Backport of v1.2.6 fixes to v0.2.x?

gorner commented 2 years ago

Thanks to the new maintainers for taking over this project. I see a new version of the v0.2.x line has been published even though it still seems to be covered by CVE-2021-44906.

Is there any possibility of the fix from v1.2.6 being backported, or is it necessary at all? I ask because the maintainers of one of the other packages we use have thus far not responded to suggestions to update and a patch update to the v0.2.x line would obviate the need for that.

And yes, I'm aware we can also use yarn resolutions, NPM overrides, etc. and the risk is probably fairly minimal in our use case – but I assume there's a reason the v0.2.x line is being maintained.

ljharb commented 2 years ago

Yes, I’ll do a few backports.

shadowspawn commented 1 year ago

The npm audit info seems to be one behind anyway, but checking against Synk.

Running manual tests against the proof of concept attacks in Sync:

A successful mitigation against pollution prints undefined.

% npm i --silent minimist@0.2.0
% node poc1
value0
% node poc2
value1
% node poc3
bar

% npm i --silent minimist@0.2.1
% node poc1                    
undefined
% node poc2                    
undefined
% node poc3                    
bar

% npm i --silent minimist@0.2.4
% node poc1                    
undefined
% node poc2                    
undefined
% node poc3                    
undefined

ljharb commented 1 year ago

Which commits/PRs are still unbackported?

shadowspawn commented 1 year ago

I think we are good to go ahead with requesting update to vulnerability information (not that I have any idea of the process!).

minimist@0.2.4 includes the new backport:

ljharb commented 1 year ago

Awesome. I'm not sure how to go about that. If there's specific things (github and/or snyk) then with the links to those, I can pursue updating them to note that v0.2.4+ isn't vulnerable.

shadowspawn commented 1 year ago

The current audit link references advisories for the first vulnerability:

% npm audit
# npm audit report

minimist  <1.2.6
Severity: critical
Prototype Pollution in minimist - https://github.com/advisories/GHSA-xvch-5gv4-984h

The Synk links for both vulnerabilities are in https://github.com/minimistjs/minimist/issues/11#issuecomment-1445270253

ljharb commented 1 year ago

https://security.snyk.io/vuln/SNYK-JS-MINIMIST-559764 is already fixed in v0.2.1+. I've pinged someone at Snyk for https://security.snyk.io/vuln/SNYK-JS-MINIMIST-2429795.

Filed https://github.com/github/advisory-database/pull/1725 for the npm audit one.

shadowspawn commented 1 year ago

For interest of gentle readers, the unit tests for prototype pollution on the v0.2.x branch are: https://github.com/minimistjs/minimist/blob/v0.2.x/test/proto.js

shadowspawn commented 1 year ago

npm audit now knows that 0.2.4 is ok, thanks to @ljharb for filing advisory database update:

11 % npm ls minimist
11@1.0.0 /Users/john/Documents/Sandpits/minimist/issues/11
└── minimist@0.2.4

11 % npm audit
found 0 vulnerabilities

shadowspawn commented 10 months ago

I have submitted updates to the CVE entries themselves via the CVE numbering authority for the issues: https://cveform.mitre.org/

ljharb commented 7 months ago

I think this is resolved; please file a new issue if there's any remaining vulnerabilities in a minor line.

minimistjs / minimist

Backport of v1.2.6 fixes to v0.2.x? #11