Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update dependency gatsby to v5.9.1 [SECURITY] #71

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

renovate[bot]
Copy link

@renovate renovate bot commented Jun 9, 2023

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
gatsby (source, changelog) 5.3.3 -> 5.9.1 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2023-34238

Impact

The Gatsby framework prior to versions 4.25.7 and 5.9.1 contain a Local File Inclusion vulnerability in the __file-code-frame and __original-stack-frame paths, exposed when running the Gatsby develop server (gatsby develop).

The following steps can be used to reproduce the vulnerability:


# Create a new Gatsby project
$ npm init gatsby
$ cd my-gatsby-site

# Start the Gatsby develop server
$ gatsby develop

# Execute the Local File Inclusion vulnerability in __file-code-frame
$ curl "http://127.0.0.1:8000/__file-code-frame?filePath=/etc/passwd&lineNumber=1"

# Execute the Local File Inclusion vulnerability in __original-stack-frame
$ curl "http://127.0.0.1:8000/__original-stack-frame?moduleId=/etc/hosts&lineNumber=1&skipSourceMap=1"

It should be noted that by default gatsby develop is only accessible via the localhost 127.0.0.1, and one would need to intentionally expose the server to other interfaces to exploit this vulnerability by using server options such as --host 0.0.0.0, -H 0.0.0.0, or the GATSBY_HOST=0.0.0.0 environment variable.

Patches

A patch has been introduced in gatsby@5.9.1 and gatsby@4.25.7 which mitigates the issue.

Workarounds

As stated above, by default gatsby develop is only exposed to the localhost 127.0.0.1. For those using the develop server in the default configuration no risk is posed. If other ranges are required, preventing the develop server from being exposed to untrusted interfaces or IP address ranges would mitigate the risk from this vulnerability.

We encourage projects to upgrade to the latest major release branch for all Gatsby plugins to ensure the latest security updates and bug fixes are received in a timely manner.

Credits

We would like to thank Maxwell Garrett of Assetnote for bringing the __file-code-frame issue to our attention.

For more information

Email us at security@gatsbyjs.com.


Release Notes

gatsbyjs/gatsby (gatsby)

v5.9.1

Compare Source

v5.9.0

Compare Source

v5.8.1

Compare Source

v5.8.0

Compare Source

v5.7.0: v5.7.0

Compare Source

Welcome to gatsby@5.7.0 release (February 2023 #2)

This release focused on bug fixes and perf improvements. Check out notable bugfixes and improvements.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

v5.6.1

Compare Source

v5.6.0: v5.6.0

Compare Source

Welcome to gatsby@5.6.0 release (February 2023 #1)

Key highlights of this release:

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog

v5.5.0

Compare Source

v5.4.2

Compare Source

v5.4.1

Compare Source

v5.4.0: v5.4.0

Compare Source

Welcome to gatsby@5.4.0 release (January 2023 #1)

The whole team took time off for a much deserved winter break and we hope you had relaxing holidays, too! Before the break we spent time doing maintenance work such as updating internal dependencies or fixing some smaller bugs here and there. In case you missed it, we shipped ES Modules (ESM) in Gatsby files in the last release.

So check out the notable bugfixes section to learn more.

Bleeding Edge: Want to try new features as soon as possible? Install gatsby@next and let us know if you have any issues.

Previous release notes

Full changelog


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from bdff95d to 0d4396a Compare June 18, 2023 05:45
@renovate renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from 0d4396a to 256947e Compare June 22, 2023 14:46
@renovate renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from 256947e to 90794f3 Compare June 30, 2023 03:01
@renovate renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from 471a45f to ae6574e Compare July 10, 2023 11:58
@renovate renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from 51e413e to 9989f9c Compare July 20, 2023 02:48
@renovate renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from 710b0e9 to b497dfd Compare August 3, 2023 02:27
@renovate renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from b497dfd to fb66995 Compare August 11, 2023 02:19
@renovate renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from df46dfb to 920c354 Compare August 27, 2023 20:55
@renovate renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from 920c354 to 8686a59 Compare September 20, 2023 02:34
@renovate renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from b0d48c9 to 27d5a56 Compare September 29, 2023 22:55
@renovate renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from 8b0ed79 to 5d50e83 Compare October 16, 2023 08:54
@renovate renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from 5d50e83 to 6227116 Compare October 24, 2023 23:23
@renovate renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from 6227116 to 90422ae Compare November 7, 2023 17:51
@renovate renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from 90422ae to 03244f1 Compare November 17, 2023 05:46
@renovate renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from 03244f1 to 7feafc3 Compare December 5, 2023 08:25
@renovate renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from 63b0f8c to b202070 Compare February 5, 2024 05:33
@renovate renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from b202070 to 5f9542d Compare February 27, 2024 08:38
@renovate renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from 5f9542d to 89f7d30 Compare March 13, 2024 08:48
@renovate renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from 892b0b5 to 2c5ec35 Compare March 25, 2024 02:48
@renovate renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch 2 times, most recently from 6e792c4 to 8a8eb0c Compare April 22, 2024 23:42
@renovate renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from 8a8eb0c to 63f3541 Compare April 26, 2024 02:42
@renovate renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from 63f3541 to c633270 Compare June 5, 2024 05:39
@renovate renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from c633270 to 8e58f58 Compare July 24, 2024 02:50
@renovate renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from 8e58f58 to 801ecb4 Compare August 9, 2024 23:54
@renovate renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from 801ecb4 to a2d7a45 Compare August 28, 2024 20:57
@renovate renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from a2d7a45 to 28ca8c6 Compare October 10, 2024 02:55
@renovate renovate bot force-pushed the renovate/npm-gatsby-vulnerability branch from 28ca8c6 to 8e1a9ea Compare December 3, 2024 02:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants