Request dependency <=2.68 opens to potential memory exposure vulnerability #14961

evilaliv3 · 2016-07-28T14:11:52Z

Do you want to request a feature or report a bug?
This ticket is to report a a potential security vulnerability caused by the request dependency.

What is the current behavior?
Various of the dependencies used by angular.js make use of a vulnerable version of the request package (<2.68) that allow potential memory exposure.

Involved dependencies are: insight, fsevents

details:

In order to address a short term fix it is suggested to modify the current npm shrinkwrap to use request==2.74.0

gkalpak · 2016-07-28T15:08:58Z

Hm...I see different packages affecting as:

bower (directly and via bower-registry-client)
dgeni-packages (via winston)
karma-sauce-launcher (via wd)

Although these are devDependencies, so only affecting the people working on the Angular codebase.

evilaliv3 · 2016-07-28T15:34:07Z

yes i agree; but when the relevant developers are impacted all the community is impacted.

mgol · 2016-07-29T10:04:27Z

I'm updating the Karma-related dependencies in #14952, I'll add other related packages in a separate commit as well.

I doubt there's any actual big vulnerability here, though; we don't use request ourselves but via various packages and only to build stuff or connect to Sauce Labs so there may very well not be any way to exploit that.

Those packages depend on a vulnerable request version. Ref gh-14961

evilaliv3 · 2016-07-29T10:57:45Z

for what relates bower i've provided a patch: evilaliv3/bower@5a348e0

the ticket to be monitored is: bower/bower#2336

mgol · 2016-07-29T11:37:54Z

Ah, so it's not fixed in Bower, I just haven't noticed it as it now bundles its all dependencies itself under bower/lib/node_modules; pretty weird. TBH I'd just try to get rid of Bower in favor of npm but, unfortunately, we're relying on package aliases which is not and will not be supported by npm.

The previous version depended on a vulnerable request version. Ref gh-14961

The previous version depended on a vulnerable request version. Ref angulargh-14961

The previous version depended on a vulnerable request version. Ref gh-14961

mgol · 2016-08-06T00:08:33Z

I've updated some packages; karma-sauce-launcher & bower still depend on the vulnerable request in their latest versions.

This is the current state on master:

$ npm ls request
angularjs@ ...
├─┬ [email protected]
│ ├─┬ [email protected]
│ │ └── [email protected] 
│ └── [email protected] 
├─┬ [email protected]
│ └─┬ [email protected]
│   └─┬ [email protected]
│     └── [email protected] 
├─┬ [email protected]
│ └─┬ [email protected]
│   └── [email protected] 
└─┬ [email protected]
  └─┬ [email protected]
    └── [email protected]

evilaliv3 · 2016-08-06T21:49:26Z

great @mgol

for what relates bower they ignored the ticket.
for what relates to karma-sauce-launcher instead i forgot to open it, i'm going to do it now.

evilaliv3 · 2016-08-06T22:02:50Z

Here are the links for keeping track of the fix of karma-sauce-launcher:

Request dependency <=2.68 opens to potential memory exposure vulnerability karma-runner/karma-sauce-launcher#98
Update request dependency to version ≥ 2.74.0 admc/wd#439

Narretz · 2017-10-11T15:42:12Z

karma-sauce-launcher has fixed the dep: https://github.com/karma-runner/karma-sauce-launcher/releases/tag/v1.2.0, now we just need to update

bower will fix itself once we switch to yarn aliases

Related to angular#14961

Related to #14961 Closes #16281

…ages Bower was used to install multiple versions of jQuery which is now handled using Yarn aliases. The remaining two packages, closure-compiler and ng-closure-compiler were installed from zip files which is not supported by Yarn (see yarnpkg/yarn#1483); the first of them was switched to the google-closure-compiler package and the latter was checked in to the repository. Fixes angular#16268 Fixes angular#14961 Ref yarnpkg/yarn#1483

…ages Bower was used to install multiple versions of jQuery which is now handled using Yarn aliases. The remaining two packages, closure-compiler and ng-closure-compiler were installed from zip files which is not supported by Yarn (see yarnpkg/yarn#1483); the first of them exists on npm as the google-closure-compiler but only versions newer than we used are published and they don't work with ng-closure-compiler so - instead - both were checked in to the repository. Fixes angular#16268 Fixes angular#14961 Ref yarnpkg/yarn#1483

…ages Bower was used to install multiple versions of jQuery which is now handled using Yarn aliases. The remaining two packages, closure-compiler and ng-closure-compiler were installed from zip files which is not supported by Yarn (see yarnpkg/yarn#1483); the first of them exists on npm as the google-closure-compiler but only versions newer than we used are published and they don't work with ng-closure-compiler so - instead - both were checked in to the repository. Fixes #16268 Fixes #14961 Ref yarnpkg/yarn#1483

evilaliv3 mentioned this issue Jul 28, 2016

Fix remote memory disclosure with multipart attachments request/request#2018

Closed

mgol added a commit that referenced this issue Jul 29, 2016

chore(*): upgrade Protractor & Bower

ee074e7

Those packages depend on a vulnerable request version. Ref gh-14961

mgol added a commit that referenced this issue Jul 29, 2016

chore(*): upgrade Protractor

3704ede

The previous version depended on a vulnerable request version. Ref gh-14961

mgol added a commit to mgol/angular.js that referenced this issue Jul 29, 2016

chore(*): upgrade Protractor

d36f2c7

The previous version depended on a vulnerable request version. Ref angulargh-14961

mgol added a commit to mgol/angular.js that referenced this issue Jul 29, 2016

chore(*): upgrade Protractor

0b5b4d0

The previous version depended on a vulnerable request version. Ref angulargh-14961

mgol added a commit to mgol/angular.js that referenced this issue Jul 29, 2016

chore(package.json): upgrade Protractor

a422b1e

The previous version depended on a vulnerable request version. Ref angulargh-14961

Narretz added the type: chore label Aug 3, 2016

Narretz added this to the Backlog milestone Aug 3, 2016

mgol added a commit to mgol/angular.js that referenced this issue Aug 5, 2016

chore(package.json): upgrade Protractor

f385ac2

The previous version depended on a vulnerable request version. Ref angulargh-14961

mgol added a commit that referenced this issue Aug 5, 2016

chore(package.json): upgrade Protractor

0606b15

The previous version depended on a vulnerable request version. Ref gh-14961

mgol added a commit that referenced this issue Aug 5, 2016

chore(package.json): upgrade Protractor

42cff06

The previous version depended on a vulnerable request version. Ref gh-14961

petebacondarwin modified the milestones: Backlog, Backlog2 Oct 17, 2016

Narretz mentioned this issue Oct 11, 2017

Move from bower to yarn aliases #16268

Closed

1 task

Narretz added a commit to Narretz/angular.js that referenced this issue Oct 16, 2017

chore(node): update karma-sauce-launcher

cd81825

Related to angular#14961

Narretz mentioned this issue Oct 16, 2017

chore(node): update karma-sauce-launcher #16281

Merged

3 tasks

Narretz added a commit that referenced this issue Oct 16, 2017

chore(node): update karma-sauce-launcher

bf758d0

Related to #14961 Closes #16281

This was referenced Oct 17, 2017

Update upstream javascript-indonesias/angular.js#20

Merged

Update upstream angular-indonesia/angular.js#77

Merged

Narretz added a commit that referenced this issue Oct 17, 2017

chore(node): update karma-sauce-launcher

5d39a11

Related to #14961 Closes #16281

mgol mentioned this issue Dec 27, 2017

chore(*): get rid of Bower in favor of Yarn aliases & checked-in packages #16385

Closed

3 tasks

Narretz closed this as completed in ff2ce9d Jan 8, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Request dependency <=2.68 opens to potential memory exposure vulnerability #14961

Request dependency <=2.68 opens to potential memory exposure vulnerability #14961

evilaliv3 commented Jul 28, 2016

gkalpak commented Jul 28, 2016 •

edited

Loading

evilaliv3 commented Jul 28, 2016 •

edited

Loading

mgol commented Jul 29, 2016

evilaliv3 commented Jul 29, 2016

mgol commented Jul 29, 2016

mgol commented Aug 6, 2016 •

edited

Loading

evilaliv3 commented Aug 6, 2016

evilaliv3 commented Aug 6, 2016

Narretz commented Oct 11, 2017 •

edited

Loading

Request dependency <=2.68 opens to potential memory exposure vulnerability #14961

Request dependency <=2.68 opens to potential memory exposure vulnerability #14961

Comments

evilaliv3 commented Jul 28, 2016

gkalpak commented Jul 28, 2016 • edited Loading

evilaliv3 commented Jul 28, 2016 • edited Loading

mgol commented Jul 29, 2016

evilaliv3 commented Jul 29, 2016

mgol commented Jul 29, 2016

mgol commented Aug 6, 2016 • edited Loading

evilaliv3 commented Aug 6, 2016

evilaliv3 commented Aug 6, 2016

Narretz commented Oct 11, 2017 • edited Loading

gkalpak commented Jul 28, 2016 •

edited

Loading

evilaliv3 commented Jul 28, 2016 •

edited

Loading

mgol commented Aug 6, 2016 •

edited

Loading

Narretz commented Oct 11, 2017 •

edited

Loading