updated tar package version to 4.4.8 by MaksPob · Pull Request #1713 · nodejs/node-gyp

MaksPob · 2019-04-08T09:00:58Z

Checklist

npm install && npm test passes
commit message follows commit guidelines

Description of change

I updated tar package version in which there were vulnerabilities:
About vulnerability: https://app.snyk.io/vuln/SNYK-JS-TAR-174125

Reviewers

@TooTallNate

stof · 2019-04-11T12:15:21Z

should package-lock.json actually be committed ? It is not until now.

stof · 2019-04-11T12:18:08Z

AFAICT, the only BC break in v4 is isaacs/node-tar@a22932a

Updated node-gyp to 3.8.1 (nodejs/node-gyp#1713) which got updated because of a security Issue in tar (https://www.npmjs.com/advisories/803)

stof · 2019-04-11T13:36:33Z

shouldn't this be patched in the 3.x to be able to have it in a 3.8.1 release ?

jimmybrawn · 2019-04-11T15:57:08Z

pls merge

refack · 2019-04-11T18:14:21Z

CI: https://ci.nodejs.org/job/nodegyp-test-pull-request/118/ ✔️

iansltx · 2019-04-11T18:37:38Z

/me follows thread so he'll know when 3.8.1 is tagged, to unblock builds 'n' stuff

stevendarby · 2019-04-11T19:00:32Z

When might this be released?

PR-URL: #1713 Reviewed-By: Refael Ackermann <refack@gmail.com>

refack · 2019-04-11T19:31:58Z

Running CI for v3.x branch - https://ci.nodejs.org/job/nodegyp-test-pull-request/119/ ❌

refack · 2019-04-11T19:36:24Z

CI for v3.x fails. Could someone backport this? I'll try to publish as soon as we get tests to pass.

/home/iojs/build/workspace/nodegyp-test-commit/nodes/ubuntu1604-64/lib/install.js:152
        , extracter = tar.Extract({ path: devDir, strip: 1, filter: isValid })
                          ^

TypeError: tar.Extract is not a function
    at /home/iojs/build/workspace/nodegyp-test-commit/nodes/ubuntu1604-64/lib/install.js:152:27
    at /home/iojs/build/workspace/nodegyp-test-commit/nodes/ubuntu1604-64/node_modules/mkdirp/index.js:30:20
    at FSReqWrap.oncomplete (fs.js:135:15)

jaredbeck · 2019-04-11T21:47:50Z

Gotta love it when you apply a security patch to your dependency (in this case, tar) and it includes breaking changes (TypeError: tar.Extract is not a function). </sarcasm>

-  "tar": "^3.1.3",
+  "tar": "^4.4.8",

tar isn't going to backport the security patch to the 3-series, huh?

richardlau · 2019-04-12T00:15:39Z

Gotta love it when you apply a security patch to your dependency (in this case, tar) and it includes breaking changes (TypeError: tar.Extract is not a function). </sarcasm>
-  "tar": "^3.1.3",
+  "tar": "^4.4.8",
tar isn't going to backport the security patch to the 3-series, huh?

tar.Extract was removed in tar@3. node-gyp@3.8.0 is still using tar@2

node-gyp/package.json

Line 35 in e6699d1

"tar": "^2.0.0",

When we bumped tar to 3 (#1212) it was deemed a breaking change so it was made on master but not the v3.x branch. It was breaking for Node.js v0.10 and Node.js v0.12 which are long out of support, so maybe we can reconsider that decision? cc @nodejs/node-gyp

mstubna · 2019-04-12T00:25:04Z

@richardlau confirmed that porting the changes from #1212 into the v3.x branch makes all the tests pass

Once `node-gyp` issues a release, we can back this out and update. The version number for that will likely be `3.8.1` More info at: nodejs/node-gyp#1713

PR-URL: nodejs#1713 Reviewed-By: Refael Ackermann <refack@gmail.com>

ebmeierj · 2019-04-15T13:54:58Z

Any idea when this will be released? All of our CI builds are complaining about the vulnerability.

stof · 2019-04-15T14:15:07Z

@ebmeierj see #1718 for the work on bring that in the 3.x codebase (currently, it is merged only in master, which is the WIP of 4.0)

PR-URL: nodejs#1713 Reviewed-By: Refael Ackermann <refack@gmail.com> (cherry picked from commit 1456ef2)

PR-URL: #1713 Reviewed-By: Refael Ackermann <refack@gmail.com>

smity81435 · 2019-04-24T19:44:46Z

Seems that a lot of people are having this issue (myself included)... I suppose you could say they are stuck on the tar?

samabp · 2019-04-24T23:09:27Z

@smity81435 Yes that is where I am stuck.

iwaduarte · 2019-04-26T11:20:58Z

Is there anything that we could in order to (at least) temporarily fix this ?

jimmybrawn · 2019-04-26T11:38:27Z

Change your package-lock and use `npm ci` to install your deps

…

On Fri, 26 Apr 2019, 13:21 iwaduarte, ***@***.***> wrote: Is there anything that we could in order to temporarily fix this ? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#1713 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AA4MKIWDTZLONOIWN6LQGVDPSLQSTANCNFSM4HEGUDDQ> .

jaysunwalter123 · 2019-04-26T13:52:30Z

Change your package-lock and use npm ci to install your deps
…
On Fri, 26 Apr 2019, 13:21 iwaduarte, @.***> wrote: Is there anything that we could in order to temporarily fix this ? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#1713 (comment)>, or mute the thread https://github.com/notifications/unsubscribe-auth/AA4MKIWDTZLONOIWN6LQGVDPSLQSTANCNFSM4HEGUDDQ .

Change it how?

tsvetomir · 2019-05-02T07:29:04Z

@jaysunwalter123 see sass/node-sass#2625 (comment)

KamilPacanek · 2019-05-02T11:21:21Z

Is it safe/recommended to modify npm manged file 'package-lock.json'? I've always thought it's not and such manual edits are discouraged.

Change your package-lock and use npm ci to install your deps

bitcoinvsalts · 2019-09-05T14:19:41Z

I am still getting this issue:

Error: node-gyp rebuild failed with: Error: Command failed: node-gyp rebuild
gyp info it worked if it ends with ok
gyp info using node-gyp@5.0.3
gyp info using node@10.16.0 | darwin | x64
gyp info find Python using Python version 2.7.15 found at "/usr/local/Cellar/python@2/2.7.15_1/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python"
gyp http GET https://nodejs.org/download/release/v10.16.0/node-v10.16.0-headers.tar.gz
gyp http 200 https://nodejs.org/download/release/v10.16.0/node-v10.16.0-headers.tar.gz
gyp ERR! UNCAUGHT EXCEPTION 
gyp ERR! stack TypeError: tar.extract is not a function

any idea how to resolve this?

HF

updated tar package version to 4.4.8

01b119f

stof mentioned this pull request Apr 11, 2019

A vulnerable version of tar is used #1714

Closed

mkaraula added a commit to mkaraula/node-sass that referenced this pull request Apr 11, 2019

Updated node-gyp to 3.8.1

2286291

Updated node-gyp to 3.8.1 (nodejs/node-gyp#1713) which got updated because of a security Issue in tar (https://www.npmjs.com/advisories/803)

mkaraula mentioned this pull request Apr 11, 2019

Updated node-gyp to 3.8.1 mkaraula/node-sass#1

Draft

russell-ingram mentioned this pull request Apr 11, 2019

0.7.4: Fixing the PasteUploader refs issue. Replaced refs with state CDCgov/fdns-ui-react#19

Merged

iansltx mentioned this pull request Apr 11, 2019

Bump tar dep to resolve https://www.npmjs.com/advisories/803 #1716

Closed

No package.lock

7b1cb72

refack approved these changes Apr 11, 2019

View reviewed changes

refack merged commit 1456ef2 into nodejs:master Apr 11, 2019

refack pushed a commit that referenced this pull request Apr 11, 2019

deps: updated tar package version to 4.4.8

c9094a6

PR-URL: #1713 Reviewed-By: Refael Ackermann <refack@gmail.com>

refack self-assigned this Apr 11, 2019

chet-manley mentioned this pull request Apr 11, 2019

NPM Audit Failure = @angular-devkit/build-angular angular/angular-cli#14138

Closed

14 tasks

refack mentioned this pull request Apr 12, 2019

test: fix addon test for Node.js 12 and V8 7.4 #1705

Merged

2 tasks

bsclifton mentioned this pull request Apr 12, 2019

Temporarily fix https://www.npmjs.com/advisories/803 brave-experiments/ad-block#206

Merged

stof mentioned this pull request Apr 12, 2019

Dependency "tar" - high severity vulnerability dlmanning/gulp-sass#730

Closed

antoniopaisfernandes mentioned this pull request Apr 12, 2019

NPM Audit issue - Arbitrary File Overwrite #1717

Closed

This was referenced Apr 12, 2019

Add streaming APIs to Rest client zowe/imperative#199

Merged

Vulnerabilities discovered zowe/imperative#200

Closed

meszaros-lajos-gyorgy mentioned this pull request Apr 12, 2019

[Security] Vulnerability in tar sass/node-sass#2625

Closed

refack pushed a commit to refack/node-gyp that referenced this pull request Apr 12, 2019

deps: updated tar package version to 4.4.8

127cb7c

PR-URL: nodejs#1713 Reviewed-By: Refael Ackermann <refack@gmail.com>

refack mentioned this pull request Apr 12, 2019

v3.8.1 proposal (became v4.0.0) #1718

Closed

3 tasks

refack pushed a commit to refack/node-gyp that referenced this pull request Apr 12, 2019

deps: updated tar package version to 4.4.8

ec8505e

PR-URL: nodejs#1713 Reviewed-By: Refael Ackermann <refack@gmail.com>

mihaiplesa mentioned this pull request Apr 12, 2019

Temporarily fix https://www.npmjs.com/advisories/803 brave/autoplay-whitelist#3

Merged

dominykas mentioned this pull request Apr 12, 2019

Security Vulnerability in "tar" semantic-release/semantic-release#1147

Closed

harkylton pushed a commit to bisondev/node-gyp that referenced this pull request Apr 16, 2019

deps: updated tar package version to 4.4.8

a8dc069

PR-URL: nodejs#1713 Reviewed-By: Refael Ackermann <refack@gmail.com> (cherry picked from commit 1456ef2)

rfultz mentioned this pull request Apr 17, 2019

[HIGH] Arbitrary File Overwrite -- need a fix by May 10, 2019 fecgov/fec-cms#2821

Closed

rvagg pushed a commit that referenced this pull request Apr 24, 2019

deps: updated tar package version to 4.4.8

ceed5cb

PR-URL: #1713 Reviewed-By: Refael Ackermann <refack@gmail.com>

devo253 added a commit to devo253/actionsrepro that referenced this pull request May 4, 2019

Attempt to workaround vulnerability in nodejs/node-gyp#1713

cafa198

Uh oh!

Conversation

MaksPob commented Apr 8, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Description of change

Reviewers

Uh oh!

stof commented Apr 11, 2019

Uh oh!

stof commented Apr 11, 2019

Uh oh!

stof commented Apr 11, 2019

Uh oh!

jimmybrawn commented Apr 11, 2019

Uh oh!

refack commented Apr 11, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

iansltx commented Apr 11, 2019

Uh oh!

stevendarby commented Apr 11, 2019

Uh oh!

refack commented Apr 11, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

refack commented Apr 11, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jaredbeck commented Apr 11, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

richardlau commented Apr 12, 2019

Uh oh!

mstubna commented Apr 12, 2019

Uh oh!

ebmeierj commented Apr 15, 2019

Uh oh!

stof commented Apr 15, 2019

Uh oh!

smity81435 commented Apr 24, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

samabp commented Apr 24, 2019

Uh oh!

iwaduarte commented Apr 26, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jimmybrawn commented Apr 26, 2019 via email

Uh oh!

jaysunwalter123 commented Apr 26, 2019

Uh oh!

tsvetomir commented May 2, 2019

Uh oh!

KamilPacanek commented May 2, 2019

Uh oh!

bitcoinvsalts commented Sep 5, 2019

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

17 participants

MaksPob commented Apr 8, 2019 •

edited

Loading

refack commented Apr 11, 2019 •

edited

Loading

refack commented Apr 11, 2019 •

edited

Loading

refack commented Apr 11, 2019 •

edited

Loading

jaredbeck commented Apr 11, 2019 •

edited

Loading

smity81435 commented Apr 24, 2019 •

edited

Loading

iwaduarte commented Apr 26, 2019 •

edited

Loading