Problem/Motivation

Further to https://www.drupal.org/project/drupal/issues/3181057, which addresses an update to the third-party library Underscore.js, another update is needed to address a security issue as raised here: https://nvd.nist.gov/vuln/detail/CVE-2021-23358

Proposed resolution

Update underscore to 1.13.1, which is the latest tagged release on the official github repository (https://github.com/jashkenas/underscore/releases)

CommentFileSizeAuthor
#3 3209456-8.9.x-3.patch101.3 KBpiggito
#2 3209456-2.patch104.03 KBkpa

Comments

kpa created an issue. See original summary.

kpa’s picture

kpa commented
Status: Active » Needs review
StatusFileSize
new 3209456-2.patch104.03 KB

Patch as attached to pull forward from 1.11.0 to 1.13.1

piggito’s picture

piggito commented
StatusFileSize
new 3209456-8.9.x-3.patch101.3 KB

Attached a ported version of patch for 8.9.x

mherchel’s picture

mherchel
he/him
Primary language English
Location Gainesville, FL, US
commented
Status: Needs review » Reviewed & tested by the community

RTBC

Verified the patch in #2 by doing the following:

  1. I applied the patch and staged the files
  2. Downloaded the underscore-min.js and underscore-min.js.map directly from Github and verified that there are no differences
  3. Verified that the version has been updated properly in the YAML file.

Note that I did not test out functionality (I assume automated tests will catch any regressions).

mherchel’s picture

mherchel
he/him
Primary language English
Location Gainesville, FL, US
commented

Also verified #3 against 8.9.x using the same method in my previous comment.

Status: Reviewed & tested by the community » Needs work

The last submitted patch, 3: 3209456-8.9.x-3.patch, failed testing. View results

andypost’s picture

andypost
he/him
Primary language Russian
commented
Assigned: kpa » Unassigned
Status: Needs work » Reviewed & tested by the community

Version: 9.2.x-dev » 9.3.x-dev

Drupal 9.2.0-alpha1 will be released the week of May 3, 2021, which means new developments and disruptive changes should now be targeted for the 9.3.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

  • lauriii committed e939dbe on 9.3.x 
    Issue #3209456 by kpa, piggito, mherchel: Update Underscore.js to the...

  • lauriii committed 431356e on 9.2.x 
    Issue #3209456 by kpa, piggito, mherchel: Update Underscore.js to the...
lauriii’s picture

lauriii
he/him
Primary language Finnish
Location Finland
commented
Version: 9.3.x-dev » 9.1.x-dev

Tested manually contextual links, tour and CKE UI that are using Backbone and Underscore.

Committed e939dbe and pushed to 9.3.x and 9.2.x. Thanks!

Leaving open for backport.

effulgentsia’s picture

effulgentsia commented
Issue tags: +9.2.0 release notes

Hasn't been backported to 9.1 yet, so tagging for a 9.2 release note.

  • lauriii committed f1170ca on 9.1.x 
    Issue #3209456 by kpa, piggito, mherchel: Update Underscore.js to the...

  • lauriii committed fd0271e on 8.9.x 
    Issue #3209456 by kpa, piggito, mherchel: Update Underscore.js to the...
catch’s picture

catch
he/him
Primary language English
commented
Issue tags: +9.1.8 release notes, +8.9.15 release notes
catch’s picture

catch
he/him
Primary language English
commented
Version: 9.1.x-dev » 8.9.x-dev
Status: Reviewed & tested by the community » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.