Build(deps): [security] bump undici from 5.22.1 to 5.26.3 #1516

2023-10-17T04:51:21Z

argoyle commented

2023-10-17 04:51:21 +00:00

(Migrated from gitlab.com)

Bumps undici from 5.22.1 to 5.26.3. This update includes a security fix.

Vulnerabilities fixed

Undici's cookie header not cleared on cross-origin redirect in fetch

Impact

Undici clears Authorization headers on cross-origin redirects, but does not clear Cookie headers. By design, cookie headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since Undici handles headers more liberally than the specification, there was a disconnect from the assumptions the spec made, and Undici's implementation of fetch.

As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site.

Patches

This was patched in e041de359221ebeae04c469e8aff4145764e6d76, which is included in version 5.26.2.

Patched versions: 5.26.2 Affected versions: < 5.26.2

Release notes

Sourced from undici's releases.

v5.26.3

No release notes provided.

v5.26.2

Security Release, CVE-2023-45143.

v5.26.1

What's Changed

Fix publish undici-types once and for all! by @Ethan-Arrowood in nodejs/undici#2338

Fix node detection omfg by @KhafraDev in nodejs/undici#2341

Full Changelog: https://github.com/nodejs/undici/compare/v5.26.0...v5.26.1

v5.26.0

What's Changed

use npm install instead of npm ci by @Ethan-Arrowood in nodejs/undici#2309

change default header to node by @Ethan-Arrowood in nodejs/undici#2310

chore: change order of the pseudo-headers by @kyrylodolynskyi in nodejs/undici#2308

fix: Agent.Options.factory should accept URL object or string as parameter by @nicole0707 in nodejs/undici#2295

build(deps-dev): bump sinon from 15.2.0 to 16.1.0 by @dependabot in nodejs/undici#2312

test: handle npm ignore-scripts settings by @panva in nodejs/undici#2313

feat: respect --max-http-header-size Node.js flag by @balazsorban44 in nodejs/undici#2234

fix(#2311): End stream after body sent by @metcoder95 in nodejs/undici#2314

disallow setting host header in fetch by @KhafraDev in nodejs/undici#2322

[StepSecurity] ci: Harden GitHub Actions by @step-security-bot in nodejs/undici#2325

fix fetch with coverage enabled by @KhafraDev in nodejs/undici#2330

Fix stuck when using http2 POST Buffer by @binsee in nodejs/undici#2336

fix: 🏷️ add allowH2 to BuildOptions by @binsee in nodejs/undici#2334

fix: 🐛 fix process http2 header by @binsee in nodejs/undici#2332

New Contributors

@kyrylodolynskyi made their first contribution in nodejs/undici#2308

@nicole0707 made their first contribution in nodejs/undici#2295

@balazsorban44 made their first contribution in nodejs/undici#2234

@binsee made their first contribution in nodejs/undici#2336

Full Changelog: https://github.com/nodejs/undici/compare/v5.23.4...v5.26.0

v5.25.3

What's Changed

perf: improve parse-url implementation by @anonrig in nodejs/undici#2286

test: enable websockets inclusion in WPTReport by @panva in nodejs/undici#2284

remove npm run test from pre-commit hook by @dancastillo in nodejs/undici#2296

perf: use @fastify/busboy by @gurgunday in nodejs/undici#2211

Disable finalizationregistry if node code cov by @mcollina in nodejs/undici#2298

New Contributors

@gurgunday made their first contribution in nodejs/undici#2211

... (truncated)

Commits

227b9be 5.26.3
5351f1f include esbuild script in files
12a6218 Bumped v5.26.2
e041de3 Merge pull request from GHSA-wqq4-5wpv-mx2g
c8c80b1 5.26.1
7bcb80c Fix node detection omfg (#2341)
69ea7b9 hopefully this fixes it for good (#2338)
4006aaf Bumped v5.26.0
df97958 fix: 🐛 fix process http2 header (#2332)
b9d8368 fix: 🏷️ add allowH2 to BuildOptions (#2334)
Additional commits viewable in compare view

Dependabot commands

You can trigger Dependabot actions by commenting on this MR

$dependabot recreate will recreate this MR rewriting all the manual changes and resolving conflicts

Bumps [undici](https://github.com/nodejs/undici) from 5.22.1 to 5.26.3. **This update includes a security fix.** <details> <summary>Vulnerabilities fixed</summary> <blockquote> <p><strong>Undici's cookie header not cleared on cross-origin redirect in fetch</strong></p> <h3>Impact</h3> <p>Undici clears Authorization headers on cross-origin redirects, but does not clear <code>Cookie</code> headers. By design, <code>cookie</code> headers are <a href="https://fetch.spec.whatwg.org/#forbidden-request-header">forbidden request headers</a>, disallowing them to be set in <code>RequestInit.headers</code> in browser environments. Since Undici handles headers more liberally than the specification, there was a disconnect from the assumptions the spec made, and Undici's implementation of fetch.</p> <p>As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site.</p> <h3>Patches</h3> <p>This was patched in <a href="https://github.com/nodejs/undici/commit/e041de359221ebeae04c469e8aff4145764e6d76">e041de359221ebeae04c469e8aff4145764e6d76</a>, which is included in version 5.26.2.</p> <p>Patched versions: 5.26.2 Affected versions: < 5.26.2</p> </blockquote> </details> <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nodejs/undici/releases">undici's releases</a>.</em></p> <blockquote> <h2>v5.26.3</h2> <p>No release notes provided.</p> <h2>v5.26.2</h2> <p>Security Release, CVE-2023-45143.</p> <h2>v5.26.1</h2> <h2>What's Changed</h2> <ul> <li>Fix publish undici-types once and for all! by <a href="https://github.com/Ethan-Arrowood"><code>@Ethan-Arrowood</code></a> in <a href="https://github.com/nodejs/undici/pull/2338">nodejs/undici#2338</a></li> <li>Fix node detection omfg by <a href="https://github.com/KhafraDev"><code>@KhafraDev</code></a> in <a href="https://github.com/nodejs/undici/pull/2341">nodejs/undici#2341</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/nodejs/undici/compare/v5.26.0...v5.26.1">https://github.com/nodejs/undici/compare/v5.26.0...v5.26.1</a></p> <h2>v5.26.0</h2> <h2>What's Changed</h2> <ul> <li>use npm install instead of npm ci by <a href="https://github.com/Ethan-Arrowood"><code>@Ethan-Arrowood</code></a> in <a href="https://github.com/nodejs/undici/pull/2309">nodejs/undici#2309</a></li> <li>change default header to <code>node</code> by <a href="https://github.com/Ethan-Arrowood"><code>@Ethan-Arrowood</code></a> in <a href="https://github.com/nodejs/undici/pull/2310">nodejs/undici#2310</a></li> <li>chore: change order of the pseudo-headers by <a href="https://github.com/kyrylodolynskyi"><code>@kyrylodolynskyi</code></a> in <a href="https://github.com/nodejs/undici/pull/2308">nodejs/undici#2308</a></li> <li>fix: Agent.Options.factory should accept URL object or string as parameter by <a href="https://github.com/nicole0707"><code>@nicole0707</code></a> in <a href="https://github.com/nodejs/undici/pull/2295">nodejs/undici#2295</a></li> <li>build(deps-dev): bump sinon from 15.2.0 to 16.1.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://github.com/nodejs/undici/pull/2312">nodejs/undici#2312</a></li> <li>test: handle npm ignore-scripts settings by <a href="https://github.com/panva"><code>@panva</code></a> in <a href="https://github.com/nodejs/undici/pull/2313">nodejs/undici#2313</a></li> <li>feat: respect <code>--max-http-header-size</code> Node.js flag by <a href="https://github.com/balazsorban44"><code>@balazsorban44</code></a> in <a href="https://github.com/nodejs/undici/pull/2234">nodejs/undici#2234</a></li> <li>fix(<a href="https://github.com/nodejs/undici/issues/2311">#2311</a>): End stream after body sent by <a href="https://github.com/metcoder95"><code>@metcoder95</code></a> in <a href="https://github.com/nodejs/undici/pull/2314">nodejs/undici#2314</a></li> <li>disallow setting host header in fetch by <a href="https://github.com/KhafraDev"><code>@KhafraDev</code></a> in <a href="https://github.com/nodejs/undici/pull/2322">nodejs/undici#2322</a></li> <li>[StepSecurity] ci: Harden GitHub Actions by <a href="https://github.com/step-security-bot"><code>@step-security-bot</code></a> in <a href="https://github.com/nodejs/undici/pull/2325">nodejs/undici#2325</a></li> <li>fix fetch with coverage enabled by <a href="https://github.com/KhafraDev"><code>@KhafraDev</code></a> in <a href="https://github.com/nodejs/undici/pull/2330">nodejs/undici#2330</a></li> <li>Fix stuck when using http2 POST Buffer by <a href="https://github.com/binsee"><code>@binsee</code></a> in <a href="https://github.com/nodejs/undici/pull/2336">nodejs/undici#2336</a></li> <li>fix: 🏷️ add allowH2 to BuildOptions by <a href="https://github.com/binsee"><code>@binsee</code></a> in <a href="https://github.com/nodejs/undici/pull/2334">nodejs/undici#2334</a></li> <li>fix: 🐛 fix process http2 header by <a href="https://github.com/binsee"><code>@binsee</code></a> in <a href="https://github.com/nodejs/undici/pull/2332">nodejs/undici#2332</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/kyrylodolynskyi"><code>@kyrylodolynskyi</code></a> made their first contribution in <a href="https://github.com/nodejs/undici/pull/2308">nodejs/undici#2308</a></li> <li><a href="https://github.com/nicole0707"><code>@nicole0707</code></a> made their first contribution in <a href="https://github.com/nodejs/undici/pull/2295">nodejs/undici#2295</a></li> <li><a href="https://github.com/balazsorban44"><code>@balazsorban44</code></a> made their first contribution in <a href="https://github.com/nodejs/undici/pull/2234">nodejs/undici#2234</a></li> <li><a href="https://github.com/binsee"><code>@binsee</code></a> made their first contribution in <a href="https://github.com/nodejs/undici/pull/2336">nodejs/undici#2336</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/nodejs/undici/compare/v5.23.4...v5.26.0">https://github.com/nodejs/undici/compare/v5.23.4...v5.26.0</a></p> <h2>v5.25.3</h2> <h2>What's Changed</h2> <ul> <li>perf: improve parse-url implementation by <a href="https://github.com/anonrig"><code>@anonrig</code></a> in <a href="https://github.com/nodejs/undici/pull/2286">nodejs/undici#2286</a></li> <li>test: enable websockets inclusion in WPTReport by <a href="https://github.com/panva"><code>@panva</code></a> in <a href="https://github.com/nodejs/undici/pull/2284">nodejs/undici#2284</a></li> <li>remove npm run test from pre-commit hook by <a href="https://github.com/dancastillo"><code>@dancastillo</code></a> in <a href="https://github.com/nodejs/undici/pull/2296">nodejs/undici#2296</a></li> <li>perf: use <code>@fastify/busboy</code> by <a href="https://github.com/gurgunday"><code>@gurgunday</code></a> in <a href="https://github.com/nodejs/undici/pull/2211">nodejs/undici#2211</a></li> <li>Disable finalizationregistry if node code cov by <a href="https://github.com/mcollina"><code>@mcollina</code></a> in <a href="https://github.com/nodejs/undici/pull/2298">nodejs/undici#2298</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/gurgunday"><code>@gurgunday</code></a> made their first contribution in <a href="https://github.com/nodejs/undici/pull/2211">nodejs/undici#2211</a></li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nodejs/undici/commit/227b9bedf233f741b86dda4ae9d1c7ad69f5d75c"><code>227b9be</code></a> 5.26.3</li> <li><a href="https://github.com/nodejs/undici/commit/5351f1fdb1f49f86e356056d7beb291af0144390"><code>5351f1f</code></a> include esbuild script in files</li> <li><a href="https://github.com/nodejs/undici/commit/12a62187d45f332cf39dd405f7c52b759cf40cdd"><code>12a6218</code></a> Bumped v5.26.2</li> <li><a href="https://github.com/nodejs/undici/commit/e041de359221ebeae04c469e8aff4145764e6d76"><code>e041de3</code></a> Merge pull request from GHSA-wqq4-5wpv-mx2g</li> <li><a href="https://github.com/nodejs/undici/commit/c8c80b1115d668664d8cf3acec7535b0258c3079"><code>c8c80b1</code></a> 5.26.1</li> <li><a href="https://github.com/nodejs/undici/commit/7bcb80c0a22509ceba1b786847faba5aded1bea0"><code>7bcb80c</code></a> Fix node detection omfg (<a href="https://github.com/nodejs/undici/issues/2341">#2341</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/69ea7b94434e2a3746e6ad1477d122a8d4075c76"><code>69ea7b9</code></a> hopefully this fixes it for good (<a href="https://github.com/nodejs/undici/issues/2338">#2338</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/4006aaf43ac8b30e16d6d3b89fa2e0df4b7eef33"><code>4006aaf</code></a> Bumped v5.26.0</li> <li><a href="https://github.com/nodejs/undici/commit/df9795883fb75eb97d27f86ce97a491bf023717c"><code>df97958</code></a> fix: 🐛 fix process http2 header (<a href="https://github.com/nodejs/undici/issues/2332">#2332</a>)</li> <li><a href="https://github.com/nodejs/undici/commit/b9d83681443405bcc4e77a4c196e559944f1dfa1"><code>b9d8368</code></a> fix: 🏷️ add allowH2 to BuildOptions (<a href="https://github.com/nodejs/undici/issues/2334">#2334</a>)</li> <li>Additional commits viewable in <a href="https://github.com/nodejs/undici/compare/v5.22.1...v5.26.3">compare view</a></li> </ul> </details> <br /> --- <details> <summary>Dependabot commands</summary> <br /> You can trigger Dependabot actions by commenting on this MR - `$dependabot recreate` will recreate this MR rewriting all the manual changes and resolving conflicts </details>

argoyle commented

2023-10-17 05:05:48 +00:00

(Migrated from gitlab.com)

added 4 commits

69932121...60a58888 - 3 commits from branch master
27ea7ddd - Build(deps): [security] bump undici from 5.22.1 to 5.26.3

Compare with previous version

added 4 commits <ul><li>69932121...60a58888 - 3 commits from branch <code>master</code></li><li>27ea7ddd - Build(deps): [security] bump undici from 5.22.1 to 5.26.3</li></ul> [Compare with previous version](/unboundsoftware/dancefinder/dancefinder-app/-/merge_requests/1467/diffs?diff_id=817401801&start_sha=69932121e179ca7f54758fd72d75db7387aad0e4)

argoyle (Migrated from gitlab.com) merged commit into master

2023-10-17 05:06:07 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dancefinder/dancefinder-app#1516