Fix multiple CVEs by updating node-tar to patched version - #774
Conversation
|
Click here to review and test in web IDE: |
&message=Dev%20cluster%20(for%20maintainers)&logo=eclipseche&color=525C86&labelColor=FDB940)
Fixes the following node-tar vulnerabilities across all 4 manifests (code/, code/remote/, code/build/npm/gyp/, code/extensions/copilot/): - CVE-2026-23745: Arbitrary File Overwrite (fixed in 7.5.3) - CVE-2026-23950: Race Condition via Unicode (fixed in 7.5.4) - CVE-2026-24842: Hardlink Arbitrary File Creation (fixed in 7.5.7) - CVE-2026-26960: Hardlink Target Escape (fixed in 7.5.8) - CVE-2026-29786: Hardlink Path Traversal (fixed in 7.5.10) - CVE-2026-31802: Symlink Path Traversal (fixed in 7.5.11) - CVE-2026-53655: PAX size override (fixed in 7.5.16) - CVE-2026-59875: Uncaught Exception DoS via NUL byte (fixed in 7.5.17) - CVE-2026-59874: Negative entry size infinite loop (fixed in 7.5.18) - CVE-2026-59871: Process crash via PAX numeric path (fixed in 7.5.18) - CVE-2026-59873: Decompression/parse DoS (fixed in 7.5.19) - GHSA-r292-9mhp-454m: Uncontrolled recursion DoS (fixed in 7.5.21) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
The tar override in code/extensions/copilot/package.json is redundant since tar is already a direct devDependency pinned to ^7.5.22. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-774-amd64 |
3 similar comments
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-774-amd64 |
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-774-amd64 |
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-774-amd64 |
1 participant
What does this PR do?
This PR fixes CVE-2026-59874 and CVE-2026-59873
node-tarversion is updated to7.5.22What issues does this PR fix?
https://redhat.atlassian.net/browse/CRW-11759
https://redhat.atlassian.net/browse/CRW-11762
How to test this PR?
Does this PR contain changes that override default upstream Code-OSS behavior?
git rebasewere added to the .rebase folder