Fix CVE-2022-24434 #179
Merged
Fix CVE-2022-24434 #179
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Force dicer to upgrade to version 0.3.1 by editing the package lock by hand. This protects against CVE-2022-24434.
JJ-8
approved these changes
Aug 24, 2022
There was a problem hiding this comment.
I can confirm that the patch fixes the problem.
We can also 'mitigate' this type of issue more generic:
diff --git a/docker-compose.yml b/docker-compose.yml
index 94cb353e..0d40b88e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -5,6 +5,7 @@ services:
context: "./api"
networks:
- ctfnote
+ restart: always
environment:
PAD_CREATE_URL: http://hedgedoc:3000/new
PAD_SHOW_URL: /If the server crashes, we just restart it always. Of course an attacker can launch the attack again and again, but this at least prevents the server from being down permanently until restarted by the admin.
This would also mitigate downtime due to errors in the code for example.
What do you think of this @XeR?
👍 |
JJ-8
added a commit
to JJ-8/CTFNote
that referenced
this pull request
Aug 26, 2022
In case of DoS, the container will restart instead of it being down until restarted manually. As discussed in TFNS#179
XeR
pushed a commit
that referenced
this pull request
Aug 26, 2022
In case of DoS, the container will restart instead of it being down until restarted manually. As discussed in #179
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I hand-patched the vulnerable dependency to a non-vulnerable version.
I did this by:
dicerand its dependency from the yarn lockfiledicerrequirement to upgrade its version to 0.3.1yarn addto adddicer@0.3.1I invited you to a private repository with a PoC script to test the fix.
The container
apicrashes before the patch, now it drops the request