Multiple vulnerabilities in Node JS modules shipped with ArangoDB 3.11.8 about arangodb HOT 8 CLOSED

Hi,
Please note that the release tarballs don't contain many of these, since they are just used with the test infrastructure.
Hence if you run a make install when compiling from the source tarballs, they will also not be installed as well.

from arangodb.

Hi @dothebart,

The list of modules provided is from the /usr/share/arangodb3/js/node/package-lock.json file of the packaged installation (not compiled from source).
Did I get it right, that this file may contain links to non-existing modules?
Is there any way to determine what modules of mentioned versions from the list above are really installed and used?

The reason I ask is: if a packaged ArangoDB installation really contains these mentioned modules with CRITICAL or HIGH severity at least, then we can't use it in production system due to security requirements.

from arangodb.

Yes, the json file is not the complete picture on the disk. /usr/share/arangodb3/js/node/node_modules/ will only contain a subset of that list. However some of your list are still there.

root@bruecklinux:~# ls /usr/share/arangodb3/js/node/node_modules/
accepts              babel-code-frame     dedent              highlight.js  joi                 mime-types  qs            statuses
ajv                  chai                 error-stack-parser  http-errors   joi-to-json-schema  minimatch   range-parser  timezone
ansi-html-community  content-disposition  extendible          i             js-yaml             ms          semver        type-is
aqb                  content-type         graphql-sync        iconv-lite    lodash              netmask     sinon         vary

from arangodb.

So, we can assume, that ArangoDB uses modules in the /usr/share/arangodb3/js/node/node_modules directory only, and
the correct way to check module version is to visit package.json in its subdirectory something like below.

d=/usr/share/arangodb3/js/node/node_modules 
find ${d?} -name 'package.json' -exec printf "{}\n" \; -exec jq '.name,.version' {} \; | tee modules.txt

Is this correct?

from arangodb.

@dothebart
I've corrected the issue text.
Is my method of checking all js modules and their versions used by ArangoDB above correct?

from arangodb.

yes, seems good - you should as well find sub modules this way.

from arangodb.

Yes, the ansi-regex 2.1.1 module name and version was found in some submodule directory by the way described above.

/usr/share/arangodb3/js/node/node_modules/babel-code-frame/node_modules/ansi-regex/package.json
"ansi-regex"
"2.1.1"

According to your comment this probably means, that ansi-regex 3.0.0 and 4.1.0 are not really installed and used despite the fact, that these versions are mentioned in package-lock.json. But ansi-regex 2.1.1 is really installed and used.

@dothebart, thanks a lot!

from arangodb.

Ok, great we could settle this.

from arangodb.