[CVE-2024-21538]Can we release a new version without HIGH/CRITICAL CVEs?

[CSi-CJ]

Describe the bug:

CVE-2024-21538 : cross-spawn 7.0.3
2024-12-25/2025-01-02
|
INFRASTRUCTURE
|
Prisma
|
image-attu
|
: cross-spawn 7.0.3
Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.
Package path: /usr/local/lib/node_modules/npm/node_modules/cross-spawn

Reference Info:
https://nvd.nist.gov/vuln/detail/CVE-2024-21538

Steps to reproduce:

1. trivy image zilliz/attu:v2.4.12 || zilliz/attu:v2.5.0
   

Attu version:
v2.4.12 / v2.5.0

[shanghaikid]

Why there is a 7.0.3 cross-spawn installed? in the yarn.lock, all the versions will be resolved using 7.0.6。

cross-spawn@^7.0.0, cross-spawn@^7.0.1, cross-spawn@^7.0.3:
  version "7.0.6"
  resolved "https://registry.yarnpkg.com/cross-spawn/-/cross-spawn-7.0.6.tgz#8a58fe78f00dcd70c370451759dfbfaf03e8ee9f"
  integrity sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==
  dependencies:
    path-key "^3.1.0"
    shebang-command "^2.0.0"
    which "^2.0.1"

[CSi-CJ]

I don't know why the current node version will install cross-spawn7.0.3. You can check the current node version and find the corresponding package.json to see if there is a newer version.

[CSi-CJ]

The current node version of attu v2.4.12 / v2.5.0 is 18.20.4

https://github.com/nodejs/node/blob/v18.20.4/deps/npm/node_modules/cross-spawn/package.json

[shanghaikid]

The current node version of attu v2.4.12 / v2.5.0 is 18.20.4

https://github.com/nodejs/node/blob/v18.20.4/deps/npm/node_modules/cross-spawn/package.json

Attu is using node 22, not 18.

# => Copy to Final container
FROM --platform=$TARGETPLATFORM node:22-slim

[CSi-CJ]

This node version is what I got when I entered the container. Anyway, I just saw that cross-spawn has been upgraded to 7.0.6 at https://github.com/nodejs/node/blob/v23.4.0/deps/npm/node_modules/cross-spawn/package.json

[CSi-CJ]

@shanghaikid
Can we downgrade this CVE, https://nvd.nist.gov/vuln/detail/CVE-2024-21538,
https://access.redhat.com/security/cve/cve-2024-21538,
that is, whether this current CVE has a clear impact on Attu

[CrazyBoyM]

I can not install this app on mac

[shanghaikid]

I can not install this app on mac

sudo xattr -rd com.apple.quarantine /Applications/attu.app

[CSi-CJ]

@shanghaikid
Would it be possible to create a plan to address these issues? If so, do we have an approximate timeline for when they might be resolved?

[shanghaikid]

@shanghaikid Would it be possible to create a plan to address these issues? If so, do we have an approximate timeline for when they might be resolved?

This month.

[CSi-CJ]

@shanghaikid Would it be possible to create a plan to address these issues? If so, do we have an approximate timeline for when they might be resolved?

This month.

Thanks！