[Security] cli-columns and cli-table3 have dependencies to vulnerable packages

Is there an existing issue for this?

I have searched the existing issues

Current Behavior

Security scans fail do to high warning of a security vulnerability in ansi-regex.

Expected Behavior

Security scan pass.

Steps To Reproduce

We use twistlock to do vulnerability detection, which relies on NVD to get vulnerability data.

The issue can be found here, https://nvd.nist.gov/vuln/detail/CVE-2021-3807 and here, https://snyk.io/vuln/npm:ansi-regex.

Environment

OS: Mac 11.5.2
Node: v12.21.0
npm: 7.21.1

Also running into this same issue. Looking at the attached PR will this issue not be addressed until version 8 since cli-columns doesn't support Node 10?

Also ran into this due to npm itself being dependent on it. Decided to add it to the CVE ignore list after confirming no other occurrences of the vulnerable issue

Note that the ansi-regex upstream PR and commit for CVE-2021-3807 are:

chalk/ansi-regex#37
chalk/ansi-regex@8d1d7cd

Also note that versions 3.0.0 - 5.0.0 and 6.0.0 are affected, issue was fixed in 5.0.1 and 6.0.1.

This report mentions ansi-regex version as bundled with current npm version 7, 8, and latest. However, version 6, that is bundled with current nodejs versions, has even more copies of ansi-regex. Here is the current status:

latest and v8.0.0:
./node_modules/string-width/node_modules/ansi-regex/package.json: "version": "3.0.0", -- affected
./node_modules/ansi-regex/package.json: "version": "2.1.1", -- notaffected
./node_modules/cli-table3/node_modules/ansi-regex/package.json: "version": "5.0.0", -- affected
./node_modules/cli-columns/node_modules/ansi-regex/package.json: "version": "5.0.1", -- fixed

v7.24.2:
./node_modules/string-width/node_modules/ansi-regex/package.json: "version": "3.0.0", -- affected
./node_modules/ansi-regex/package.json: "version": "2.1.1", -- notaffected
./node_modules/cli-table3/node_modules/ansi-regex/package.json: "version": "5.0.0", -- affected

v6.14.15
./node_modules/wrap-ansi/node_modules/ansi-regex/package.json: "version": "4.1.0" -- affected
./node_modules/string-width/node_modules/ansi-regex/package.json: "version": "3.0.0" -- affected
./node_modules/ansi-regex/package.json: "version": "2.1.1", -- notaffected
./node_modules/yargs/node_modules/ansi-regex/package.json: "version": "4.1.0" -- affected
./node_modules/cliui/node_modules/ansi-regex/package.json: "version": "4.1.0" -- affected

The above covers versions that can be found in the respective git tags or branches.

Is there any plan to fix this in npm v6 ?

Hello,
Following this bug report: nodejs/docker-node#1574 (comment)

npm 8.1.0 continues to install vulnerable versions of ansi-regex package - namely, @5.0.0, @2.1.1, and @3.0.0 - which results in the base Docker image being flagged by container security software.

Would it be possible to upgrade all dependencies to use ansi-regex@5.0.1?
Thanks!

Hello,
We got same issue,too.
nodejs team asked us to open issue here.
nodejs/node#40853
Thanks a lot.

Hello Team,

Can you please upgrade npm to use fixed ansi-regex?
Also, kindly inform if any timelines are there for this?

Thanks,
Khushboo Soni
VMware

We got same issue.

Same here with using base docker image node:16-alpine

Hi npm Team,

Kindly let us know the timeline for fixing this issue.

Thanks,
Omkar
Oracle

Giving this another bump as this issue is persisting in our CI pipeline's security scan. Any attention to fixing this will make a lot of people happy ❤️

PS. We use trivy for our security scans

For anyone blocked by this issue. Don't use NPM in your final container image.

Here is an example of Dockefile with multistage build based on Alpine:

# Build stage
FROM node:16-alpine3.15 as build

# Install dependencies
WORKDIR /
COPY package-lock.json .
COPY package.json .
RUN npm ci --production

# Final stage
FROM alpine:3.15 as final

# Upgrade APK and install nodejs
RUN apk --no-cache add --upgrade nodejs~16

# Setup application
RUN mkdir -p /app/simple-server
WORKDIR /app/simple-server
COPY . .
COPY --from=build node_modules node_modules

# Run App
ENTRYPOINT ["node", "index.js"]

This will make your scanners happy 😊

For anyone blocked by this issue. Don't use NPM in your final container image.

We ended up uninstalling npm from the final image:

# Don't need npm during runtime
RUN npm uninstall npm -g

@hi-artem

@hi-artem Thanks, this is the solution we've opted for

It would be good to see high vulnerabilities in NPM fixed in a timely fashion, whether or not some deployments can hack NPM out of the equation.

@MartinFalatic

@MartinFalatic "a CVE exists" does not mean "a vulnerability exists". Most CVEs are false positives, and unless these vulnerabilities are exploitable via npm, it's not actually a vulnerability.

An actual vulnerability is a concern - a false positive CVE warning should not be. (i'm not making any assertions about these CVEs/vulnerabilities specifically, just speaking in general terms)

@MartinFalatic

@MartinFalatic the thing here is how often do you need to have NPM in your final image? IHMO it is not a hack to remove it, but a good practice of not installing development dependencies in your production environment. NPM itself is the development dependency.

@lukekarrys

Closed in v8.5.2 thanks @lukekarrys

I have verified that updating globally to the latest npm version (v8.5.4) on the Dockerfile also does the trick. The security vulnerabilities disappeared.

FROM node:16-alpine3.15
...
RUN npm -g npm@8.5.4
...

@wraithgar

@wraithgar Is it possible to backport it to version 6.x?

@wraithgar

The earlier assessments of fix incompatibility with npm 6 are probably no longer true, as the fixed ansi-regex is in npm@6.14.17 via yargs@14.2.3/cliui@5.0.0

npm@6.14.17 
├─┬ libnpx@10.2.4
│ └─┬ yargs@14.2.3
│   ├─┬ cliui@5.0.0
│   │ ├─┬ string-width@3.1.0
│   │ │ ├── emoji-regex@7.0.3 deduped
│   │ │ ├── is-fullwidth-code-point@2.0.0
│   │ │ └── strip-ansi@5.2.0 deduped
│   │ ├─┬ strip-ansi@5.2.0
│   │ │ └── ansi-regex@4.1.1
│   │ └─┬ wrap-ansi@5.1.0
│   │   ├── ansi-styles@3.2.1 deduped
│   │   ├─┬ string-width@3.1.0
│   │   │ ├── emoji-regex@7.0.3 deduped
│   │   │ ├── is-fullwidth-code-point@2.0.0
│   │   │ └── strip-ansi@5.2.0 deduped
│   │   └─┬ strip-ansi@5.2.0
│   │     └── ansi-regex@4.1.1

so we just need to upgrade cli-columns to version with strip-ansi@5

├─┬ cli-columns@3.1.2
│ ├─┬ string-width@2.1.1
│ │ ├── is-fullwidth-code-point@2.0.0
│ │ └─┬ strip-ansi@4.0.0
│ │   └── ansi-regex@3.0.0
│ └─┬ strip-ansi@3.0.1
│   └── ansi-regex@2.1.1

@wraithgar @Izook do you agree? Thanks!

Navigation Menu

Repository navigation

[Security] cli-columns and cli-table3 have dependencies to vulnerable packages #3785

Is there an existing issue for this?

Current Behavior

Expected Behavior

Steps To Reproduce

Environment

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Security] cli-columns and cli-table3 have dependencies to vulnerable packages #3785

Description

Is there an existing issue for this?

Current Behavior

Expected Behavior

Steps To Reproduce

Environment

Activity

Izook commented on Oct 7, 2021

ckcr4lyf commented on Oct 7, 2021

thoger commented on Oct 13, 2021

panayiod44 commented on Oct 18, 2021

f2404 commented on Nov 8, 2021

guomeng306 commented on Nov 22, 2021

skhushboo-vm commented on Nov 23, 2021

psandeep09 commented on Nov 24, 2021

dennismeister93 commented on Nov 26, 2021

dmce2009 commented on Dec 17, 2021

nachtwerk commented on Jan 4, 2022

hi-artem commented on Jan 6, 2022

f2404 commented on Jan 6, 2022

nachtwerk commented on Jan 6, 2022

MartinFalatic commented on Jan 6, 2022

ljharb commented on Jan 6, 2022

hi-artem commented on Jan 6, 2022

wraithgar commented on Mar 9, 2022

franher commented on Mar 15, 2022

vanta commented on Aug 17, 2022

c3ivodujmovic commented on Sep 15, 2022

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions