[Docs]: list of false-postive CVEs (handlebars, etc)
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 42/100
- Issue type
- Documentation
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- handlebars, vscode
- Domain
- documentation, security
Research direction
Start by reviewing code-server/lib/code-server-4.13.0/lib/vscode/extensions/handlebars/package.json and the reported CVEs cve-2019-19919, cve-2021-23369, and cve-2021-23383. Compare the component identified by Trivy with the npm handlebars package and determine whether the findings apply to the VS Code plugin. Done means the false-positive status is confirmed and the affected CVEs are documented for security teams.
Written by the indexing model from the issue text.
Description
What is your suggestion?
We evaluate coder in a high security offline environment. For that, we scanned our workspace image with code-server preinstalled with trivy. There were crititcal CVEs found but we think that they are false positives. Can you please confirm that? This could be added to the docs too.
We found the handlebars CVEs cve-2019-19919, cve-2021-23369, cve-2021-23383 in code-server/lib/code-server-4.13.0/lib/vscode/extensions/handlebars/package.json
We think that Trivy is misled by the name of this component and thinks that it refers to handlebars on npm and not to the vs-code plugin with the same name.
How will this improve the docs?
Security-oriented teams like us will benefit from that because they can forward the false-positive list to their security team to still get the permission to use the software.
Can you confirm that CVEs are false-positives, so that we can forward that to the security team responsible for us?
- Dominant language
- TypeScript
- Stars
- 79.4k
- Forks
- 6.9k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 39
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from coder/code-server
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
coder/code-server#8017 · 2 comments ·
-
security
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
coder/code-server#8013 · 4 comments ·
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 35/100
coder/code-server#7976 · 2 comments ·
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 35/100
coder/code-server#7962 · 3 comments ·
-
bug needs-investigation
Difficulty 4/5 3-5 days Newbie friendliness 55/100
coder/code-server#7955 · 1 comment ·
All issues in coder/code-server
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
vercel-labs/just-bash#464 ·
-
looksLikeSlug() is ASCII-only, so non-Latin entity slugs (e.g. Korean) skip exact match and collapse Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
TanStack/tanstack.com#1293 ·