fix: mitigate CVE-2023-28155, CVE-2023-26136

[coreydaley]

Hey, I just made a Pull Request!

This pull request builds off of #23320 and supersedes it, fixing the conflicts that it had with the main branch when it was abandoned.

This pull request updates the @kubernetes/client-node dependency from version 0.20.0 to 1.0.0-rc7. This update is critical as it addresses two known security vulnerabilities related to the request package, a dependency of @kubernetes/client-node, and its transitive dependency tough-cookie:

1. CVE-2023-28155 - A vulnerability in the request package, which could potentially allow attackers to perform various attacks due to improper input validation.
2. CVE-2023-26136 - A vulnerability in the tough-cookie package, a transitive dependency of request, which could allow attackers to craft cookies that may bypass intended security restrictions, leading to potential information disclosure or session hijacking.

By updating to @kubernetes/client-node version 1.0.0-rc7, these vulnerabilities are mitigated through the inclusion of patched versions of the affected packages. It is highly recommended to merge this pull request at the earliest to ensure the security of our application and protect against potential exploits leveraging these vulnerabilities.

Fixes #18742

Changes:

• Updated @kubernetes/client-node from 0.20.0 to 1.0.0-rc7 in package.json.

Impact:

• Addresses critical security vulnerabilities CVE-2023-28155 and CVE-2023-26136 related to the request and tough-cookie packages.
• Enhances the security and stability of the application by using the latest, patched versions of dependencies.

Please review the changes and merge this pull request to enhance our application's security posture.

Thank you.

Built upon a contribution by Daniel Meyer (external expert on behalf of DB InfraGO) daniel.di.meyer-extern@deutschebahn.com

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes)
• All your commits have a Signed-off-by line in the message. (more info)

[backstage-goalie]

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
@backstage/plugin-kubernetes-backend	plugins/kubernetes-backend	minor	v0.18.8-next.0
@backstage/plugin-kubernetes-common	plugins/kubernetes-common	minor	v0.8.3
@backstage/plugin-kubernetes-node	plugins/kubernetes-node	minor	v0.1.21-next.0
@backstage/plugin-kubernetes-react	plugins/kubernetes-react	minor	v0.4.5-next.0
@backstage/plugin-kubernetes	plugins/kubernetes	minor	v0.11.17-next.0

[backstage-goalie]

Thanks for the contribution!
All commits need to be DCO signed before they are reviewed. Please refer to the the DCO section in CONTRIBUTING.md or the DCO status for more info.

[benjdlambert]

@mclarke47 I know you're pretty slammed at the min, but is there any chance you could take a look and test this out? 🙏

[efenner-cambia]

@coreydaley thanks for taking this on!

[mclarke47]

There seem to be some test failures in CI. I'll run this locally and do some basic manual testing

[coreydaley]

Thank you @mclarke47 , if you figure it out please let me know and I can update my pull request.

[freben]

This PR has a conflict now.

[joaquin386]

Any traction on the vulnerability fix?

[coreydaley]

I am back working on this, the only part I have left is what was discussed in #25385 (review)
I am not a TypeScript guru so trying to reason my way through it :)

[coreydaley]

@mclarke47 I think I will just stick with this approach then. Looks like I need one more approving review before I can merge. Thanks!

[coreydaley]

Verify Docs Quality failing due to #27154

[coreydaley]

I have rebased (again) and all tests are passing if anyone has time for a second approving review. Thanks!

[mclarke47]

It needs another rebase 😞

[mclarke47]

Thank you for this amazing contribution btw! 🙏 Sorry it's been such a slog

[coreydaley]

Thank you for this amazing contribution btw! 🙏 Sorry it's been such a slog

No problem, it's been a good learning experience and I appreciate all of the help along the way :)

I would like to get it merged soon though if possible ...

[mclarke47]

I'll try to get one of the maintainers to look, when they come online STO time tomorrow.

[coreydaley]

I'll try to get one of the maintainers to look, when they come online STO time tomorrow.

I would appreciate that, thank you!

[Rugvip]

Awesome, thank you! 😁

Just need to avoid mock-fs

[Rugvip]

Nice! 🎉

Just a small nit left

[Rugvip]

Awesome, let's , thank you! 🎉

[github-actions]

Thank you for contributing to Backstage! The changes in this pull request will be part of the 1.33.0 release, scheduled for Tue, 19 Nov 2024.

[meda1028]

Hi coreydaley and team,
First of all, a huge huge thank you for getting this over the line.

Since you superseded the PR Description from PR(#23320), can you remove the "Contribution is Signed-off-by: Daniel Meyer (external expert on behalf of DB InfraGO) daniel.di.meyer-extern@deutschebahn.com" statement as this is not true anymore.
Mentioning it would be appreciated still.

[coreydaley]

@meda1028 Updated, please let me know if that is ok or you would like further modifications.