Closed renovate[bot] closed 1 year ago
Latest commit: 3314b9c84aa89a21e9004424c6743ffaecd483af
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
Click here to learn what changesets are, and how to add one.
Click here if you're a maintainer who wants to add a changeset to this PR
This PR contains the following updates:
3.0.1
->3.0.2
GitHub Vulnerability Alerts
CVE-2022-39382
Impact
@keystone-6/core@3.0.0 || 3.0.1
users that useNODE_ENV
in their own code (not dependencies) to trigger security-sensitive functionality in a production build are vulnerable toNODE_ENV
being inlined to"development"
for user code.If your dependencies use
NODE_ENV
to trigger particular behaviours (optimisations, security or otherwise), they should still respect your environment's configuredNODE_ENV
variable and thereby be unaffected.If you do not use
NODE_ENV
in your own code to trigger security-sensitive functionality, you are not impacted by this vulnerability. An example of code that would be affected, might be the following:Technical Description
The problem comes from esbuild defaulting
NODE_ENV
to"development"
when a platform configuration is undefined. You can read about whyesbuild
has that behaviour in their documentation, but the result for Keystone users is that user Typescript was compiled, and had inlinedNODE_ENV
to the constant"development"
.Your application's dependencies, as found in
node_modules
(including@keystone-6/core
), are typically not compiled as part of this process, and thus should be unaffected. Therefore any libraries that usedNODE_ENV
to trigger particular behaviours (optimisations, security or otherwise) should still respect your environment'sNODE_ENV
. We have tested this assumption by verifying thatNODE_ENV=production yarn keystone start
still uses secure cookies when usingstatelessSessions
.Thereby, the severity of this vulnerability is dependent on what functionality users conditionally triggered, in their own code, depending on the expectation that
NODE_ENV
would be correctly configured in their application. In accordance with Common Vulnerability Scoring System2.3.3. Assume Vulnerable Configurations
, this security advisory assumes vulnerable configurations and is thus marked as critical, but you should evaluate the true security impact for your application to determine a relevant score.Patches
This vulnerability has been fixed in
@keystone-6/core@3.0.2
, thanks to @mmachatschhttps://github.com/keystonejs/keystone/pull/8031l/8031/. We have added regression tests for this vulnerabilihttps://github.com/keystonejs/keystone/pull/8063l/8063.Workarounds
If you cannot upgrade your
@keystone-6/core
version for any reason, your best alternative is to remove any code that usesNODE_ENV
in a way that may reasonably impact your application security.References
For more information
Thanks to Austin Burdine for reporting this problem as a potential security vulnerability.
If you have any questions around this security advisory, please don't hesitate to contact us at security@keystonejs.com, or open an issue on GitHub.
If you have a security flaw to report for any software in this repository, please see our SECURITY policy.
Release Notes
keystonejs/keystone
### [`v3.0.2`](https://togithub.com/keystonejs/keystone/compare/1b49306a6c41a504ae0b8e2bf696269634297d88...6fd5ded55fdb24b3afaa8668063e096932ff7597) [Compare Source](https://togithub.com/keystonejs/keystone/compare/1b49306a6c41a504ae0b8e2bf696269634297d88...6fd5ded55fdb24b3afaa8668063e096932ff7597)Configuration
📅 Schedule: Branch creation - "" in timezone Australia/Sydney, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.