1. This can be moved out of the security area. Waiting for somebody else to confirm. (In reply to Jonathan Druart from comment #4) > This can be moved out of the security area. Waiting for somebody else to > confirm. Yep, moving out of security area. It looks like this file is unused. I was looking at the DataTables bundle the other day and noticed that it was included in that bundle itself. Created attachment 173242 [details] [review] Bug 38234: Remove unused jszip.min.js file This specific file is not used since Bug 23013 ("Upgrade DataTables in the staff client") This version is vulnerable and should not be used in the future anyway. There is a version embedded in our DataTables bundle, which is jszip-3.10.1. Signed-off-by: David Cook <dcook@prosentient.com.au> Changing the title from "Vulnerable jszip version used in stable release (CVE-2022-48285)" since the file isn't actually used. Sorry, misread. Back into Koha product. Created attachment 173511 [details] [review] Bug 38234: Remove unused jszip.min.js file This specific file is not used since Bug 23013 ("Upgrade DataTables in the staff client") This version is vulnerable and should not be used in the future anyway. There is a version embedded in our DataTables bundle, which is jszip-3.10.1. Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Created attachment 173512 [details] [review] Bug 38234: Remove unused jszip.min.js file This specific file is not used since Bug 23013 ("Upgrade DataTables in the staff client") This version is vulnerable and should not be used in the future anyway. There is a version embedded in our DataTables bundle, which is jszip-3.10.1. Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Passing QA.. but I have a question. Should we also remove reference to it on the about page? Whilst we no longer reference it directly anywhere, we do use the embedded version inside datatables itself.. should we drop our about reference or keep it in this case? I've decided to keep it as we were actually still using it, indirectly. (In reply to Martin Renvoize (ashimema) from comment #11) > Passing QA.. but I have a question. > > Should we also remove reference to it on the about page? Whilst we no > longer reference it directly anywhere, we do use the embedded version inside > datatables itself.. should we drop our about reference or keep it in this > case? (In reply to Jonathan Druart from comment #12) > I've decided to keep it as we were actually still using it, indirectly. Yeah, I'd say we keep the reference in the about page, as Jonathan says. Pushed for 24.11! Well done everyone, thank you! Applied to 23.05.x-security Backported to 24.05.x for upcoming 24.05.06 Pushed to 23.11.x for 23.11.11 Not pushed to LTS. Marked Resolved. If you feel this should be in LTS please reply with your reason. |