Description
One of the code-server community members reached out asking if we could update the node version in code-server to 14.17.2 to fix a couple security vulnerabilities in 14.17.1
Original message:
My team is using code-server in our work and in doing a scan for vulnerabilities, we noticed that the most recent release of code-server updated the node version to 14.17.1. This resolved a lot of high severity vulnerabilities, but in doing a snyk.io scan, it detected two more high severity vulnerabilities that are resolved in Node v14.17.2.Output from docker scan via snyk.io:
✗ High severity vulnerability found in node
Description: Privilege Escalation
Info: https://snyk.io/vuln/SNYK-UPSTREAM-NODE-1315789
Introduced through: [email protected]
From: [email protected]
Fixed in: 14.17.2✗ High severity vulnerability found in node
Description: Out-of-bounds Read
Info: https://snyk.io/vuln/SNYK-UPSTREAM-NODE-1315790
Introduced through: [email protected]
From: [email protected]
Fixed in: 14.17.2In the interim, we're fine to use a fork that's bumped the version of Node, but figured it might be worth doing in the source repo as well given it would only mean doing a patch-version bump.