[CVE-2024-33883] Bump ejs from `3.1.7` to `3.1.10` #6770

ananzh · 2024-05-10T22:26:21Z

Issue Resolved

#6769

Changelog

security: [CVE-2024-33883] Bump ejs from 3.1.7 to 3.1.10

Check List

All tests pass
- yarn test:jest
- yarn test:jest_integration
New functionality includes testing.
New functionality has been documented.
Update CHANGELOG.md
Commits are signed per the DCO using --signoff

codecov · 2024-05-10T22:41:49Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 55.12%. Comparing base (8d50974) to head (02a3799).
Report is 13 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #6770       +/-   ##
===========================================
- Coverage   67.38%   55.12%   -12.27%     
===========================================
  Files        3443     1204     -2239     
  Lines       67795    24625    -43170     
  Branches    11032     4168     -6864     
===========================================
- Hits        45683    13574    -32109     
+ Misses      19440    10400     -9040     
+ Partials     2672      651     -2021

Flag	Coverage Δ
Linux_1	`?`
Linux_2	`55.12% <ø> (ø)`
Linux_3	`?`
Linux_4	`?`
Windows_1	`?`
Windows_2	`?`
Windows_3	`?`
Windows_4	`?`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

virajsanghvi

Approving as 3.1.101 doesn't seem to exist and lint errors seem unrelated...

virajsanghvi · 2024-05-15T17:43:01Z

packages/osd-plugin-generator/package.json

@@ -11,7 +11,7 @@
  "dependencies": {
    "@osd/cross-platform": "1.0.0",
    "@osd/dev-utils": "1.0.0",
-    "ejs": "^3.1.7",
+    "ejs": "^3.1.10",


I'm assuming the title should be update to 3.1.10 instead of 3.1.101?

Yes. 1 should be `. Will correct it and thank you for the careful check.

virajsanghvi

Requesting change to accurate version

virajsanghvi · 2024-05-15T17:44:49Z

changelogs/fragments/6770.yml

@@ -0,0 +1,2 @@
+security:
+- [CVE-2024-33883] Bump ejs from `3.1.7` to `3.1.101 ([#6770](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/6770))


Should this be 3.1.10?

Yes. 1 should be `. Will correct it and thank you for the careful check.

Issue Resolved opensearch-project#6769 Signed-off-by: Anan Zhuang <ananzh@amazon.com>

bandinib-amzn · 2024-05-28T18:50:13Z

packages/osd-plugin-generator/package.json

@@ -11,7 +11,7 @@
  "dependencies": {
    "@osd/cross-platform": "1.0.0",
    "@osd/dev-utils": "1.0.0",
-    "ejs": "^3.1.7",
+    "ejs": "^3.1.10",


ananzh · 2024-06-03T15:17:05Z

@bandinib-amzn @virajsanghvi I corrected the typo. Could you two help me to re-check this fix?

opensearch-trigger-bot · 2024-06-04T16:16:03Z

The backport to 2.x failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repository
cd $(git rev-parse --show-toplevel)
# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/OpenSearch-Dashboards/backport-2.x 2.x
# Navigate to the new working tree
pushd ../.worktrees/OpenSearch-Dashboards/backport-2.x
# Create a new branch
git switch --create backport/backport-6770-to-2.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 016dcfd82bb93ca3e64d4eaf54d9a34795c02891
# Push it to GitHub
git push --set-upstream origin backport/backport-6770-to-2.x
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/OpenSearch-Dashboards/backport-2.x

Then, create a pull request where the base branch is 2.x and the compare/head branch is backport/backport-6770-to-2.x.

opensearch-trigger-bot · 2024-06-05T05:07:26Z

The backport to 2.x failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repository
cd $(git rev-parse --show-toplevel)
# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/OpenSearch-Dashboards/backport-2.x 2.x
# Navigate to the new working tree
pushd ../.worktrees/OpenSearch-Dashboards/backport-2.x
# Create a new branch
git switch --create backport/backport-6770-to-2.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 016dcfd82bb93ca3e64d4eaf54d9a34795c02891
# Push it to GitHub
git push --set-upstream origin backport/backport-6770-to-2.x
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/OpenSearch-Dashboards/backport-2.x

Then, create a pull request where the base branch is 2.x and the compare/head branch is backport/backport-6770-to-2.x.

Backport PR opensearch-project#6770 Issue Resolved opensearch-project#6769 Signed-off-by: Anan Zhuang <ananzh@amazon.com>

…6924) Backport PR #6770 Issue Resolved #6769 Signed-off-by: Anan Zhuang <ananzh@amazon.com>

BionIT · 2024-06-05T23:17:49Z

Thanks @ananzh ! Found we have a manual backport #6924, thus removed the failed backport label

ananzh requested review from kavilla, AMoo-Miki, ashwin-pc, joshuarrrr, abbyhu2000, zengyan-amazon, zhongnansu, manasvinibs, ZilongX, Flyingliuhub, curq, bandinib-amzn, SuZhou-Joe, ruanyl, BionIT and xinruiba as code owners May 10, 2024 22:26

github-actions bot added the distinguished-contributor label May 10, 2024

opensearch-changeset-bot bot added a commit to ananzh/OpenSearch-Dashboards that referenced this pull request May 10, 2024

Changeset file for PR opensearch-project#6770 created/updated

cb7ea5a

virajsanghvi approved these changes May 15, 2024

View reviewed changes

virajsanghvi requested changes May 15, 2024

View reviewed changes

yujin-emma assigned bandinib-amzn May 28, 2024

ananzh and others added 2 commits May 28, 2024 11:49

[CVE-2024-33883] Bump ejs from to

9e43c7b

Issue Resolved opensearch-project#6769 Signed-off-by: Anan Zhuang <ananzh@amazon.com>

Changeset file for PR opensearch-project#6770 created/updated

336799b

bandinib-amzn force-pushed the cve-6769 branch from cb7ea5a to 336799b Compare May 28, 2024 18:49

bandinib-amzn requested review from zhyuanqi and mengweieric as code owners May 28, 2024 18:49

bandinib-amzn requested changes May 28, 2024

View reviewed changes

ananzh changed the title ~~[CVE-2024-33883] Bump ejs from 3.1.7 to `3.1.101~~ [CVE-2024-33883] Bump ejs from 3.1.7 to 3.1.101 Jun 3, 2024

Changeset file for PR opensearch-project#6770 created/updated

561577f

Changeset file for PR opensearch-project#6770 created/updated

0b2ff19

ananzh changed the title ~~[CVE-2024-33883] Bump ejs from 3.1.7 to 3.1.101~~ [CVE-2024-33883] Bump ejs from 3.1.7 to 3.1.10 Jun 3, 2024

opensearch-changeset-bot bot added 2 commits June 3, 2024 15:14

Changeset file for PR opensearch-project#6770 created/updated

34b35f3

Changeset file for PR opensearch-project#6770 created/updated

02a3799

virajsanghvi approved these changes Jun 3, 2024

View reviewed changes

bandinib-amzn approved these changes Jun 3, 2024

View reviewed changes

manasvinibs approved these changes Jun 3, 2024

View reviewed changes

abbyhu2000 approved these changes Jun 3, 2024

View reviewed changes

ananzh added cve Security vulnerabilities detected by Dependabot or Mend backport 2.x v2.15.0 labels Jun 4, 2024

ananzh merged commit 016dcfd into opensearch-project:main Jun 4, 2024
72 of 73 checks passed

opensearch-trigger-bot bot added the failed backport label Jun 4, 2024

bandinib-amzn mentioned this pull request Jun 4, 2024

Bump ejs from 3.1.7 to 3.1.10 #6698

Closed

ananzh mentioned this pull request Jun 4, 2024

Bump tar from 6.1.13 to 6.2.1 #6492

Merged

7 tasks

BionIT added backport 2.x and removed backport 2.x failed backport labels Jun 5, 2024

opensearch-trigger-bot bot added the failed backport label Jun 5, 2024

ananzh mentioned this pull request Jun 5, 2024

[2.x Manual Backport][CVE-2024-33883] Bump ejs from 3.1.7 to 3.1.10 #6924

Merged

7 tasks

BionIT pushed a commit that referenced this pull request Jun 5, 2024

[2.x Manual Backport][CVE-2024-33883] Bump ejs from 3.1.7 to 3.1.10 (#…

f06b6aa

…6924) Backport PR #6770 Issue Resolved #6769 Signed-off-by: Anan Zhuang <ananzh@amazon.com>

BionIT removed the failed backport label Jun 5, 2024

ananzh mentioned this pull request Jun 7, 2024

[Meta][2.15 Release] OpenSearch Dashboards Visualization+Discover+CVEs+Maintenance PRs sign-off #6962

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[CVE-2024-33883] Bump ejs from `3.1.7` to `3.1.10` #6770

[CVE-2024-33883] Bump ejs from `3.1.7` to `3.1.10` #6770

ananzh commented May 10, 2024 •

edited

Loading

codecov bot commented May 10, 2024 •

edited

Loading

virajsanghvi left a comment

virajsanghvi May 15, 2024

bandinib-amzn May 28, 2024

ananzh Jun 3, 2024

virajsanghvi left a comment

virajsanghvi May 15, 2024

ananzh Jun 3, 2024

bandinib-amzn May 28, 2024

ananzh commented Jun 3, 2024

opensearch-trigger-bot bot commented Jun 4, 2024

opensearch-trigger-bot bot commented Jun 5, 2024

BionIT commented Jun 5, 2024

		@@ -0,0 +1,2 @@
		security:
		- [CVE-2024-33883] Bump ejs from `3.1.7` to `3.1.101 ([#6770](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/6770))

[CVE-2024-33883] Bump ejs from 3.1.7 to 3.1.10 #6770

[CVE-2024-33883] Bump ejs from 3.1.7 to 3.1.10 #6770

Conversation

ananzh commented May 10, 2024 • edited Loading

Issue Resolved

Changelog

Check List

codecov bot commented May 10, 2024 • edited Loading

Codecov Report

virajsanghvi left a comment

Choose a reason for hiding this comment

virajsanghvi May 15, 2024

Choose a reason for hiding this comment

bandinib-amzn May 28, 2024

Choose a reason for hiding this comment

ananzh Jun 3, 2024

Choose a reason for hiding this comment

virajsanghvi left a comment

Choose a reason for hiding this comment

virajsanghvi May 15, 2024

Choose a reason for hiding this comment

ananzh Jun 3, 2024

Choose a reason for hiding this comment

bandinib-amzn May 28, 2024

Choose a reason for hiding this comment

ananzh commented Jun 3, 2024

opensearch-trigger-bot bot commented Jun 4, 2024

opensearch-trigger-bot bot commented Jun 5, 2024

BionIT commented Jun 5, 2024

[CVE-2024-33883] Bump ejs from `3.1.7` to `3.1.10` #6770

[CVE-2024-33883] Bump ejs from `3.1.7` to `3.1.10` #6770

ananzh commented May 10, 2024 •

edited

Loading

codecov bot commented May 10, 2024 •

edited

Loading