5.0.2 is throwing high severity security; audit fix wants to downgrade to 4.2.0

[StoneCypher]

5.0.2 is throwing high severity security. The underlying problem appears to be node-gyp.

Audit fix wants to downgrade to 4.2.0

Development machine is Windows 10 Pro running Git Bash

$ npm audit
# npm audit report

tar  <=3.2.2 || 4.0.0 - 4.4.14 || 5.0.0 - 5.0.6 || 6.0.0 - 6.1.1
Severity: high
Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization - https://npmjs.com/advisories/1770
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning - https://npmjs.com/advisories/1771
fix available via `npm audit fix --force`
Will install sqlite3@4.2.0, which is a breaking change
node_modules/tar
  node-gyp  <=3.8.0
  Depends on vulnerable versions of tar
  node_modules/node-gyp
    sqlite3  >=5.0.0
    Depends on vulnerable versions of node-gyp
    node_modules/sqlite3

3 high severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

[rwky]

I've tested the master branch and this isn't a problem there, the master branch build is failing but that looks to be a missing python depencency in the CI env. The diff between master and 5.0.2 is minimal so if the CI could be fixed it should straight forward to cut a new release.

[dearzubi]

Is anyone working on this?

[bennycode]

I am using sqlite3 v5.0.2 which defines node-gyp v3.x as peer dependency. Unfortunately, node-gyp 3.x (3.8.0) is currently 302 commits behind the latest node-gyp and uses the vulnerable dependency tar v2.2.2: GHSA-3jfq-g458-7qm9

I can see that the "master" branch of "node-sqlite3" already uses node-gyp v7.x. @kewde Can you please create a release for it?

[createthis]

@kewde Is the failure in master a temporary network error? https://ci.appveyor.com/project/Mapbox/node-sqlite3/builds/38143237/job/mwmk1n45rrd3s8gi

Can someone re-run the CI test suite to see if it was a temporary failure?

What is preventing the tagging of a new release?

[louislam]

I published my fork on npm which is using the latest source code of this repo.
https://github.com/louislam/node-sqlite3

npm install @louislam/sqlite3
npm remove sqlite3

// Replace require('sqlite') in source code
require('@louislam/sqlite')

You can use this as a temporary fix. Switch back to mapbox/node-sqlite3 once it got fixed.

[jan-swiecki]

Workaround:

npm install git@github.com:mapbox/node-sqlite3.git

[createthis]

Workaround:

npm install git@github.com:mapbox/node-sqlite3.git

Even better, tag the commit so that it can't change when someone merges a PR:

npm install git+https://github.com/mapbox/node-sqlite3.git#593c9d

[kewde]

Hi,

I will take a look at this ASAP.

[NehaNaithani]

Hi ,

I am also getting high vulnerability issue in 5.2.0 and npm audit fix downgrade the package to 4.2.0

│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Arbitrary File Creation/Overwrite due to insufficient        │
│               │ absolute path sanitization                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ tar                                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=3.2.2 <4.0.0 || >=4.4.14  <5.0.0 || >=5.0.6 <6.0.0 ||      │
│               │ >=6.1.1                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ sqlite3                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ sqlite3 > node-gyp > tar                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1770                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Arbitrary File Creation/Overwrite via insufficient symlink   │
│               │ protection due to directory cache poisoning                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ tar                                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=3.2.3 <4.0.0 || >=4.4.15  <5.0.0 || >=5.0.7 <6.0.0 ||      │
│               │ >=6.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ sqlite3                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ sqlite3 > node-gyp > tar                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1771                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

Thanks

[ijavid]

@kewde Any news on this?

[sharedrory]

Almost 1 month later, I know things take time, is there any news on this?

[josep11]

I published my fork on npm which is using the latest source code of this repo. https://github.com/louislam/node-sqlite3

npm install @louislam/sqlite3
npm remove sqlite3

// Replace require('sqlite') in source code
require('@louislam/sqlite')

You can use this as a temporary fix. Switch back to mapbox/node-sqlite3 once it got fixed.

For the workaround, I got 'Not found' from npm on trying to install with: npm i @louislam/sqlite

[puja-saraswat]

Hi Team,
Is there any update for this issue? We are waiting for the solution to resolve the CVE-2021-32804 vulnerability

[platrofa]

Hi,
is there any new release planned to solve the node-gyp vulnerability?

[grenik]

Looks like there is a solution in #1493 (comment)

[daniellockyer]

I believe this should be fixed in v5.0.3 🙂

~/code/node-sqlite3 λ git describe --tags
v5.0.3
~/code/node-sqlite3 λ yarn audit
yarn audit v1.22.15
0 vulnerabilities found - Packages audited: 335
✨  Done in 0.49s.