security vulnerability in tar v6.2.0

[pooja6693]

We have a security vulnerability in tar which is in @mapbox/node-pre-gyp.
[email protected]
└─┬ @mapbox/[email protected]
└── [email protected]

@mapbox/node-pre-gyp has released an intermediate version resolving these issues : https://www.npmjs.com/package/@mapbox/node-pre-gyp/v/1.1.0-dev.1

Can we get an update in muhammara as well for this? We are getting security vulnerability issues due to this.

[julianhille]

need to check the possibility to upgrade without loosing other systems. Essentially this is not an issue as the only thing where node-pre-gyp uses tar is when downloading the pre compiled binary from github.

If you dont trust the tar file you also should not / never trust the binary as this might include arbitrary compiled code.

TL;DR:

• will look into it
• not really a security issue as the download from github must be compromised for that

[julianhille]

still a dev version. is this really that important that we should consider a not final dev version? this feels a bit odd to me. lets wait for a final. feel free to ping if its not a -dev version anymore.

[pooja6693]

@julianhille major issue is because of vulnerability. "@mapbox/node-pre-gyp" is added as bundleDependencies and I cannot override the tar version.

[julianhille]

Afaik, the vulnerability is not exploitable by any other system then node-pre-gyp while installing muhammara (or updating the binary from github).

What i try to say, this is not really an vulnerability which anyone can use to get access to your deployment or where ever / how ever this is running. Anyway there will be a fix shortly

[julianhille]

Fixed with: #366

[pooja6693]

@julianhille I tried npm update its not fixing the issue. When will muhammara release a version for this fix?

[julianhille]

as far is i fixed building issues

[pooja6693]

no its not solved, i did npm install and npm update but its not resolving vulnerability issue

[julianhille]

i'm not sure what you are talking about exactly. Muhammara has not been released to npmjs, hence you can not update through npm with a version number and npmjs as source / repository for the versions.

To check if this is still an issue you would need to install from github repository.

[pooja6693]

@julianhille When will we have new version, any approx idea?

[julianhille]

can say, must investigate why electron is not building since v28 on ubuntu runners anymore.

[pooja6693]

@julianhille Okay thanks but do you have any ETA for new version, we will need to raise 1 exception because of security vulnerability.

[ansariadil]

by installing module from github directly resolving the security vulnerabilities.
"muhammara": "git+https://github.com/julianhille/MuhammaraJS.git"

@mapbox/node-pre-gyp is loading with 1.0.11 version which resolve the CVE-2024-28863.

lets hope this is published as soon as possible.

[julianhille]

Afaik, the vulnerability is not exploitable by any other system then node-pre-gyp while installing muhammara (or updating the binary from github).

What i try to say, this is not really an vulnerability which anyone can use to get access to your deployment or where ever / how ever this is running. Anyway there will be a fix shortly

i just wanted to state that again to make sure. This security vulnerability is just a security node not really exploitable. And to be one:

• someone needs to have a valid certificate for github.com (at least on your host a trusted rootcert)
• must control network traffic along the line (mitm)

if these two issues happen at the same time this is one of the smaller issues you've got. :>

Anyway im currently having issues in getting electron 32 and gcc and the ci to comply with building without failing. if that is solved, im currently put a lot of effort at night into it, i can release.

[imagineer-aman]

Hi @julianhille
Thank you for your reply and your efforts. 👍
Due to the nature of our project, we have to ensure compliance from security standpoint and hence are reaching out to you (and sorry to push you).
For our internal planning purposes to take appropriate next actions, we would appreciate it if you could let us know by which month, tentatively (e.g., Sep 2024 or Oct 2024), the publicly available version of MuhammaraJS that resolves CVE-2024-28863 will be released.

[julianhille]

I hope august bist think it will be September. But can't guarantee anything. I've got 5 kids, a full time job a house to renovate and not much from this project as in compensation, which is totally fine. This should just show that this is not on the very top of priority list and I'm trying to keep up and use my spare time here at the moment.

Hope you can understand.
To speed things up I consider removing electron 32 from the release list. This might help.

[pooja6693]

@julianhille Thank you so much for providing new version. We don't have any vulnerability now but after the upgrade I am getting error :

Error: /usr/lib/x86_64-linux-gnu/libstdc++.so.6: version `GLIBCXX_3.4.31' not found (required by /home/test/node_modules/muhammara/binding/muhammara.node)
at Module._extensions..node (node:internal/modules/cjs/loader:1460:18)
at Module.load (node:internal/modules/cjs/loader:1203:32)
at Module._load (node:internal/modules/cjs/loader:1019:12)
at Module.require (node:internal/modules/cjs/loader:1231:19)
at require (node:internal/modules/helpers:177:18)
at Object. (/home/test/node_modules/muhammara/lib/muhammara.js:6:35)
at Module._compile (node:internal/modules/cjs/loader:1364:14)
at Module._extensions..js (node:internal/modules/cjs/loader:1422:10)
at Module.load (node:internal/modules/cjs/loader:1203:32)
at Module._load (node:internal/modules/cjs/loader:1019:12) {
code: 'ERR_DLOPEN_FAILED'
}

[julianhille]

You need to install another glibc oder upgrade your docker container.

[pooja6693]

@julianhille I am on lower docker image which is using "GLIBCXX_3.4.28". Is it possible to have only patch on previous version with vulnerability update only?

[julianhille]

will take a look

[julianhille]

ahh. no its not as far as i know. Thats why i had to do 5.0.0 because ubuntu 18.04 is not there as a runner anymore.

[pooja6693]

@julianhille I am using docker image : node:18.20.4-bullseye-slim which is using OS (Debian GNU/Linux 11 (bullseye)). Earlier 4.1.0 version was working fine with this docker image. But now its failing with error :
Error: /usr/lib/x86_64-linux-gnu/libstdc++.so.6: version `GLIBCXX_3.4.31' not found (required by /home/test/node_modules/muhammara/binding/muhammara.node)
at Module._extensions..node (node:internal/modules/cjs/loader:1460:18)
at Module.load (node:internal/modules/cjs/loader:1203:32)
at Module._load (node:internal/modules/cjs/loader:1019:12)
at Module.require (node:internal/modules/cjs/loader:1231:19)
at require (node:internal/modules/helpers:177:18)
at Object. (/home/test/node_modules/muhammara/lib/muhammara.js:6:35)
at Module._compile (node:internal/modules/cjs/loader:1364:14)
at Module._extensions..js (node:internal/modules/cjs/loader:1422:10)
at Module.load (node:internal/modules/cjs/loader:1203:32)
at Module._load (node:internal/modules/cjs/loader:1019:12) {
code: 'ERR_DLOPEN_FAILED'
}

To make this version work, please let me know which OS will support this. Also, it will be a big challenge for us if I have to do a major OS upgrade just for this, is there no way a possibility that I can make this new version work in my node:18.20.4-bullseye-slim image?

@imagineer-aman FYI

[julianhille]

you have some possibilities but there are rather limited:

• upgrade debian to at least trixie, bookworm would not suffice (only has libstdc 6.0.30)
• install newer libstdc > libstdc++.so.6.0.30
• compile locally in your docker container as part of the deployment (will raise build time and maybe costs)

I thought about a possible 4.x version but this is rather cumbersome and error prone as i would like to have to copy and move all the files around by hand.

This takes hours and no one really can help there as this is a "this needs much trust" task which can only be done manually.

[pooja6693]

@julianhille Yes, we are also facing challenges finding any solution.
Trixie is not a stable release as it is in testing, so we cannot upgrade to Trixie. We are strict guidelines in our project and we can use only stable versions.
Is there any possibility to have only vulnerability update in 4.x.x without the upgraded 'GLIBCXX_3.4.31' part ?

[julianhille]

Is there any possibility to have only vulnerability update in 4.x.x without the upgraded 'GLIBCXX_3.4.31' part ?

yes there is but that takes, as stated before, a whole bunch of manual effort. :/

[julianhille]

btw you could switch to ubuntu 20.04 or later.

node:18.20-alpine should work too

[pooja6693]

@julianhille What is plan for #423 ?
@imagineer-aman FYI

[julianhille]

trying to get it running but this seems a whole lot of effort.

[norbornen]

@julianhille any updates about #423?

[julianhille]

Not easy as expected. Need to compile gcC 13 myself. Takes loads of time then misses cc command.