deps: updated tar package version to 4.4.8 · nodejs/node-gyp@1456ef2

ogensec · 2019-04-15T00:23:19Z

When can will we have this update please ?

Please... fast ...

hykw · 2019-04-15T01:31:04Z

@romanstingler
Thank you for providing the great package!
I'd appreciate you publish the new version when there is time.

ogensec · 2019-04-15T02:27:54Z

Will we just need to do a "npm update" after the next update distribution ?
this will resolve this ? :
(can't resolve High Arbitrary File Overwrite Package tar
Patched in >=4.4.2
Dependency of node-sass [dev] )

jhnferraris · 2019-04-15T07:33:12Z

Any news on this or a workaround so we can reactivate our npm audit check? :)

giamir · 2019-04-15T10:04:40Z

It would be great if you could publish a new version of this package soon. We are currently having a lot of our security pipelines red because of the tar vulnerability. Thanks.

ram-you · 2019-04-15T11:10:35Z

Please do because https://npmjs.com/advisories/803

pieron187 · 2019-04-15T11:39:18Z

+1, this is causing 'yarn audit' fails.

C-odes · 2019-04-15T14:55:58Z

Any estimated time on when this will be published???

tzanis · 2019-04-16T14:21:55Z

npm audit fails. Do we have any estimation or update one this?

aittomakia · 2019-04-16T16:51:44Z

I wish this would get patched soon

davidhbrown · 2019-04-17T02:20:54Z

+1

francoismassart · 2019-04-17T08:04:47Z

When can we fix this ? It's been too long

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Arbitrary File Overwrite                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ tar                                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.4.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ node-sass [dev]                                              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ node-sass > node-gyp > tar                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/803                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

pchoudhary-drg · 2019-04-17T09:33:47Z

+1

I-keep-trying · 2019-04-17T13:39:33Z

+1

FredPell83 · 2019-04-17T14:30:01Z

+1

romerocs · 2019-04-17T18:21:32Z

+1

romanstingler · 2019-04-17T18:32:08Z

you guys earn the golden poop.
6 days ago a fix was commited for a critical security issue and you have not released it by now.
You should look for new maintainer for this damn package

pandukovur · 2019-04-17T20:32:34Z

  High            Arbitrary File Overwrite

  Package         tar

  Patched in      >=4.4.2

  Dependency of   @angular-devkit/build-angular [dev]

  Path            @angular-devkit/build-angular > node-sass > node-gyp > tar

  More info       https://npmjs.com/advisories/803

High            Arbitrary File Overwrite

 Package         tar

 Patched in      >=4.4.2

 Dependency of   node-sass [dev]

 Path            node-sass > node-gyp > tar

 More info       https://npmjs.com/advisories/803

Waiting on the latest version to publish as this package is a dev dependency for agular dev servers. When this will be published?

evanhooff · 2019-04-18T07:51:45Z

+1

jhnferraris · 2019-04-18T14:15:51Z

Any news?

jhnferraris · 2019-04-18T14:16:50Z

Referencing issues: #1721 and #1717

purplelady105 · 2019-04-18T16:00:55Z

Please release a new version with the latest security patch for tar; npm audit keeps yelling at me :)

samabp · 2019-04-19T00:19:59Z

+1
@purplelady105 Yeah what she said.

tkrebs2 · 2019-04-19T18:49:49Z

Can't update my react-scripts package because of this

onx2 · 2019-04-20T00:01:35Z

+1 Please release this fix. It is a critical security issue that is affecting us all :)

aayush420 · 2019-04-20T15:17:15Z

+1

omarmok · 2019-04-22T06:03:04Z

Can't update gulp because of this for 2 days

suits-at · 2019-04-22T17:02:39Z

+1

mtzrmzia · 2019-04-22T17:56:29Z

+1 Please release the fix we all need it

NaturalDevCR · 2019-04-22T19:30:50Z

+1

felipecalvo · 2019-04-22T21:56:01Z

This is a serious vulnerability we'd really like to have fixed as soon as possible. Thanks!

sportgirl · 2019-04-23T15:50:55Z

+1

domic6300 · 2019-04-24T07:26:07Z

+1

abadilah1 · 2019-04-24T11:56:13Z

+1

mikern12 · 2019-04-24T12:38:51Z

A fix was merged into master for this and the version of node-gyp was increased to 4.0.0, however, I do not think that this was updated in the node-sass table. When I run npm install node-gyp, I do get the 4.0.0 version, but I get an error that I something changed and I need to "Run npm rebuild node-sass to download the binding for your current environment." When I do this, it re-loads the 3.8.x version of node-gyp. Error below from the rebuild of node-sass:

gyp ERR! node -v v9.4.0
gyp ERR! node-gyp -v v3.8.0
gyp ERR! This is a bug in node-gyp.
gyp ERR! Try to update node-gyp and file an Issue if it does not help:
gyp ERR! https://github.com/nodejs/node-gyp/issues
Build failed with error code: 7
npm ERR! code ELIFECYCLE
npm ERR! errno 1
npm ERR! node-sass@4.11.0 postinstall: node scripts/build.js
npm ERR! Exit status 1
npm ERR!
npm ERR! Failed at the node-sass@4.11.0 postinstall script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.

marcovalentin · 2019-04-24T12:40:07Z

+1

mikern12 · 2019-04-24T14:40:40Z

I see the error. The package-lock.json still has the old values and hash for the old version of node-gyp. I have tried to modify it, but gets overwritten every time there is an update for npm

RandomErrorMessage · 2019-04-24T14:42:45Z

The absolute state of NodeJS

MartCube · 2019-04-25T17:13:33Z

Does anyone found a side solution for this ?

aayush420 · 2019-04-25T17:16:59Z

Yeah. Just moved my scss assets into my SFCs and commented out node-sass out of my package.json temporarily. I don't want my IS team send emails saying that your system is infected.

…

On Thu, Apr 25, 2019, 10:43 PM mart cube ***@***.***> wrote: Does anyone found a side solution for this ? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <1456ef2#commitcomment-33311082>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AEA5VXZSZTRA2E3FL56ZHFDPSHREZANCNFSM4HFNECSA> .

LaurelineP · 2019-04-26T14:13:31Z

1 for node-sass ...

gontranbezerra · 2019-04-27T00:12:13Z

+1

gigi206 · 2019-04-27T10:53:54Z

+1

Morb0 · 2019-04-29T16:31:11Z

+1

Lucas-Marchand · 2019-04-30T04:01:29Z

+1

Lucas13600 · 2019-04-30T13:53:05Z

Does anyone know how I can keep working (running localhost & deploying my website) while this issue isn't fixed yet ?

Thanks folks

morgantkb · 2019-04-30T17:59:16Z

+1

jamilservicos · 2019-05-01T18:19:06Z

my manual fix:

$ npm --version
6.9.0

$ npm uninstall --save tar
found 0 vulnerabilities

$ npm install --save-dev tar
+ tar@4.4.8
found 0 vulnerabilities

$ npm audit fix
fixed 0 of 0 vulnerabilities

purplelady105 · 2019-05-01T21:49:37Z

Does anyone know how I can keep working (running localhost & deploying my website) while this issue isn't fixed yet ?

Thanks folks

@Lucas13600

I just manually updated the tar version number in every occurrence in my package-lock.json file. Granted, it will try to overwrite these version numbers if you install anything else or run npm update, but it's only meant to be a temporary fix.

Lucas13600 · 2019-05-02T13:43:02Z

I just manually updated the tar version number in every occurrence in my package-lock.json file. Granted, it will try to overwrite these version numbers if you install anything else or run npm update, but it's only meant to be a temporary fix.

@purplelady105

Thanks a lot ! I am pretty new to coding, so needed a little help, thanks 👍
Which version number did you pick for the tar ?

tomrcht · 2019-05-03T08:39:38Z

@Lucas13600 you should use the latest: 4.4.8

Lucas13600 · 2019-05-13T11:32:03Z

When will it be fixed ?
Even when I updated my tar version manually, if I run npm audit I get "found 0 vulnerabilities" but
I still cannot use npm run dev because I get this :
"> web-app@1.0.0 dev /Users/ldu/Desktop/web-app

webpack-dev-server --inline --progress --config build/webpack.dev.conf.js

internal/modules/cjs/loader.js:613
throw err;
^

Error: Cannot find module './lib/bytesToUuid'
Require stack:

/Users/ldu/Desktop/web-app/node_modules/uuid/v4.js
/Users/ldu/Desktop/web-app/node_modules/sockjs/lib/transport.js
/Users/ldu/Desktop/web-app/node_modules/sockjs/lib/trans-websocket.js
/Users/ldu/Desktop/web-app/node_modules/sockjs/lib/sockjs.js
/Users/ldu/Desktop/web-app/node_modules/sockjs/index.js
/Users/ldu/Desktop/web-app/node_modules/webpack-dev-server/lib/Server.js
/Users/ldu/Desktop/web-app/node_modules/webpack-dev-server/bin/webpack-dev-server.js
at Function.Module._resolveFilename (internal/modules/cjs/loader.js:610:15)
at Function.Module._load (internal/modules/cjs/loader.js:526:27)
at Module.require (internal/modules/cjs/loader.js:666:19)
at require (internal/modules/cjs/helpers.js:16:16)
at Object. (/Users/ldu/Desktop/web-app/node_modules/uuid/v4.js:2:19)
at Module._compile (internal/modules/cjs/loader.js:759:30)
at Object.Module._extensions..js (internal/modules/cjs/loader.js:770:10)
at Module.load (internal/modules/cjs/loader.js:628:32)
at Function.Module._load (internal/modules/cjs/loader.js:555:12)
at Module.require (internal/modules/cjs/loader.js:666:19)
npm ERR! code ELIFECYCLE
npm ERR! errno 1
npm ERR! web-app@1.0.0 dev: webpack-dev-server --inline --progress --config build/webpack.dev.conf.js
npm ERR! Exit status 1
npm ERR!
npm ERR! Failed at the web-app@1.0.0 dev script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.

npm ERR! A complete log of this run can be found in:
npm ERR! /Users/ldu/.npm/_logs/2019-05-13T11_22_31_372Z-debug.log"

Can anyone help me through this ?

I really don't get what is going on...

This comment was marked as off-topic.

Sign in to view

ogensec · 2019-05-26T15:35:43Z

There should be an version upgrade ASAP

"ASAP" ???? Do you know what that mean ?

addaleax · 2019-05-26T15:41:04Z

@OG3NS3C Hi! While I understand your frustration, I’d like to remind you that this project is governed by a Code of Conduct, and we’d like to keep comments productive and professional. I’ve hidden your previous comment due to its wording (as well as its excessive length, which makes this discussion harder to follow than it already is).

That being said, my understanding is that the underlying security issue has already been addressed: #1717 (comment)

ogensec · 2019-05-26T15:49:06Z

Ok no problem, how much time we will wait ? I have 36 vulnerability cause of this ... I can't launch my project in production ...

addaleax · 2019-05-26T15:59:19Z

@OG3NS3C In your case, the issue appears to be that you have a dependency chain like this:

@vue/cli-service > webpack > chrome-trace-event > npm > npm-lifecycle > node-gyp > tar

Ultimately, your depencies are outdated because @vue/cli-service explicitly forbids using an up-to-date version of webpack: https://github.com/vuejs/vue-cli/blob/5f879c4b5d2e50fb23b5e35ec6f635fc5f80e796/packages/%40vue/cli-service/package.json#L75, and so the node-gyp dependency cannot be updated.

So, it looks like your issue is more with the vue CLI package than with the node-gyp one.

ogensec · 2019-05-26T16:14:21Z

I don't find what to do to resolve my problem :(

aayush420 · 2019-05-26T16:18:46Z

I resolved it by removing sass and scss files and replacing them with compiled css for now. I don't have to compile them, thus, I don't require node-gyp or node-sass for that matter. When the issue really gets resolved from future updates, I would switch back to scss and sass. Might look like a noob solution. But it is an option for the people who want to try it out. In my case, I can not keep my Symantec send me alerts about the vulnerability.

…

On Sun, May 26, 2019, 9:44 PM OG3NS3C ***@***.***> wrote: I don't find what to do to resolve my problem :( Le dim. 26 mai 2019 à 17:59, Anna Henningsen ***@***.*** ***@***.***>> a écrit : @OG3NS3C<https://github.com/OG3NS3C> In your case, the issue appears to be that you have a dependency chain like this: @vue/cli-service > webpack > chrome-trace-event > npm > npm-lifecycle > node-gyp > tar Ultimately, your depencies are outdated because @vue/cli-service explicitly forbids using an up-to-date version of webpack: https://github.com/vuejs/vue-cli/blob/5f879c4b5d2e50fb23b5e35ec6f635fc5f80e796/packages/%40vue/cli-service/package.json#L75, and so the node-gyp dependency cannot be updated. So, it looks like your issue is more with the vue CLI package than with the node-gyp one. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub< 1456ef2?email_source=notifications&email_token=AJTN3MJNLJAI7PACORCXICLPXKXWPA5CNFSM4HFNECSKYY3PNVWWK3TUL52HS4DFVVBW63LNNF2EG33NNVSW45FKMNXW23LFNZ2F62LEZYBAD4SO#commitcomment-33681998>, or mute the thread< https://github.com/notifications/unsubscribe-auth/AJTN3MN4VNMHNJ36UAG5RV3PXKXWPANCNFSM4HFNECSA>. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <1456ef2?email_source=notifications&email_token=AEA5VX4MKJDMGJTL2EXLQBDPXKZOXA5CNFSM4HFNECSKYY3PNVWWK3TUL52HS4DFVVBW63LNNF2EG33NNVSW45FKMNXW23LFNZ2F62LEZYBAD4UP#commitcomment-33682063>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AEA5VX5IIWC4B2HT27NDNSDPXKZOXANCNFSM4HFNECSA> .

addaleax · 2019-05-26T16:23:35Z

@OG3NS3C Without more information, I probably can’t help you either. I think opening an issue at https://github.com/vuejs/vue-cli/issues might be a good step, in order to start talking to the right people?

Depending on your situation – which we know very little about, you could also try to fork @vue/cli-service and use an updated version of webpack from that fork.

(But for this thread, the current situation still is: At this point, from the node-gyp point of view we can’t really do anything anymore besides what we have done.)

-Original file line number
+Diff line change
@@ Expand Up / @@ -31,7 +31,7 @@ @@
         "request": "^2.87.0",
         "rimraf": "2",
         "semver": "~5.3.0",
-        "tar": "^3.1.3",
+        "tar": "^4.4.8",
         "which": "1"
       },
       "engines": {
@@ Expand Down @@

Commit

There are no files selected for viewing

65 comments on commit 1456ef2

ogensec commented on 1456ef2 Apr 15, 2019

Choose a reason for hiding this comment

hykw commented on 1456ef2 Apr 15, 2019

Choose a reason for hiding this comment

ogensec commented on 1456ef2 Apr 15, 2019

Choose a reason for hiding this comment

jhnferraris commented on 1456ef2 Apr 15, 2019 • edited Loading

Choose a reason for hiding this comment

giamir commented on 1456ef2 Apr 15, 2019

Choose a reason for hiding this comment

ram-you commented on 1456ef2 Apr 15, 2019

Choose a reason for hiding this comment

pieron187 commented on 1456ef2 Apr 15, 2019

Choose a reason for hiding this comment

C-odes commented on 1456ef2 Apr 15, 2019

Choose a reason for hiding this comment

tzanis commented on 1456ef2 Apr 16, 2019

Choose a reason for hiding this comment

aittomakia commented on 1456ef2 Apr 16, 2019

Choose a reason for hiding this comment

davidhbrown commented on 1456ef2 Apr 17, 2019

Choose a reason for hiding this comment

francoismassart commented on 1456ef2 Apr 17, 2019

Choose a reason for hiding this comment

pchoudhary-drg commented on 1456ef2 Apr 17, 2019

Choose a reason for hiding this comment

I-keep-trying commented on 1456ef2 Apr 17, 2019

Choose a reason for hiding this comment

FredPell83 commented on 1456ef2 Apr 17, 2019

Choose a reason for hiding this comment

romerocs commented on 1456ef2 Apr 17, 2019

Choose a reason for hiding this comment

romanstingler commented on 1456ef2 Apr 17, 2019 • edited Loading

Choose a reason for hiding this comment

pandukovur commented on 1456ef2 Apr 17, 2019 • edited Loading

Choose a reason for hiding this comment

evanhooff commented on 1456ef2 Apr 18, 2019

Choose a reason for hiding this comment

jhnferraris commented on 1456ef2 Apr 18, 2019

Choose a reason for hiding this comment

jhnferraris commented on 1456ef2 Apr 18, 2019 • edited Loading

Choose a reason for hiding this comment

purplelady105 commented on 1456ef2 Apr 18, 2019

Choose a reason for hiding this comment

samabp commented on 1456ef2 Apr 19, 2019 • edited Loading

Choose a reason for hiding this comment

tkrebs2 commented on 1456ef2 Apr 19, 2019

Choose a reason for hiding this comment

onx2 commented on 1456ef2 Apr 20, 2019

Choose a reason for hiding this comment

aayush420 commented on 1456ef2 Apr 20, 2019

Choose a reason for hiding this comment

omarmok commented on 1456ef2 Apr 22, 2019

Choose a reason for hiding this comment

suits-at commented on 1456ef2 Apr 22, 2019

Choose a reason for hiding this comment

mtzrmzia commented on 1456ef2 Apr 22, 2019 • edited Loading

Choose a reason for hiding this comment

NaturalDevCR commented on 1456ef2 Apr 22, 2019

Choose a reason for hiding this comment

felipecalvo commented on 1456ef2 Apr 22, 2019

Choose a reason for hiding this comment

sportgirl commented on 1456ef2 Apr 23, 2019

Choose a reason for hiding this comment

domic6300 commented on 1456ef2 Apr 24, 2019

Choose a reason for hiding this comment

abadilah1 commented on 1456ef2 Apr 24, 2019

Choose a reason for hiding this comment

mikern12 commented on 1456ef2 Apr 24, 2019

Choose a reason for hiding this comment

marcovalentin commented on 1456ef2 Apr 24, 2019

Choose a reason for hiding this comment

mikern12 commented on 1456ef2 Apr 24, 2019

Choose a reason for hiding this comment

RandomErrorMessage commented on 1456ef2 Apr 24, 2019

Choose a reason for hiding this comment

MartCube commented on 1456ef2 Apr 25, 2019

65 comments on commit `1456ef2`

ogensec commented on `1456ef2` Apr 15, 2019

hykw commented on `1456ef2` Apr 15, 2019

ogensec commented on `1456ef2` Apr 15, 2019

jhnferraris commented on `1456ef2` Apr 15, 2019 •

edited

Loading

giamir commented on `1456ef2` Apr 15, 2019

ram-you commented on `1456ef2` Apr 15, 2019

pieron187 commented on `1456ef2` Apr 15, 2019

C-odes commented on `1456ef2` Apr 15, 2019

tzanis commented on `1456ef2` Apr 16, 2019

aittomakia commented on `1456ef2` Apr 16, 2019

davidhbrown commented on `1456ef2` Apr 17, 2019

francoismassart commented on `1456ef2` Apr 17, 2019

pchoudhary-drg commented on `1456ef2` Apr 17, 2019

I-keep-trying commented on `1456ef2` Apr 17, 2019

FredPell83 commented on `1456ef2` Apr 17, 2019

romerocs commented on `1456ef2` Apr 17, 2019

romanstingler commented on `1456ef2` Apr 17, 2019 •

edited

Loading

pandukovur commented on `1456ef2` Apr 17, 2019 •

edited

Loading

evanhooff commented on `1456ef2` Apr 18, 2019

jhnferraris commented on `1456ef2` Apr 18, 2019

jhnferraris commented on `1456ef2` Apr 18, 2019 •

edited

Loading

purplelady105 commented on `1456ef2` Apr 18, 2019

samabp commented on `1456ef2` Apr 19, 2019 •

edited

Loading

tkrebs2 commented on `1456ef2` Apr 19, 2019

onx2 commented on `1456ef2` Apr 20, 2019

aayush420 commented on `1456ef2` Apr 20, 2019

omarmok commented on `1456ef2` Apr 22, 2019

suits-at commented on `1456ef2` Apr 22, 2019

mtzrmzia commented on `1456ef2` Apr 22, 2019 •

edited

Loading

NaturalDevCR commented on `1456ef2` Apr 22, 2019

felipecalvo commented on `1456ef2` Apr 22, 2019

sportgirl commented on `1456ef2` Apr 23, 2019

domic6300 commented on `1456ef2` Apr 24, 2019

abadilah1 commented on `1456ef2` Apr 24, 2019

mikern12 commented on `1456ef2` Apr 24, 2019

marcovalentin commented on `1456ef2` Apr 24, 2019

mikern12 commented on `1456ef2` Apr 24, 2019

RandomErrorMessage commented on `1456ef2` Apr 24, 2019

MartCube commented on `1456ef2` Apr 25, 2019

aayush420 commented on `1456ef2` Apr 25, 2019 via email

LaurelineP commented on `1456ef2` Apr 26, 2019

gontranbezerra commented on `1456ef2` Apr 27, 2019

gigi206 commented on `1456ef2` Apr 27, 2019

Morb0 commented on `1456ef2` Apr 29, 2019

Lucas-Marchand commented on `1456ef2` Apr 30, 2019

Lucas13600 commented on `1456ef2` Apr 30, 2019

morgantkb commented on `1456ef2` Apr 30, 2019

jamilservicos commented on `1456ef2` May 1, 2019

purplelady105 commented on `1456ef2` May 1, 2019

Lucas13600 commented on `1456ef2` May 2, 2019 •

edited

Loading

tomrcht commented on `1456ef2` May 3, 2019

Lucas13600 commented on `1456ef2` May 13, 2019

ogensec commented on `1456ef2` May 26, 2019

addaleax commented on `1456ef2` May 26, 2019

ogensec commented on `1456ef2` May 26, 2019 •

edited

Loading

addaleax commented on `1456ef2` May 26, 2019

ogensec commented on `1456ef2` May 26, 2019 via email •

edited

Loading

aayush420 commented on `1456ef2` May 26, 2019 via email

addaleax commented on `1456ef2` May 26, 2019