search

googleapis / cloud-profiler-nodejs

Node.js library for Google Cloud Profiler. Continuous CPU and heap profiling to improve performance and reduce costs.
https://cloud.google.com/profiler/
Apache License 2.0
69 stars 35 forks source link

Installing this lib brings in a critical vulnerability from @google-cloud/logging-min -> google-gax -> protobuf.js #937

Closed klon closed 2 months ago

klon commented 3 months ago

It seems this library is relying on @google-cloud/logging-min that in turn relies on an unpatched version of google-gax that has the https://github.com/googleapis/gax-nodejs/issues/1586 not fixed. npm audit fix doesn't work to resolve it.

The root cause is a critical vulnerability https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36665 which I am sure is not really a problem here but it makes every vulnerability scanner scream.

This prevents us from using this library.

Environment details

Steps to reproduce

  1. npm install @google-cloud/profiler
  2. npm audit
  3. npm audit fix
dashpole commented 3 months ago

@aabmass can you take a look?

EvgeniyS-Planhat commented 2 months ago

Hello guys, Should we expect the patch or should stop using Cloud Profiler?

klon commented 2 months ago

Any updates @aabmass ?

aabmass commented 2 months ago

Sorry for the slowness, I'll take a look this week

aabmass commented 2 months ago

It seems like the real issue is https://github.com/googleapis/nodejs-logging/issues/1496 and we just need a new release. I'll follow up internally and see if we can move this forward.

If it will not be a quick fix, I think we could move over from logging-min -> logging or remove that lib altogether. I'll try to dig up why we depend on the minified version.

aabmass commented 2 months ago

@google-cloud/logging-min was released https://github.com/googleapis/cloud-profiler-nodejs/pull/939

I will make a release and mark this fixed when it's out