CVE-2023-26136 odf-multicluster-console-container: tough-cookie: prototype pollution in cookie memstore

[GowthamShanmugam]

BZ: https://bugzilla.redhat.com/show_bug.cgi?id=2219339
tough-cookie <= 4.1.2 has critical vulnerability
Ref: jsdom/jsdom#3578, jsdom/jsdom#3572

[GowthamShanmugam]

/hold

[SanjalKatiyar]

Can u plz run npm list webpack-dev-middleware and npm list ws once and cross-check the dependency tree ??

It should be using versions mentioned here: #1477.

[GowthamShanmugam]

Can u plz run npm list webpack-dev-middleware and npm list ws once and cross-check the dependency tree ??

It should be using versions mentioned here: #1477.
webpack-dev-middleware and jsdom both are using ws, if I upgrade ws for jsdom, it may affect the webpack-dev-middleware also. The problem here is jest-environment-jsdom is one year old release and still using old jsdom.

I think we need to wait for the new jest-environment-jsdom to be released.

[SanjalKatiyar]

BZ: https://bugzilla.redhat.com/show_bug.cgi?id=2219339 tough-cookie <= 4.1.12 has critical vulnerability Ref: jsdom/jsdom#3578, jsdom/jsdom#3572

Copying from BZ details:
Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.
but in PR's description u have mentioned <= 4.1.12, am I missing anything ?? isn't 4.1.3 < 4.1.12 ??

[SanjalKatiyar]

Can u plz run npm list webpack-dev-middleware and npm list ws once and cross-check the dependency tree ??
It should be using versions mentioned here: #1477.
webpack-dev-middleware and jsdom both are using ws, if I upgrade ws for jsdom, it may affect the webpack-dev-middleware also. The problem here is jest-environment-jsdom is one year old release and still using old jsdom.

I think we need to wait for the new jest-environment-jsdom to be released.

I did not get it how it's related to ws, but can't we just add "jest-environment-jsdom/jsdom/tough-cookie": "^4.1.3" or "^4.1.4" to resolutions ??

[GowthamShanmugam]

Can u plz run npm list webpack-dev-middleware and npm list ws once and cross-check the dependency tree ??
It should be using versions mentioned here: #1477.
webpack-dev-middleware and jsdom both are using ws, if I upgrade ws for jsdom, it may affect the webpack-dev-middleware also. The problem here is jest-environment-jsdom is one year old release and still using old jsdom.

I think we need to wait for the new jest-environment-jsdom to be released.

I did not get it how it's related to ws, but can't we just add "jest-environment-jsdom/jsdom/tough-cookie": "^4.1.3" or "^4.1.4" to resolutions ??

mm. i thinking to add "tough-cookie": "^4.1.3" so it will resolve for all dependencies

[GowthamShanmugam]

/hold cancel

[SanjalKatiyar]

/approve
/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: GowthamShanmugam, SanjalKatiyar

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [SanjalKatiyar]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[SanjalKatiyar]

/cherry-pick release-4.17

[openshift-cherrypick-robot]

@SanjalKatiyar: once the present PR merges, I will cherry-pick it on top of release-4.17 in a new PR and assign it to you.

In response to this:

/cherry-pick release-4.17

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[SanjalKatiyar]

/cherry-pick release-4.17-compatibility

[openshift-cherrypick-robot]

@SanjalKatiyar: once the present PR merges, I will cherry-pick it on top of release-4.17-compatibility in a new PR and assign it to you.

In response to this:

/cherry-pick release-4.17-compatibility

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-cherrypick-robot]

@SanjalKatiyar: new pull request created: #1531

In response to this:

/cherry-pick release-4.17

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-cherrypick-robot]

@SanjalKatiyar: new pull request created: #1532

In response to this:

/cherry-pick release-4.17-compatibility

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.