Bug 38234 - Remove unused vulnerable jszip library file
Summary: Remove unused vulnerable jszip library file
Status: Pushed to oldoldstable
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low minor
Assignee: Jonathan Druart
QA Contact: Martin Renvoize (ashimema)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-10-23 09:27 UTC by EW1974
Modified: 2024-12-18 09:03 UTC (History)
14 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.11.00,24.05.06,23.11.11
Circulation function:


Attachments
Bug 38234: Remove unused jszip.min.js file (100.52 KB, patch)
2024-10-23 10:13 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 38234: Remove unused jszip.min.js file (100.57 KB, patch)
2024-10-23 23:18 UTC, David Cook
Details | Diff | Splinter Review
Bug 38234: Remove unused jszip.min.js file (100.63 KB, patch)
2024-10-28 11:04 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review
Bug 38234: Remove unused jszip.min.js file (100.63 KB, patch)
2024-10-28 11:05 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description EW1974 2024-10-23 09:27:57 UTC
The jszip javascript class version used (3.1.3) is reported to be vulnerable to directory traversal attacks when opening special crafted zip-files.

Affected file on Linux Installation (main stable)

/usr/share/koha/intranet/htdocs/intranet-tmpl/lib/jquery/plugins/jszip.min.js

Refer to CVE-2022-48285 for further information. 
https://www.cve.org/CVERecord?id=CVE-2022-48285

I suggest upgrading to a fixed version of jszip. Thanks.
Comment 1 Jonathan Druart 2024-10-23 10:09:17 UTC
I don't think it's used, we could simply remove it.
Comment 2 Jonathan Druart 2024-10-23 10:11:41 UTC
This specific file is not used since Bug 23013 ("Upgrade DataTables in the staff client")

There is a version embedded in our DataTables bundle, which is jszip-3.10.1.
Comment 3 Jonathan Druart 2024-10-23 10:13:07 UTC
Created attachment 173204 [details] [review]
Bug 38234: Remove unused jszip.min.js file

This specific file is not used since Bug 23013 ("Upgrade DataTables in the staff client")

This version is vulnerable and should not be used in the future anyway.

There is a version embedded in our DataTables bundle, which is jszip-3.10.1.
Comment 4 Jonathan Druart 2024-10-23 10:13:41 UTC
This can be moved out of the security area. Waiting for somebody else to confirm.
Comment 5 David Cook 2024-10-23 23:15:39 UTC
(In reply to Jonathan Druart from comment #4)
> This can be moved out of the security area. Waiting for somebody else to
> confirm.

Yep, moving out of security area. It looks like this file is unused.

I was looking at the DataTables bundle the other day and noticed that it was included in that bundle itself.
Comment 6 David Cook 2024-10-23 23:18:07 UTC
Created attachment 173242 [details] [review]
Bug 38234: Remove unused jszip.min.js file

This specific file is not used since Bug 23013 ("Upgrade DataTables in the staff client")

This version is vulnerable and should not be used in the future anyway.

There is a version embedded in our DataTables bundle, which is jszip-3.10.1.

Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 7 David Cook 2024-10-23 23:19:13 UTC
Changing the title from "Vulnerable jszip version used in stable release (CVE-2022-48285)" since the file isn't actually used.
Comment 8 Katrin Fischer 2024-10-24 09:18:31 UTC
Sorry, misread. Back into Koha product.
Comment 9 Martin Renvoize (ashimema) 2024-10-28 11:04:22 UTC
Created attachment 173511 [details] [review]
Bug 38234: Remove unused jszip.min.js file

This specific file is not used since Bug 23013 ("Upgrade DataTables in the staff client")

This version is vulnerable and should not be used in the future anyway.

There is a version embedded in our DataTables bundle, which is jszip-3.10.1.

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 10 Martin Renvoize (ashimema) 2024-10-28 11:05:57 UTC
Created attachment 173512 [details] [review]
Bug 38234: Remove unused jszip.min.js file

This specific file is not used since Bug 23013 ("Upgrade DataTables in the staff client")

This version is vulnerable and should not be used in the future anyway.

There is a version embedded in our DataTables bundle, which is jszip-3.10.1.

Signed-off-by: David Cook <dcook@prosentient.com.au>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 11 Martin Renvoize (ashimema) 2024-10-28 11:07:00 UTC
Passing QA.. but I have a question.

Should we also remove reference to it on the about page?  Whilst we no longer reference it directly anywhere, we do use the embedded version inside datatables itself.. should we drop our about reference or keep it in this case?
Comment 12 Jonathan Druart 2024-10-28 11:14:02 UTC
I've decided to keep it as we were actually still using it, indirectly.
Comment 13 David Cook 2024-10-28 22:15:21 UTC
(In reply to Martin Renvoize (ashimema) from comment #11)
> Passing QA.. but I have a question.
> 
> Should we also remove reference to it on the about page?  Whilst we no
> longer reference it directly anywhere, we do use the embedded version inside
> datatables itself.. should we drop our about reference or keep it in this
> case?

(In reply to Jonathan Druart from comment #12)
> I've decided to keep it as we were actually still using it, indirectly.

Yeah, I'd say we keep the reference in the about page, as Jonathan says.
Comment 14 Katrin Fischer 2024-10-29 15:18:21 UTC
Pushed for 24.11!

Well done everyone, thank you!
Comment 15 Wainui Witika-Park 2024-11-01 01:34:43 UTC
Applied to 23.05.x-security
Comment 16 Lucas Gass (lukeg) 2024-12-05 18:15:03 UTC
Backported to 24.05.x for upcoming 24.05.06
Comment 17 Fridolin Somers 2024-12-18 09:03:48 UTC
Pushed to 23.11.x for 23.11.11