Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update dependency express to v4.20.0 [SECURITY] #2084

Merged
merged 1 commit into from
Sep 17, 2024
Merged

Update dependency express to v4.20.0 [SECURITY] #2084

merged 1 commit into from
Sep 17, 2024

Conversation

gardener-ci-robot
Copy link
Contributor

@gardener-ci-robot gardener-ci-robot commented Sep 13, 2024 •
edited
Loading

This PR contains the following updates:

Package Type Update Change
express (source) dependencies minor 4.19.2 -> 4.20.0
express (source) devDependencies minor 4.19.2 -> 4.20.0

GitHub Vulnerability Alerts

CVE-2024-43796

Impact

In express <4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code

Patches

this issue is patched in express 4.20.0

Workarounds

users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist

Details

successful exploitation of this vector requires the following:

  1. The attacker MUST control the input to response.redirect()
  2. express MUST NOT redirect before the template appears
  3. the browser MUST NOT complete redirection before:
  4. the user MUST click on the link in the template

Release Notes

expressjs/express (express)

v4.20.0

Compare Source

==========

  • deps: [email protected]
    • Remove link renderization in html while redirecting
  • deps: [email protected]
    • Remove link renderization in html while redirecting
  • deps: [email protected]
    • add depth option to customize the depth level in the parser
    • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect
  • deps: [email protected]
    • Adds support for named matching groups in the routes using a regex
    • Adds backtracking protection to parameters without regexes defined
  • deps: encodeurl@~2.0.0
    • Removes encoding of \, |, and ^ to align better with URL spec
  • Deprecate passing options.maxAge and options.expires to res.clearCookie
    • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@gardener-ci-robot gardener-ci-robot added kind/enhancement Enhancement, improvement, extension renovate labels Sep 13, 2024
@gardener-robot
Copy link

@gardener-ci-robot Thank you for your contribution.

@gardener-robot gardener-robot added needs/review Needs review size/m Size of pull request is medium (see gardener-robot robot/bots/size.py) labels Sep 13, 2024
@gardener-robot-ci-2 gardener-robot-ci-2 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Sep 13, 2024
@gardener-robot-ci-1 gardener-robot-ci-1 added needs/ok-to-test Needs approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Sep 13, 2024
@gardener-robot-ci-1 gardener-robot-ci-1 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Sep 13, 2024
@gardener-robot-ci-2 gardener-robot-ci-2 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Sep 13, 2024
@gardener-robot-ci-1 gardener-robot-ci-1 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Sep 16, 2024
@gardener-robot-ci-3 gardener-robot-ci-3 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Sep 16, 2024
@gardener-robot-ci-1 gardener-robot-ci-1 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Sep 16, 2024
@gardener-robot-ci-3 gardener-robot-ci-3 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Sep 16, 2024
@holgerkoser holgerkoser merged commit 1dd44e7 into master Sep 17, 2024
8 checks passed
@holgerkoser holgerkoser deleted the renovate/npm-express-vulnerability branch September 17, 2024 12:16
@gardener-robot gardener-robot added the status/closed Issue is closed (either delivered or triaged) label Sep 17, 2024
holgerkoser added a commit that referenced this pull request Sep 20, 2024
@holgerkoser
Merge branch 'master' into enh/eslint-plugin-security
a337100 
# By Gardener Prow Robot (50) and others
# Via GitHub
* master: (62 commits)
  Update dependency codemirror to v5.65.18 (#2101)
  Update dependency vite to v5.4.6 [SECURITY] (#2096)
  Fix issues with hibernation schedule dialog (#2076)
  Hide SSH keypair rotation when SSH access disabled (#2077)
  remove unnecessary model-value binding (#2080)
  Fix vite warning (#2090)
  Update dependency vuetify to v3.7.2 (#2095)
  Update vueuse monorepo to v11.1.0 (#2094)
  Update dependency @vueuse/core to v11.1.0 (#2091)
  Update dependency chokidar to v4 (#2081)
  Update dependency @fontsource/roboto to v5.1.0 (#2078)
  Update dependency jose to v5.9.2 (#2087)
  Update dependency express to v4.20.0 [SECURITY] (#2084)
  Update dependency vue to v3.5.6 (#2089)
  Update Yarn to v4.5.0 (#2088)
  Update dependency vue to v3.5.5 (#2086)
  Update dependency vue-router to v4.4.5 (#2083)
  Update dependency express-static-gzip to v2.1.8 (#2082)
  Update dependency vue-router to v4.4.4 (#2075)
  Update dependency openid-client to v5.7.0 (#2069)
  ...

# Conflicts:
#	.pnp.cjs
#	backend/package.json
#	frontend/package.json
#	frontend/src/components/ShootAddons/GManageAddons.vue
#	packages/kube-client/package.json
#	packages/kube-config/package.json
#	packages/logger/package.json
#	packages/monitor/package.json
#	packages/request/package.json
#	yarn.lock
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@holgerkoser holgerkoser holgerkoser approved these changes

@grolu grolu Awaiting requested review from grolu grolu is a code owner

@petersutter petersutter Awaiting requested review from petersutter petersutter is a code owner

Assignees
No one assigned
Labels
kind/enhancement Enhancement, improvement, extension needs/ok-to-test Needs approval for testing (check PR in detail before setting this label because PR is run on CI/CD) needs/review Needs review renovate size/m Size of pull request is medium (see gardener-robot robot/bots/size.py) status/closed Issue is closed (either delivered or triaged)
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
6 participants
@gardener-ci-robot @gardener-robot @holgerkoser @gardener-robot-ci-1 @gardener-robot-ci-2 @gardener-robot-ci-3