Bug 27901

Assigning to Stig for this SRPM.

Assignee: bugsquad => smelror

fixed in cauldron by updating to version 1.3.8

Version: Cauldron => 7
CC: (none) => mageia
Whiteboard: MGA7TOO => (none)

updated in mga7 ( to 1.3 branch , to make sure we do not break other nodejs deps )
src: 
    nodejs-ini-1.3.8-1.mga7

Assignee: smelror => qa-bugs

Advisory:
========================

Updated nodejs-ini package fixes security vulnerability:

It was discovered that there was an issue in nodejs-ini, where an application
could be exploited by a malicious input file. This affects the package ini
before 1.3.6. If an attacker submits a malicious INI file to an application
that parses it with ini.parse, they will pollute the prototype on the
application. This can be exploited further depending on the context
(CVE-2020-7788).


References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788
https://www.debian.org/lts/security/2020/dla-2503
========================

Updated packages in core/updates_testing:
========================
nodejs-ini-1.3.8-1.mga7

from nodejs-ini-1.3.8-1.mga7.src.rpm

mga7, x86_64

Installed nodejs files before updating.

CVE-2020-7788
https://snyk.io/vuln/SNYK-JS-INI-1048974
$ cat payload.ini
[__proto__]
polluted = "polluted"
$ cat poc.js
var fs = require('fs')
var ini = require('ini')

var parsed = ini.parse(fs.readFileSync('./payload.ini', 'utf-8'))
console.log(parsed)
console.log(parsed.__proto__)
console.log(polluted)

The test is to use nodejs interactively - this is what is expected:
$ node
> node poc.js
{}
{ polluted: 'polluted' }
{ polluted: 'polluted' }
polluted

But this is what happens here:
$ node
> node poc.js
Thrown:
node poc.js
     ^^^

SyntaxError: Unexpected identifier
> poc.js
Thrown:
ReferenceError: poc is not defined
> .exit

Cannot figure out what is going on here.  The REPL definitely works so maybe my interpretation of the PoC procedure is wrong.

CC: (none) => tarazed25

Running the PoC code explicitly in the REPL does not work.
$ node
> var fs = require('fs')
undefined
> var ini = require('ini')
Thrown:
{ Error: Cannot find module 'ini'
    at Function.Module._resolveFilename (internal/modules/cjs/loader.js:636:15)
    at Function.Module._load (internal/modules/cjs/loader.js:562:25)
    at Module.require (internal/modules/cjs/loader.js:692:17)
    at require (internal/modules/cjs/helpers.js:25:18) code: 'MODULE_NOT_FOUND' }
> 
> var parsed = ini.parse(fs.readFileSync('./payload.ini', 'utf-8'))
Thrown:
TypeError: Cannot read property 'parse' of undefined
> console.log(parsed)
undefined
undefined
> console.log(parsed.__proto__)
Thrown:
TypeError: Cannot read property '__proto__' of undefined
> console.log(polluted)
Thrown:
ReferenceError: polluted is not defined
> .exit

Ping?

CC: (none) => ouaurelien
Source RPM: nodejs-ini-1.3.5-3.mga8.src.rpm => nodejs-ini-1.3.5-2.mga7.src.rpm
CVE: (none) => CVE-2020-7788

Feb 04 13:41:53 localhost [RPM][5804]: install nodejs-libs-1:10.23.1-10.mga7.x86_64: success
Feb 04 13:41:53 localhost [RPM][5804]: install nodejs-1:10.23.1-10.mga7.x86_64: success
Feb 04 13:42:33 localhost [RPM][5804]: install nodejs-packaging-9-2.mga7.noarch: success
Feb 04 13:42:41 localhost [RPM][5804]: install nodejs-libs-1:10.23.1-10.mga7.x86_64: success
Feb 04 13:42:41 localhost [RPM][5804]: install nodejs-1:10.23.1-10.mga7.x86_64: success
Feb 04 13:42:41 localhost [RPM][5804]: install nodejs-packaging-9-2.mga7.noarch: success
Feb 04 13:42:56 localhost [RPM][5804]: install nodejs-devel-1:10.23.1-10.mga7.x86_64: success
Feb 04 13:42:59 localhost [RPM][5804]: install nodejs-docs-1:10.23.1-10.mga7.noarch: success
Feb 04 13:42:59 localhost [RPM][5804]: install nodejs-devel-1:10.23.1-10.mga7.x86_64: success
Feb 04 13:42:59 localhost [RPM][5804]: install nodejs-docs-1:10.23.1-10.mga7.noarch: success

note other modules include nbm were installed.

set up a multi-user game and tested some basic server functionality.

Working as designed for me.

CC: (none) => brtians1

So, MGA7-64-OK on behalf comment 8.

Validating.
Advisory flushed to SVN.

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0068.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED