[Release-4.19] OCPBUGS-70284: Fix CVE-2025-15284 by upgrading cypress#408
[Release-4.19] OCPBUGS-70284: Fix CVE-2025-15284 by upgrading cypress#408MrSanketkumar wants to merge 1 commit intoopenshift:release-4.19from
Conversation
openshift-ci-robot
added
jira/severity-important
|
@MrSanketkumar: This pull request references Jira Issue OCPBUGS-70284, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughBumped three devDependencies in ChangesDependency Version Updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 12✅ Passed checks (12 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: MrSanketkumar The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
/jira refresh |
|
@MrSanketkumar: This pull request references Jira Issue OCPBUGS-70284, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
|
/jira refresh |
|
@MrSanketkumar: This pull request references Jira Issue OCPBUGS-70284, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@package.json`:
- Line 61: Update the Cypress dependency to 15.8.2 in package.json and update
the devcontainer to use Node.js 20+ so Cypress can run: change the "cypress"
entry to "^15.8.2" and modify the devcontainer base (referenced in
.devcontainer/Dockerfile.plugin where it currently uses typescript-node:16) to a
Node 20+ image (e.g., typescript-node:20 or another official Node 20 image),
rebuild the devcontainer and verify the workspace uses Node 20.x, run the test
suite locally to confirm compatibility, and ensure CI Linux runners have glibc
>=2.31 (update CI images or document requirement) before merging.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: bf33ff34-3f09-46e9-8144-082dbb92ed7e
⛔ Files ignored due to path filters (1)
yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (1)
package.json
| "css-loader": "^6.7.1", | ||
| "cypress": "^12.17.4", | ||
| "cypress-multi-reporters": "^1.6.2", | ||
| "cypress": "^15.0.0", |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, let's check the actual package.json file
cat -n package.json | sed -n '55,70p'Repository: openshift/networking-console-plugin
Length of output: 798
🏁 Script executed:
# Search for any CI/dev configuration files to understand the environment
find . -type f \( -name ".github" -o -name "docker*" -o -name ".circleci" -o -name ".gitlab-ci*" \) 2>/dev/null | head -20Repository: openshift/networking-console-plugin
Length of output: 114
🌐 Web query:
CVE-2025-15284 Cypress vulnerability
💡 Result:
CVE-2025-15284 is an Improper Input Validation vulnerability in the qs npm package (versions < 6.14.1), enabling potential HTTP Denial of Service (DoS) via memory exhaustion. The arrayLimit option fails to enforce limits on bracket notation arrays (e.g., a[]=1&a[]=2), unlike indexed notation, creating a consistency bug. However, the default parameterLimit=1000 mitigates practical DoS risk in most cases, as it caps parsed parameters. Severity reduced accordingly: CVSS v3.1 3.7 (Low), CVSS v4 6.3 (Medium). It affects Cypress (cypress-io/cypress) as a transitive dependency via @cypress/request, flagged by npm audit in versions up to 15.8.1. Fixed in Cypress 15.8.2 by updating dependencies. Workarounds: npm audit fix, overrides to qs@~6.14.1, or reinstall. No evidence of a vulnerability directly in Cypress Semiconductor/Infineon products; searches of official sites yielded no matches. The association is with the Cypress testing framework.
Citations:
- 1: https://nvd.nist.gov/vuln/detail/CVE-2025-15284
- 2: https://it.tenable.com/cve/CVE-2025-15284
- 3: GHSA-6rw7-vpxm-498p
- 4: High severity vulnerability CVE-2025-15284 in qs <6.14.1 cypress-io/cypress#33180
- 5: https://www.tenable.com/cve/CVE-2025-15284
🌐 Web query:
Cypress 15.8.2 changelog CVE fix release notes
💡 Result:
Cypress 15.8.2 was released on January 6, 2026. It is a patch release primarily addressing bug fixes and a security vulnerability. Bug fixes: - Fixed ffprobe path configuration for video operations; upgraded @ffprobe-installer/ffprobe from 1.1.0 to 2.1.2 for darwin-arm64 support (#33136). - Fixed test:after:run and test:after:run:async events not firing after both before all and after all hooks failed (#33172). Dependency updates: - Upgraded @cypress/request to 3.0.10, which removes the CVE-2025-15284 vulnerability reported in security scans (#33188). This release specifically fixes the CVE-2025-15284 vulnerability via the @cypress/request dependency upgrade, making it a CVE fix release.
Citations:
- 1: cypress-io/cypress@v15.8.1...v15.8.2
- 2: https://docs.cypress.io/llm/markdown/app/references/changelog.md
- 3: https://docs.cypress.io/app/references/changelog
- 4: https://github.com/cypress-io/cypress/blob/develop/cli/CHANGELOG.md
🌐 Web query:
Cypress 15 Node.js version requirement glibc
💡 Result:
Cypress 15 requires Node.js 20.x, 22.x, or >=24.x for installation. On Linux systems, it requires glibc >=2.31, due to dependencies like Electron 36 and better-sqlite3 built on Debian Bullseye. Supported Linux distributions include Ubuntu 20.04+, Debian 11+, Fedora 41+. Use ldd --version to check glibc version. This aligns with Node.js 20+ Linux support and Cypress binary/Electron requirements.
Citations:
- 1: https://docs.cypress.io/app/references/migration-guide
- 2: https://www.cypress.io/blog/cypress-15-made-simple-upgrade-paths-from-13-and-14
- 3: cypress-io/cypress@v15.0.0...v15.1.0
- 4: https://docs.cypress.io/app/references/changelog
- 5: https://docs.cypress.io/llm/markdown/app/get-started/install-cypress.md
🏁 Script executed:
# Check the devcontainer for Node.js version and base image
cat -n .devcontainer/docker-compose.ymlRepository: openshift/networking-console-plugin
Length of output: 1138
🏁 Script executed:
# Also check if there are any other CI configs
find . -type f -name "Dockerfile*" -o -name "*action*.yml" -o -name "*action*.yaml" 2>/dev/null | head -20Repository: openshift/networking-console-plugin
Length of output: 178
🏁 Script executed:
# Check the plugin Dockerfile for Node version
cat -n .devcontainer/Dockerfile.pluginRepository: openshift/networking-console-plugin
Length of output: 235
🏁 Script executed:
# Check console Dockerfile too
cat -n .devcontainer/Dockerfile.consoleRepository: openshift/networking-console-plugin
Length of output: 1087
🏁 Script executed:
# Check main Dockerfile as well
cat -n DockerfileRepository: openshift/networking-console-plugin
Length of output: 1369
Bump Cypress to 15.8.2 and update devcontainer Node.js version.
CVE-2025-15284 (in qs package, transitive dependency) is fixed in Cypress 15.8.2. However, the devcontainer's .devcontainer/Dockerfile.plugin uses typescript-node:16 (Node.js 16), which is incompatible with Cypress 15's requirement for Node.js 20.x, 22.x, or >=24.x. The devcontainer must be updated to use Node.js 20+ before this change merges. Additionally, confirm that CI environments have glibc >=2.31 for Linux systems.
Suggested change
- "cypress": "^15.0.0",
+ "cypress": "^15.8.2",📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "cypress": "^15.0.0", | |
| "cypress": "^15.8.2", |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@package.json` at line 61, Update the Cypress dependency to 15.8.2 in
package.json and update the devcontainer to use Node.js 20+ so Cypress can run:
change the "cypress" entry to "^15.8.2" and modify the devcontainer base
(referenced in .devcontainer/Dockerfile.plugin where it currently uses
typescript-node:16) to a Node 20+ image (e.g., typescript-node:20 or another
official Node 20 image), rebuild the devcontainer and verify the workspace uses
Node 20.x, run the test suite locally to confirm compatibility, and ensure CI
Linux runners have glibc >=2.31 (update CI images or document requirement)
before merging.
openshift-ci
Bot
added
the
needs-rebase
MrSanketkumar
force-pushed
the
fix-CVE-2025-15284-4.19
branch
from
3736d3f to
af3a461
Compare
openshift-ci
Bot
removed
the
needs-rebase
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
|
@MrSanketkumar: This pull request references Jira Issue OCPBUGS-70284, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/hold Waiting for the NPM migration to complete. |
openshift-ci
Bot
added
the
do-not-merge/hold
|
@MrSanketkumar: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
Release-4.19 is NOT VULNERABLE to CVE-2025-15284 after the NPM migration (PR #398). The vulnerability has been naturally resolved without requiring additional fixes. |
|
@MrSanketkumar: This pull request references Jira Issue OCPBUGS-70284. The bug has been updated to no longer refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
2 participants
Summary by CodeRabbit