security: update tough-cookie dependency to 4.1.3 #32

BreakBB · 2023-07-10T06:54:46Z

PR Checklist:

I have run npm test locally and all tests are passing.
I have added/updated tests for any new behavior.
If this is a significant change, an issue has already been created where the problem / solution was discussed: [N/A, or add link to issue here]

Fixes Vulnerable version of tough-cookie in use (2.5.0) CVE-2023-26136 #31 and therefore CVE-2023-26136

PR Description

As described in #31, the tough-cookie dependency had a prototype pollution issue before v4.1.3. This PR updates the tough-cookie dependency to fix this.

LubosK · 2023-07-11T20:16:51Z

Hi @tgriesser , could you or someone from the team take a look at this PR? Thx in andvance

tim-bezhashvyly · 2023-07-12T19:54:36Z

+1

LubosK · 2023-07-13T08:09:28Z

We've also just got our pipeline audit job stalled by this ):

You can temporary solved it by adding tough-cookie to resolutions in package.json.
e.g.
"resolutions": { "tough-cookie": "^4.1.3" },

tim-bezhashvyly · 2023-07-13T08:24:43Z

For npm

"overrides": {
  "tough-cookie": "^4.1.3"
}

works as a temporary fix.

GoudekettingRM · 2023-07-20T09:16:27Z

Bump

herleraja · 2023-07-24T07:48:40Z

any update on this PR approval ?

The recently upgrade cypress installation (`12.7.1` -> `12.7.2`) has resulted in a vulnerability warning: https://app.circleci.com/pipelines/github/ministryofjustice/hmpps-community-accommodation-tier-2-ui/519/workflows/4ea28190-5859-4266-87de-6c4ff38d402d/jobs/1381 This is [CWE 1321](https://github.com/advisories?query=cwe%3A1321) [tough-cookie Prototype Pollution vulnerability](GHSA-72xf-g2v4-qvf3) and comes from cypress' `@cypress/request package` This has not yet been fixed in cypress though there's a PR: cypress-io/request#32 We declare a temporary 'override' in `package.json` to force this upgrade.

The recently upgraded cypress installation (`12.7.1` -> `12.7.2`) has resulted in a vulnerability warning: https://app.circleci.com/pipelines/github/ministryofjustice/hmpps-community-accommodation-tier-2-ui/519/workflows/4ea28190-5859-4266-87de-6c4ff38d402d/jobs/1381 This is [CWE 1321](https://github.com/advisories?query=cwe%3A1321) [tough-cookie Prototype Pollution vulnerability](GHSA-72xf-g2v4-qvf3) and comes from cypress' `@cypress/request package` This has not yet been fixed in cypress though there's a PR waiting to be merged: cypress-io/request#32 We declare a temporary 'override' in `package.json` to force this upgrade.

jeffsays · 2023-07-28T17:10:02Z

bump - any chance this gets fixed soon @tgriesser?

anthony-b-dev · 2023-07-29T20:03:44Z

needing this approved and merged in as well please

herleraja

LGTM. But it needs approval from the maintainer.

MikeMcC399 · 2023-08-01T11:01:32Z

I have added related issues which affect the repo without this PR

yarn add tough-cookie

to update to ^4.1.3 causes an additional failure under Node.js 20 - installing and testing with Yarn (although it is already failing without the change).

MikeMcC399 · 2023-08-01T12:30:12Z

npm install
npm audit --omit=dev

shows

found 0 vulnerabilities

with this PR. 👍🏻

nagash77 · 2023-08-01T14:17:17Z

Hi everyone, sorry for the late response. This PR was not seen by our team. I am having someone take a look to get this PR ready for merge if possible. I see some failing checks at the moment. Thank you for your patience.

MikeMcC399 · 2023-08-01T15:30:16Z

.github/workflows/yarn.yaml

 jobs:
  build:
    name: Install and test with yarn
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
+        with:
+          node-version: "18"


To get the tests to pass, you need to use Node.js 16.

See Test failures for Node.js 18.17 and 20.x #37

MikeMcC399 · 2023-08-01T15:54:06Z

.github/workflows/yarn.yaml

+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          node-version: "18"


Suggested change

node-version: "18"

node-version: 16.16.0

This matches Cypress' .node-version.

cypress issue will be fixed after: cypress-io/request#32

cypress-app-bot · 2023-08-01T17:21:47Z

🎉 This PR is included in version 2.88.12 🎉

The release is available on:

Your semantic-release bot 📦🚀

G-Rath · 2023-08-01T19:52:32Z

@nagash77 in case you've not seen it, there's also GHSA-p8p7-x288-28g6 which needs addressing - there is #30 and #28 open for that

cypress issue will be fixed after: cypress-io/request#32

security: update tough-cookie dependency to 4.1.3

194b8dc

LubosK approved these changes Jul 10, 2023

View reviewed changes

zheliazkov approved these changes Jul 10, 2023

View reviewed changes

zach-green-proscia approved these changes Jul 19, 2023

View reviewed changes

edavey mentioned this pull request Jul 24, 2023

Patch npm package 'tough-cookie' version ministryofjustice/hmpps-community-accommodation-tier-2-ui#99

Merged

TheLandolorien mentioned this pull request Jul 30, 2023

Vulnerability Issue reported for tough-cookie, latest version of @cypress/request is dependent of tough-cookie@2.5.0 cypress-io/cypress#27261

Closed

vmendez-marklogic approved these changes Jul 31, 2023

View reviewed changes

herleraja approved these changes Jul 31, 2023

View reviewed changes

vicorotto approved these changes Jul 31, 2023

View reviewed changes

nagash77 assigned jordanpowell88 Aug 1, 2023

jordanpowell88 approved these changes Aug 1, 2023

View reviewed changes

Ben M and others added 3 commits August 1, 2023 11:19

Merge branch 'master' into fix-cve-2023-26136

4ceb20b

update workflow to use npm

3bce354

revert back to yarn but v 18

825485a

MikeMcC399 reviewed Aug 1, 2023

View reviewed changes

pin 18.16

a67e132

nagash77 merged commit bfbb95f into cypress-io:master Aug 1, 2023

MikeMcC399 mentioned this pull request Aug 1, 2023

CI GitHub Actions yarn workflow fails #36

Closed

jordanpowell88 mentioned this pull request Aug 1, 2023

fix: update tough-cookie dependency to 4.1.3 #39

Merged

3 tasks

fullsushidev added a commit to RedHatInsights/tower-analytics-frontend that referenced this pull request Aug 1, 2023

Temporary fix to security issue

8d748c4

cypress issue will be fixed after: cypress-io/request#32

jordanpowell88 mentioned this pull request Aug 1, 2023

fix(request): update tough-cookie dependency to 4.1.3 #40

Closed

3 tasks

cypress-app-bot added the released label Aug 1, 2023

BreakBB deleted the fix-cve-2023-26136 branch August 2, 2023 05:09

fullsushidev added a commit to RedHatInsights/tower-analytics-frontend that referenced this pull request Aug 7, 2023

Temporary fix to security issue

eddc321

cypress issue will be fixed after: cypress-io/request#32

fullsushidev added a commit to RedHatInsights/tower-analytics-frontend that referenced this pull request Aug 7, 2023

Temporary fix to security issue

e2c073d

cypress issue will be fixed after: cypress-io/request#32

fullsushidev added a commit to RedHatInsights/tower-analytics-frontend that referenced this pull request Aug 9, 2023

Temporary fix to security issue

b274ee1

cypress issue will be fixed after: cypress-io/request#32

dmzoneill pushed a commit to RedHatInsights/tower-analytics-frontend that referenced this pull request Aug 9, 2023

Temporary fix to security issue

3d9b7a6

cypress issue will be fixed after: cypress-io/request#32

fullsushidev added a commit to RedHatInsights/tower-analytics-frontend that referenced this pull request Aug 9, 2023

Temporary fix to security issue

13e0691

cypress issue will be fixed after: cypress-io/request#32

fullsushidev added a commit to RedHatInsights/tower-analytics-frontend that referenced this pull request Aug 15, 2023

Temporary fix to security issue

8b91d65

cypress issue will be fixed after: cypress-io/request#32

fullsushidev added a commit to RedHatInsights/tower-analytics-frontend that referenced this pull request Aug 17, 2023

Temporary fix to security issue

9ab6ebb

cypress issue will be fixed after: cypress-io/request#32

fullsushidev added a commit to RedHatInsights/tower-analytics-frontend that referenced this pull request Aug 17, 2023

Temporary fix to security issue

25aef3a

cypress issue will be fixed after: cypress-io/request#32

fullsushidev added a commit to RedHatInsights/tower-analytics-frontend that referenced this pull request Sep 1, 2023

Temporary fix to security issue

927119e

cypress issue will be fixed after: cypress-io/request#32

fullsushidev added a commit to RedHatInsights/tower-analytics-frontend that referenced this pull request Sep 6, 2023

Temporary fix to security issue

3e6beb0

cypress issue will be fixed after: cypress-io/request#32

fullsushidev added a commit to RedHatInsights/tower-analytics-frontend that referenced this pull request Sep 11, 2023

Temporary fix to security issue

32eb804

cypress issue will be fixed after: cypress-io/request#32

fullsushidev added a commit to RedHatInsights/tower-analytics-frontend that referenced this pull request Sep 19, 2023

Temporary fix to security issue

64dfc39

cypress issue will be fixed after: cypress-io/request#32

fullsushidev added a commit to RedHatInsights/tower-analytics-frontend that referenced this pull request Sep 21, 2023

Temporary fix to security issue

02fe217

cypress issue will be fixed after: cypress-io/request#32

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

security: update tough-cookie dependency to 4.1.3 #32

security: update tough-cookie dependency to 4.1.3 #32

BreakBB commented Jul 10, 2023 •

edited

Loading

LubosK commented Jul 11, 2023

tim-bezhashvyly commented Jul 12, 2023

LubosK commented Jul 13, 2023

tim-bezhashvyly commented Jul 13, 2023 •

edited

Loading

GoudekettingRM commented Jul 20, 2023

herleraja commented Jul 24, 2023

jeffsays commented Jul 28, 2023

anthony-b-dev commented Jul 29, 2023

herleraja left a comment •

edited

Loading

MikeMcC399 commented Aug 1, 2023 •

edited

Loading

MikeMcC399 commented Aug 1, 2023

nagash77 commented Aug 1, 2023

MikeMcC399 Aug 1, 2023

MikeMcC399 Aug 1, 2023 •

edited

Loading

cypress-app-bot commented Aug 1, 2023

G-Rath commented Aug 1, 2023

security: update tough-cookie dependency to 4.1.3 #32

security: update tough-cookie dependency to 4.1.3 #32

Conversation

BreakBB commented Jul 10, 2023 • edited Loading

PR Checklist:

PR Description

LubosK commented Jul 11, 2023

tim-bezhashvyly commented Jul 12, 2023

LubosK commented Jul 13, 2023

tim-bezhashvyly commented Jul 13, 2023 • edited Loading

GoudekettingRM commented Jul 20, 2023

herleraja commented Jul 24, 2023

jeffsays commented Jul 28, 2023

anthony-b-dev commented Jul 29, 2023

herleraja left a comment • edited Loading

Choose a reason for hiding this comment

MikeMcC399 commented Aug 1, 2023 • edited Loading

MikeMcC399 commented Aug 1, 2023

nagash77 commented Aug 1, 2023

MikeMcC399 Aug 1, 2023

Choose a reason for hiding this comment

MikeMcC399 Aug 1, 2023 • edited Loading

Choose a reason for hiding this comment

cypress-app-bot commented Aug 1, 2023

G-Rath commented Aug 1, 2023

BreakBB commented Jul 10, 2023 •

edited

Loading

tim-bezhashvyly commented Jul 13, 2023 •

edited

Loading

herleraja left a comment •

edited

Loading

MikeMcC399 commented Aug 1, 2023 •

edited

Loading

MikeMcC399 Aug 1, 2023 •

edited

Loading