Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

NethCTI 3: upgrade moment.js dependency due to security vulnerability #5375

Closed
alepolidori opened this issue Apr 10, 2018 · 12 comments
Closed

NethCTI 3: upgrade moment.js dependency due to security vulnerability #5375

alepolidori opened this issue Apr 10, 2018 · 12 comments
Labels
bug A defect of the software nethcti Relative to NethCTI client or server verified All test cases were verified successfully
Milestone
NethVoice 14

Comments

@alepolidori
Copy link

alepolidori commented Apr 10, 2018 •
edited

Description

Moment library is vulnerable to regular expression denial of service via a crafted date string.
Here all info: https://nvd.nist.gov/vuln/detail/CVE-2017-18214
Issue: moment/moment#4163

Todo
Update the library
@alepolidori alepolidori added bug A defect of the software nethcti Relative to NethCTI client or server labels Apr 10, 2018
@alepolidori alepolidori added this to the NethVoice 14 milestone Apr 10, 2018
@alepolidori alepolidori self-assigned this Apr 10, 2018
@alepolidori alepolidori changed the title NethCTI 3: security dos vulnerability on moment library NethCTI 3: upgrade moment.js dependency due to security vulnerability Apr 10, 2018
@alepolidori
Copy link
Author

alepolidori commented Apr 10, 2018 •
edited

On the client the lib is never used: I have removed it.

@alepolidori alepolidori removed their assignment Apr 10, 2018
@alepolidori
Copy link
Author

alepolidori commented Apr 10, 2018 •
edited

Note: requires update of client and server

How to test

  • verify that date time is correct, for example in history, switchboard search, into the queue service (e.g. the lost queue calls list) and into the offhoure.
  • verify the correctness of datetime into the server log /var/log/asterisk/nethcti.log

@alepolidori alepolidori added the testing Packages are available from testing repositories label Apr 10, 2018
@nethbot
Copy link
Member

nethbot commented Apr 10, 2018

in 7.4.1708/nethesis-testing:

@alepolidori alepolidori removed the testing Packages are available from testing repositories label Apr 11, 2018
alepolidori pushed a commit to nethesis/nethcti-server that referenced this issue Apr 11, 2018
Upgrade moment.js dependency due to security vulnerability
0b100e9 
nethesis/dev#5375
@alepolidori alepolidori mentioned this issue Apr 11, 2018
Merged
alepolidori added a commit to nethesis/nethcti-server that referenced this issue Apr 11, 2018
@alepolidori
Upgrade moment.js dependency due to security vulnerability (#45)
a6c0542 
nethesis/dev#5375
@alepolidori alepolidori added the testing Packages are available from testing repositories label Apr 11, 2018
@nethbot
Copy link
Member

nethbot commented Apr 11, 2018

in 7.4.1708/nethesis-testing:

@SebastianMB-IT SebastianMB-IT added verified All test cases were verified successfully and removed testing Packages are available from testing repositories labels Apr 11, 2018
@SebastianMB-IT
Copy link

Verified

@nethbot
Copy link
Member

nethbot commented Apr 12, 2018

in 7.4.1708/nethesis-testing:

@nethbot
Copy link
Member

nethbot commented Apr 12, 2018

in 7.4.1708/nethesis-upgrades:

@nethbot
Copy link
Member

nethbot commented Apr 12, 2018

in 7.4.1708/nethesis-upgrades:

@alepolidori
Copy link
Author

Timestamp on the client is broken

@alepolidori alepolidori reopened this Apr 16, 2018
@alepolidori
Copy link
Author

Fixed

@nethbot
Copy link
Member

nethbot commented Apr 16, 2018

in 7.4.1708/nethesis-testing:

@nethbot
Copy link
Member

nethbot commented Apr 16, 2018

in 7.4.1708/nethesis-upgrades:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug A defect of the software nethcti Relative to NethCTI client or server verified All test cases were verified successfully
Projects
None yet
Milestone
NethVoice 14
Development

No branches or pull requests
3 participants
@alepolidori @SebastianMB-IT @nethbot