Bug 2218888

Summary: Clarification about PRISMA-2023-0054
Product: Red Hat Enterprise Linux 8 Reporter: Paulo Andrade <pandrade>
Component: nodejs-18-containerAssignee: Node.js maintainers <nodejs-maint>
Status: CLOSED NOTABUG QA Contact: rhscl image testing <rhscl-container-qe>
Severity: medium Docs Contact: Lenka Špačková <lkuprova>
Priority: unspecified    
Version: 8.7CC: midawson, pkubat
Target Milestone: rc   
Target Release: ---   
Hardware: alpha   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-07-07 08:24:06 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
twistlock.png none

Description Paulo Andrade 2023-06-30 12:50:13 UTC 
Created attachment 1973402 [details]
twistlock.png

User noticed Twistlock logs claim nodejs 18 is affected by issue
as shown in the attached file.

  Checking what should be related patch
https://github.com/nodejs/node/pull/47335/commits/84ad3bc7b8ddbe57a718ea1467a21f48a3505619
it does not apply to nodejs 18, and in comment
https://github.com/nodejs/node/pull/47335#issuecomment-1593912485
it appears to make it clear the issue does not apply to nodejs 18,
as it is a nodejs 20 feature.

  Can you please confirm the log is incorrect?

  Actual software in use is

UBI_BASE_IMAGE="registry.access.redhat.com/ubi8/nodejs-18-minimal"
ubi image nodejs-18-minimal
Comment 1 Petr Kubat 2023-06-30 13:08:28 UTC 
Michael, can you take a look to confirm node 18 is not affected?
Comment 2 Michael Dawson 2023-07-04 14:24:42 UTC 
Taking a look this, the code in question never made it into any official release. The permissions model was only release in 20.x and the deny api was removed before that release. Therefore it does not affect 18.x since it does not include the permission model. Note it also does not affect 20.x since it was not part of the initial release of the permission model as well.
Comment 3 Petr Kubat 2023-07-07 08:24:06 UTC 
Thanks! Closing this bug then.