search

okta / okta-signin-widget

HTML/CSS/JS widget that provides out-of-the-box authentication UX for your organization's apps
Other
375 stars 317 forks source link

Upgrade jQueryCourage to more recent than 1.12.4 #1301

Open shk3bq4d opened 4 years ago

shk3bq4d commented 4 years ago

:information_source: If you have a question, please post it on the Okta Developer Forum instead. Issues in this repository are reserved for bug reports and feature requests.

I'm submitting a

Background info

Okta sign-in widget uses an outdated version of jQuery 1.12.4 named as global variable jQueryCourage which was EOL'ed on 2016.05.20 and suffers from CVE-2015-9251

Reference: Vendor - http://jquery.com/Advisory - https://github.com/jquery/jquery/commit/f60729f3903d17917dc351f3ac87794de379b0cc Advisory - https://github.com/jquery/jquery/issues/2432 Advisory - https://snyk.io/vuln/npm:jquery:20150627 CVE: CVE-2015-9251

Expected behavior

Upgrade to version 3.5.0 or later of jQuery

Steps to reproduce

Either:

Or see in the source code that the legacy version is still present

Your environment

haishengwu-okta commented 4 years ago

We did patch those security vulnerabilities in this jquery-1.12.4. We're also working toward upgrade to latest jQuery. Stay tune.

kevinwuhoo commented 4 years ago

Is there a timeline when this dependency will be upgraded? It looks like CVE-2019-11358/CVE-2019-5428 was patched but there are a number of other vulnerabilities affecting this version: https://snyk.io/test/npm/jquery/1.12.4.

swiftone commented 4 years ago

@kevinwuhoo - Thanks for the question. Our team confirms that all vulnerabilities in that list have already been patched in our internal fork of jquery 1.12.4.

man0a commented 4 years ago

Hello, is there any updates on when jQuery would be updated beyond 1.12.4 for this library?

swiftone commented 4 years ago

@Dewar0019 - No updates. Security patches get high priority (we are not running 1.12.4, but rather a patched version) but otherwise changing that version is not a priority task.

Can you tell us a bit more about what issues the older (base) version is causing you?

man0a commented 4 years ago

We were getting flags for this issue with our security scanners. I think it is only looking at the version number to raise this flag. How do you determine whether not a version of v1.12.4 jQuery being used is patched (or if several patches were applied)? Should we assume that all versions using v1.12.4 of jquery is patched?

Cbryndum commented 3 years ago

@swiftone Since you havent changed the version ASVs still detect this as vulnerable version and will continue flag it and fail anyone doing a PCI-DSS scan. How much effort can it be to change the version in your code?

jjbags commented 3 years ago

Can you say when you guys patched jQuery version 1.12.4?

stefbauer commented 3 years ago

This is showing up in security scanners/pen testing reports as an issue. You list the fix as being on an internal fork last OCTOBER - when will this be released?

shuowu commented 3 years ago

Add internal ticket to get the issue prioritized.

Internal Ref: OKTA-377873

lee-bennie commented 3 years ago

@Dewar0019 - No updates. Security patches get high priority (we are not running 1.12.4, but rather a patched version) but otherwise changing that version is not a priority task.

Can you tell us a bit more about what issues the older (base) version is causing you?

When was 1.12.4 patched?

jcrew99 commented 3 years ago

Hey, what is the timeline on updating the version number/s to indicate that this has been patched?

Waseemrajashaik commented 2 years ago

please provide an update on this issue.

kochste commented 1 year ago

@shuowu - Can we please get an update on this issue? Security scans are picking this up constantly and we have to justify why our IDP is using an outdated javascript library. Since you are running a patched version, it might be helpful to provide a periodical update on what was patched. Thanks!

jaredperreault-okta commented 1 year ago

@kochste The most recent major version of SIW (v7) includes jQuery 3.6 (https://github.com/okta/okta-signin-widget/blob/master/packages/%40okta/courage-dist/package.json#L9)

Choo57 commented 2 months ago

hello, just wanted to check if there is any progress on this. jQuery 1.12.4 has been picked up during a pen test for us as well, we understand it has been patched but will be great to see this updated...