[
https://issues.apache.org/jira/browse/HBASE-29812?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Dávid Paksy updated HBASE-29812:
--------------------------------
Hadoop Flags: Reviewed
Resolution: Fixed
Status: Resolved (was: Patch Available)
> Bump qs and valibot to fix high security vulnerability in hbase-website
> -----------------------------------------------------------------------
>
> Key: HBASE-29812
> URL: https://issues.apache.org/jira/browse/HBASE-29812
> Project: HBase
> Issue Type: Task
> Components: website
> Reporter: Dávid Paksy
> Assignee: Dávid Paksy
> Priority: Major
> Labels: pull-request-available
>
> Dependabot found a high CVE in qs <6.14.1:
> [https://github.com/apache/hbase/security/dependabot/117]
> npm audit also found another high CVE in valibot 0.31.0 - 1.1.0.
> These are dependencies (npm packages) of the hbase-website module.
> h2. Before the fix
> {code:java}
> $ npm audit
> # npm audit report
> qs <6.14.1
> Severity: high
> qs's arrayLimit bypass in its bracket notation allows DoS via memory
> exhaustion - https://github.com/advisories/GHSA-6rw7-vpxm-498p
> fix available via `npm audit fix`
> node_modules/express/node_modules/qs
> node_modules/qs
> body-parser <=1.20.3 || 2.0.0-beta.1 - 2.0.2
> Depends on vulnerable versions of qs
> node_modules/body-parser
> valibot 0.31.0 - 1.1.0
> Severity: high
> Valibot has a ReDoS vulnerability in `EMOJI_REGEX` -
> https://github.com/advisories/GHSA-vqpr-j7v3-hqw9
> fix available via `npm audit fix`
> node_modules/valibot
> 3 high severity vulnerabilities
> To address all issues, run:
> npm audit fix
> {code}
> h2.After fix
> {code:java}
> npm audit fix
> added 798 packages, and audited 799 packages in 5s
> 288 packages are looking for funding
> run `npm fund` for details
> found 0 vulnerabilities
> {code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
