Vulnerability check reported failure on main - Tue Jul 19 00:48:59 UTC 2022 - undici CVE-2022-32210

[mhdawson]

https://github.com/mhdawson/nodejs-dependency-vuln-assessments/actions/runs/2694426919
WARNING: New vulnerabilities found

[mhdawson]

Full error message:

WARNING: New vulnerabilities found

• undici (version 5.8.0) :
  • CVE-2022-32210: https://nvd.nist.gov/vuln/detail/CVE-2022-32210
    For each dependency and vulnerability, check the following:
• Check that the dependency's version printed by the script corresponds to the version present in the Node repo.
  If not, update dependencies.py with the actual version number and run the script again.
• If the version is correct, check the vulnerability's description to see if it applies to the dependency as
  used by Node. If not, the vulnerability ID (either a CVE or a GHSA) can be added to the ignore list in
  dependencies.py. IMPORTANT: Only do this if certain that the vulnerability found is a false positive.
• Otherwise, the vulnerability found must be remediated by updating the dependency in the Node repo to a
  non-affected version, followed by updating dependencies.py with the new version.

[mhdawson]

@mcollina I believe you already confirmed that this does not affect Node.js, can you confirm that here.

My understanding is that we will update the version of undici in Node.js but that that will happen as part of regular releases since Node.js is not affectected.

[mcollina]

Yes exactly. fetch() has a few more protection than the lower level APIs.

[mhdawson]

@mcollina thanks for confirming. We'll leave this open as documentation of that until we have updates in the relevant Node.js versions.

[mcollina]

I think something in the script or in the advisory is incorrect.
Node.js has already been updated to v5.8.0, which is significantly past that. nodejs/node#43886

[facutuesca]

It looks like NVD published the advisory but has not yet updated all the information (like the specific range of affected versions):

UNDERGOING ANALYSIS
This vulnerability is currently undergoing analysis and not all information is available. Please check back soon to view the completed vulnerability summary.

Since there is no version specified, it's considered a vulnerability in all versions (at least from the point of view of querying the NVD API)

[mhdawson]

closing in favor of - #45