Security vulnerability: hoek (CVE-2018-3728)

[DanielMSchmidt]

Bug / Security vulnerability

jest-environment-jsdom has a dependency to jsdom which is dependant on request which is dependant on hawk which is dependant on hoek in the version 4.2.1. As described in CVE-2018-3728 there is a security problem before version 5.0.3 of hoek. hawk in version 7.X uses hoek in 5.X, request needs to be updated to use hawk in version 7.X instead of ~6.0.2. As jsdom does not pin it's dependencies, jest-environment-jsdom should get the update automatically after the issue is resolved, so no action required, as I understand it.

Associated issues

• request updating hawk: first issue & second issue

I hope it's okay that I leave this ticket here for others who got notified about this vulnerability. Will close it once there is a way to update hoek by reinstalling the dependencies.

[SimenB]

Since Jest (and JSDOM) is only used in tests, this doesn't really impact us. I'm fine with it being open, if nothing else to discourage more issues, though

[DanielMSchmidt]

I agree, jest is not really affected by the security issue. Only github users by the securtiy checks 🙈

[jfoclpf]

@SimenB and @DanielMSchmidt

newbie question, but why not just updating the package hawk@7.0.7?

└─┬ request@2.85.0
  └─┬ hawk@6.0.2
    ├─┬ boom@4.3.1
    │ └── hoek@4.2.1 
    ├─┬ cryptiles@3.1.2
    │ └─┬ boom@5.2.0
    │   └── hoek@4.2.1 
    ├── hoek@4.2.1 
    └─┬ sntp@2.1.0
      └── hoek@4.2.1 

this github warning about vulnerabilities in hoek@4.2.1 is really annoying.
thanks :)

[SimenB]

This is not an issue with Jest.

We can keep this issue open for visibility, but it is not actionable for us.

[SimenB]

Update: request/request#2926 (comment)

version 4.2.1 has been patched. github's alerts are currently wrong. i've submitted a request to correct the version range in the CVE

[github-actions]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.
Please note this issue tracker is not a help forum. We recommend using StackOverflow or our discord channel for questions.