The jszip javascript class version used (3.1.3) is reported to be vulnerable to directory traversal attacks when opening special crafted zip-files. Affected file on Linux Installation (main stable) /usr/share/koha/intranet/htdocs/intranet-tmpl/lib/jquery/plugins/jszip.min.js Refer to CVE-2022-48285 for further information. https://www.cve.org/CVERecord?id=CVE-2022-48285 I suggest upgrading to a fixed version of jszip. Thanks.
I don't think it's used, we could simply remove it.
This specific file is not used since Bug 23013 ("Upgrade DataTables in the staff client") There is a version embedded in our DataTables bundle, which is jszip-3.10.1.
Created attachment 173204 [details] [review] Bug 38234: Remove unused jszip.min.js file This specific file is not used since Bug 23013 ("Upgrade DataTables in the staff client") This version is vulnerable and should not be used in the future anyway. There is a version embedded in our DataTables bundle, which is jszip-3.10.1.
This can be moved out of the security area. Waiting for somebody else to confirm.
(In reply to Jonathan Druart from comment #4) > This can be moved out of the security area. Waiting for somebody else to > confirm. Yep, moving out of security area. It looks like this file is unused. I was looking at the DataTables bundle the other day and noticed that it was included in that bundle itself.
Created attachment 173242 [details] [review] Bug 38234: Remove unused jszip.min.js file This specific file is not used since Bug 23013 ("Upgrade DataTables in the staff client") This version is vulnerable and should not be used in the future anyway. There is a version embedded in our DataTables bundle, which is jszip-3.10.1. Signed-off-by: David Cook <dcook@prosentient.com.au>
Changing the title from "Vulnerable jszip version used in stable release (CVE-2022-48285)" since the file isn't actually used.
Sorry, misread. Back into Koha product.
Created attachment 173511 [details] [review] Bug 38234: Remove unused jszip.min.js file This specific file is not used since Bug 23013 ("Upgrade DataTables in the staff client") This version is vulnerable and should not be used in the future anyway. There is a version embedded in our DataTables bundle, which is jszip-3.10.1. Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Created attachment 173512 [details] [review] Bug 38234: Remove unused jszip.min.js file This specific file is not used since Bug 23013 ("Upgrade DataTables in the staff client") This version is vulnerable and should not be used in the future anyway. There is a version embedded in our DataTables bundle, which is jszip-3.10.1. Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Passing QA.. but I have a question. Should we also remove reference to it on the about page? Whilst we no longer reference it directly anywhere, we do use the embedded version inside datatables itself.. should we drop our about reference or keep it in this case?
I've decided to keep it as we were actually still using it, indirectly.
(In reply to Martin Renvoize (ashimema) from comment #11) > Passing QA.. but I have a question. > > Should we also remove reference to it on the about page? Whilst we no > longer reference it directly anywhere, we do use the embedded version inside > datatables itself.. should we drop our about reference or keep it in this > case? (In reply to Jonathan Druart from comment #12) > I've decided to keep it as we were actually still using it, indirectly. Yeah, I'd say we keep the reference in the about page, as Jonathan says.
Pushed for 24.11! Well done everyone, thank you!
Applied to 23.05.x-security
Backported to 24.05.x for upcoming 24.05.06
Pushed to 23.11.x for 23.11.11