Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1824523

Summary:	cockpit is affected by multiple CVEs
Product:	[oVirt] cockpit-ovirt	Reporter:	Gal Zaidman <gzaidman>
Component:	Generic	Assignee:	Aviv Turgeman <aturgema>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Wei Wang <weiwang>
Severity:	medium	Docs Contact:
Priority:	high
Version:	0.14.3	CC:	bugs, cshao, eslutsky, lsvaty, mavital, michal.skrivanek, nlevy, peyu, qiyuan, sbonazzo, shlei, weiwang, yaniwang, yturgema
Target Milestone:	ovirt-4.4.0	Keywords:	Rebase
Target Release:	---	Flags:	michal.skrivanek: ovirt-4.4? sbonazzo: planning_ack? sbonazzo: devel_ack+ weiwang: testing_ack+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ovirt-engine-nodejs-modules-2.0.27-1 ,cockpit-ovirt-0.14.6	Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-05-20 20:00:38 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	Integration	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Gal Zaidman 2020-04-16 10:25:35 UTC

Github sent an CVE alert on the following:
* Upgrade minimist to version 1.2.3 or later
* Upgrade acorn to version 6.4.1 or later
* Upgrade kind-of to version 6.0.3 or later

to fix it you need to:
1. cd to dashboard dir
2. run "yarn update"
3. create patches:
cockpit-ovirt:  https://gerrit.ovirt.org/#/c/105504/
ovirt-engine-nodejs-modules : https://gerrit.ovirt.org/#/c/106388/

IMPORTANT
This is an indirect dep, the package which gets installed at the end are the good packages.
yarn lock file just needs an update so that github will not complain.

Comment 2 Michal Skrivanek 2020-04-17 06:27:39 UTC

sharon's addressing that in nodejs-modules. check with her, it may need just a rebuild then

Comment 5 Sandro Bonazzola 2020-05-20 20:00:38 UTC

This bugzilla is included in oVirt 4.4.0 release, published on May 20th 2020.

Since the problem described in this bug report should be
resolved in oVirt 4.4.0 release, it has been closed with a resolution of CURRENT RELEASE.

If the solution does not work for you, please open a new bug report.