Problem/Motivation

Note (& Cover My Ass-disclaimer): This issue been discussed with @longwave wearing his Drupal Security Team hat (which I must admit matches the color of his eyes perfectly) and he was OK with this being handled in the public queue.

Steps to reproduce

$ yarn audit
yarn audit v1.22.19
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high          │ Chaijs/get-func-name vulnerable to ReDoS                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ get-func-name                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=2.0.1                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ nightwatch                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ nightwatch > @nightwatch/chai > loupe > get-func-name        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1094183                     │
└───────────────┴──────────────────────────────────────────────────────────────┘
1 vulnerabilities found - Packages audited: 822
Severity: 1 High

Proposed resolution

Nightwatch is a major version bump ahead of us (#3371963: Update Nightwatch to 3.x), so we can't (easily) update it.

Adding magic to /core/package.json "resolutions"-key should work.

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

CommentFileSizeAuthor
#5 3390380-10.1.x-5.patch1.45 KBspokje
#2 CVE-2023-43646.patch1.46 KBspokje

Comments

Spokje created an issue. See original summary.

spokje’s picture

spokje
Primary language Dutch
commented
StatusFileSize
new CVE-2023-43646.patch1.46 KB 
$  yarn-lock-diff -o yarn.old.lock -n yarn.lock
┌───────────────┬────────────────┬─────────────────┐
│ package name  │ old version(s) │ new version(s)  │
├───────────────┼────────────────┼─────────────────┤
│ get-func-name │ 2.0.0          │ 2.0.2           │
└───────────────┴────────────────┴─────────────────┘
spokje’s picture

spokje
Primary language Dutch
commented
Status: Active » Needs review
spokje’s picture

spokje
Primary language Dutch
commented
Status: Needs review » Needs work

Needs backports

spokje’s picture

spokje
Primary language Dutch
commented
Version: 11.x-dev » 10.1.x-dev
StatusFileSize
new 3390380-10.1.x-5.patch1.45 KB 
$  yarn-lock-diff -o yarn.old.lock -n yarn.lock
┌───────────────┬────────────────┬─────────────────┐
│ package name  │ old version(s) │ new version(s)  │
├───────────────┼────────────────┼─────────────────┤
│ get-func-name │ 2.0.0          │ 2.0.2           │
└───────────────┴────────────────┴─────────────────┘
spokje’s picture

spokje
Primary language Dutch
commented

Looking at #3390380: Security update get-func-name (CVE-2023-43646) we don't do 10.0.x anymore

spokje’s picture

spokje
Primary language Dutch
commented
Status: Needs work » Needs review
smustgrave’s picture

smustgrave commented
Status: Needs review » Reviewed & tested by the community

Applies cleanly to 11.x also.

longwave’s picture

longwave
he/him
Primary language English
Location UK
commented
Status: Reviewed & tested by the community » Fixed

Committed and pushed b164d5c575 to 11.x and c23f214501 to 10.1.x. Thanks!

  • longwave committed c23f2145 on 10.1.x 
    Issue #3390380 by Spokje: Security update get-func-name (CVE-2023-43646...

  • longwave committed b164d5c5 on 11.x 
    Issue #3390380 by Spokje: Security update get-func-name (CVE-2023-43646)

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.