Your message dated Thu, 11 May 2023 09:38:42 +0200 with message-id <182fb2e1-0b82-bf26-8bc6-53d59b70c82a@debian.org> and subject line Re: Bug#1035625: unblock: node-yaml/2.1.3-2 has caused the Debian Bug report #1035625, regarding unblock: node-yaml/2.1.3-2 to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner@bugs.debian.org immediately.) -- 1035625: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1035625 Debian Bug Tracking System Contact owner@bugs.debian.org with problems
--- Begin Message ---
- To: Debian Bug Tracking System <submit@bugs.debian.org>
- Subject: unblock: node-yaml/2.1.3-2
- From: Yadd <yadd@debian.org>
- Date: Sun, 07 May 2023 00:22:52 +0400
- Message-id: <[🔎] 168340457255.305260.7342825301512476293.reportbug@debian007.xnr.fr>
Package: release.debian.org Severity: normal User: release.debian.org@packages.debian.org Usertags: unblock X-Debbugs-Cc: node-yaml@packages.debian.org Control: affects -1 + src:node-yaml Please unblock package node-yaml [ Reason ] node-yaml is vulnerable to Denial-of-Service (#1035580, CVE-2023-2251) [ Impact ] Medium security issue [ Tests ] New tests added: - by upstream in the CVE-2023-2251.patch file - by myself in autopkgtest using code provided to prove the issue You can verify using https://salsa.debian.org/js-team/node-yaml/-/pipelines that the CVE is fixed by this patch. [ Risks ] Low risk, patch is trivial (just fix line characters count) [ Checklist ] [X] all changes are documented in the d/changelog [X] I reviewed all changes and I approve them [X] attach debdiff against the package in testing [ Others ] This debdiff includes also: * little things from lintian-brush * a little test paths fix because test failed on platforms where the "debian" word was in the build root path (especially salsa) Cheers, Yadd unblock node-yaml/2.1.3-2diff --git a/debian/changelog b/debian/changelog index 3265e73..5d44f16 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,14 @@ +node-yaml (2.1.3-2) unstable; urgency=medium + + * Team upload + * Update lintian override info format in + d/source/lintian-overrides on line 2-7 + * Update standards version to 4.6.2, no changes needed + * Fix corner case failure in error pretty-printer + (Closes: #1035580, CVE-2023-2251) + + -- Yadd <yadd@debian.org> Sun, 07 May 2023 00:10:19 +0400 + node-yaml (2.1.3-1) unstable; urgency=medium * Team upload diff --git a/debian/control b/debian/control index 0a7fe7e..e221de8 100644 --- a/debian/control +++ b/debian/control @@ -15,7 +15,7 @@ Build-Depends: , node-tslib <!nocheck> , node-typescript <!nocheck> , rollup -Standards-Version: 4.6.1 +Standards-Version: 4.6.2 Homepage: https://eemeli.org/yaml/ Vcs-Git: https://salsa.debian.org/js-team/node-yaml.git Vcs-Browser: https://salsa.debian.org/js-team/node-yaml diff --git a/debian/patches/CVE-2023-2251.patch b/debian/patches/CVE-2023-2251.patch new file mode 100644 index 0000000..0d8b1d4 --- /dev/null +++ b/debian/patches/CVE-2023-2251.patch @@ -0,0 +1,36 @@ +Description: fix: Corner case failure in error pretty-printer +Author: Eemeli Aro <eemeli@gmail.com> +Origin: upstream, https://github.com/eemeli/yaml/commit/984f5781 +Bug: https://github.com/advisories/GHSA-f9xv-q969-pqx4 +Bug-Debian: https://bugs.debian.org/1035580 +Forwarded: not-needed +Applied-Upstream: 2.2.2, commit:984f5781 +Reviewed-By: Yadd <yadd@debian.org> +Last-Update: 2023-05-06 + +--- a/src/errors.ts ++++ b/src/errors.ts +@@ -91,7 +91,7 @@ + let count = 1 + const end = error.linePos[1] + if (end && end.line === line && end.col > col) { +- count = Math.min(end.col - col, 80 - ci) ++ count = Math.max(1, Math.min(end.col - col, 80 - ci)) + } + const pointer = ' '.repeat(ci) + '^'.repeat(count) + error.message += `:\n\n${lineStr}\n${pointer}\n` +--- a/tests/doc/errors.js ++++ b/tests/doc/errors.js +@@ -341,6 +341,12 @@ + const doc = YAML.parseDocument(src, { prettyErrors: true }) + expect(doc.warnings).toMatchObject([{ name: 'YAMLWarning' }]) + }) ++ ++ test('repeated CR', () => { ++ const src = '[' + '\r'.repeat(80) ++ const doc = YAML.parseDocument(src, { prettyErrors: true }) ++ expect(doc.errors[0]).not.toHaveProperty('source') ++ }) + }) + + describe('tags on invalid nodes', () => { diff --git a/debian/patches/series b/debian/patches/series index 053c2da..e2d7781 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1,2 +1,3 @@ fix-test.patch fix-for-rollup-3.patch +CVE-2023-2251.patch diff --git a/debian/source/lintian-overrides b/debian/source/lintian-overrides index 7c118d4..b78412d 100644 --- a/debian/source/lintian-overrides +++ b/debian/source/lintian-overrides @@ -1,10 +1,10 @@ # False positive: test data -source-is-missing *tests/doc/YAML-1.2.spec.js* -source-is-missing *tests/doc/foldFlowLines.js* -source-contains-prebuilt-javascript-object *tests/doc/YAML-1.2.spec.js* -source-contains-prebuilt-javascript-object *tests/doc/foldFlowLines.js* -source-is-missing *debian/tests/test_modules/* -source-contains-prebuilt-javascript-object *debian/tests/test_modules/* +source-is-missing [*tests/doc/YAML-1.2.spec.js*] +source-is-missing [*tests/doc/foldFlowLines.js*] +source-contains-prebuilt-javascript-object [*tests/doc/YAML-1.2.spec.js*] +source-contains-prebuilt-javascript-object [*tests/doc/foldFlowLines.js*] +source-is-missing [*debian/tests/test_modules/*] +source-contains-prebuilt-javascript-object [*debian/tests/test_modules/*] very-long-line-length-in-source-file *tests/doc/YAML-1.2.spec.js* very-long-line-length-in-source-file *tests/doc/foldFlowLines.js* very-long-line-length-in-source-file *debian/tests/test_modules/* diff --git a/debian/tests/CVE-2023-2251 b/debian/tests/CVE-2023-2251 new file mode 100755 index 0000000..819869e --- /dev/null +++ b/debian/tests/CVE-2023-2251 @@ -0,0 +1,6 @@ +#!/usr/bin/node + +process.chdir('/'); +const yaml = require("/usr/share/nodejs/yaml"); +const string = "[" + "\r".repeat(80); +yaml.parseDocument(string); diff --git a/debian/tests/control b/debian/tests/control new file mode 100644 index 0000000..34bba78 --- /dev/null +++ b/debian/tests/control @@ -0,0 +1,2 @@ +Tests: CVE-2023-2251 +Depends: @, nodejs diff --git a/debian/tests/pkg-js/test b/debian/tests/pkg-js/test index 8d2da7d..6bd4f1a 100644 --- a/debian/tests/pkg-js/test +++ b/debian/tests/pkg-js/test @@ -1,5 +1,5 @@ # Test -jest --config config/jest.config.js --ci --testPathIgnorePatterns tests/yaml-test-suite.ts tests/_utils.ts tests/json-test-suite.ts .pc/ debian/ +jest --config config/jest.config.js --ci --testPathIgnorePatterns tests/yaml-test-suite.ts tests/_utils.ts tests/json-test-suite.ts .pc/ debian/tests/ # Types test tsc --allowJs --moduleResolution node --noEmit --target es5 dist/index.js
--- End Message ---
--- Begin Message ---
- To: Yadd <yadd@debian.org>, 1035625-done@bugs.debian.org
- Subject: Re: Bug#1035625: unblock: node-yaml/2.1.3-2
- From: Paul Gevers <elbrus@debian.org>
- Date: Thu, 11 May 2023 09:38:42 +0200
- Message-id: <182fb2e1-0b82-bf26-8bc6-53d59b70c82a@debian.org>
- In-reply-to: <[🔎] 168340457255.305260.7342825301512476293.reportbug@debian007.xnr.fr>
- References: <[🔎] 168340457255.305260.7342825301512476293.reportbug@debian007.xnr.fr>
Hi Yadd, On 06-05-2023 22:22, Yadd wrote:unblock node-yaml/2.1.3-2done, but....--- node-yaml-2.1.3/debian/tests/control 1970-01-01 00:00:00.000000000 +0000 +++ node-yaml-2.1.3/debian/tests/control 2023-05-06 05:56:19.000000000 +0000@@ -0,0 +1,2 @@ +Tests: CVE-2023-2251 +Depends: @, nodejsCan you please mark that test a superficial in the future? This doesn't qualify as non-trivial autopkgtest (see [1]).Paul [1] https://release.debian.org/testing/freeze_policy.html#beforeAttachment: OpenPGP_signature
Description: OpenPGP digital signature
--- End Message ---