Outdated and vulnerable versions of Javascript libraries

[Martin Ivanov]

One or more vulnerabilities were reported for few outdated version of the Javascript libraries, used by horizon.
Suggestion is to upgrade to the latest version.

 /dashboard/static/dashboard/js/5508d0ed7005.js
 /dashboard/static/horizon/lib/jquery/jquery.js
 /dashboard/static/horizon/lib/jquery/jquery.min.js
 /dashboard/static/horizon/lib/jquery_migrate/jquery-migrate.js
 /dashboard/static/horizon/lib/jquery_migrate/jquery-migrate.min.js
 /dashboard/static/horizon/lib/jquery_ui/ui/jquery-ui.js
 /dashboard/static/horizon/lib/jquery_ui/ui/jquery.ui.dialog.js
 /dashboard/static/horizon/lib/jquery_ui/ui/minified/jquery-ui.min.js

[Tristan Cacqueray (tristan-cacqueray)]

Since this report concerns a possible security risk, an incomplete security advisory task has been added while the core security reviewers for the affected project or projects confirm the bug and discuss the scope of any vulnerability along with potential solutions.

[Tristan Cacqueray (tristan-cacqueray)]

Can you please detail the vulnerabilities and the affected versions?

It seems like a packaging issue since horizon doesn't bundle those libraries ( https://docs.openstack.org/horizon/latest/contributor/topics/packaging.html#embedded-copies-not-allowed ), therefor this report is likely a class C2 according to VMT's taxonomy ( https://security.openstack.org/vmt-process.html#incident-report-taxonomy ).

[Martin Ivanov (martin76)]

/dashboard/static/dashboard/js/5508d0ed7005.js

Detected Javascript library jquery version 1.10.2.
The version was detected from file content.

References:
https://github.com/jquery/jquery/issues/2432
http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/

[Matthias Runge (mrunge)]

Since the libraries are decoupled from Horizon itself, it's an issue of your OpenStack distributor.

[Jeremy Stanley (fungi)]

In keeping with recent OpenStack vulnerability management policy changes, no report should remain under private embargo for more than 90 days. Because this report predates the change in policy, the deadline for public disclosure is being set to 90 days from today. If the report is not resolved within the next 90 days, it will revert to our public workflow as of 2020-05-27. Please see http://lists.openstack.org/pipermail/openstack-discuss/2020-February/012721.html for further details.

[Jeremy Stanley (fungi)]

It doesn't look like this report has seen any activity since my update two months ago, so consider this a friendly reminder:

The embargo for this report is due to expire one month from today, on May 27, and will be switched public on or shortly after that day if it is not already resolved sooner.

Thanks!

[Jeremy Stanley (fungi)]

The embargo for this report has expired and is now lifted, so it's acceptable to discuss further in public.

[Jeremy Stanley (fungi)]

I've set our security advisory task for this to Won't Fix as it's a class C2 report per our taxonomy (A vulnerability, but not in OpenStack supported code, e.g., in a dependency): https://security.openstack.org/vmt-process.html#incident-report-taxonomy

[Akihiro Motoki (amotoki)]

Horizon uses xstatic-jquery 1.12.4.1 since Sep 26 2018. 1.12.4 is the latest jquery release.
As Mathias commented above, the maintenance of xstatic-jquery is decoupled with horizon, but horizon is responsible for making horizon work with the latest stable of jquery 1.x series at least.
We now use the latest stable of jquery 1.x so I am marking it as Fix Released. (I don't mark it as Invalid as we used 1.10.x when the bug is reported.)

FYI: Note that the horizon team is considering the switch to jquery 3 but it is still on the way as we hit test failures.