Skip to content

Conversation

@julio-rocketchat
Copy link
Member

@julio-rocketchat julio-rocketchat commented Jan 23, 2025

Fix for https://github.com/RocketChat/Rocket.Chat/security/code-scanning/399

To fix the problem, we need to increase the RSA key size to at least 2048 bits. This change will ensure that the generated keys are secure and comply with modern cryptographic standards.

Specifically, we will update the line new NodeRSA({ b: 512 }) to use a key size of 2048 bits. This change will not affect the existing functionality of the code but will enhance the security of the generated keys.

https://rocketchat.atlassian.net/browse/VLN-92

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@changeset-bot
Copy link

changeset-bot bot commented Jan 23, 2025

⚠️ No Changeset found

Latest commit: 79b69da

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@dionisio-bot
Copy link
Contributor

dionisio-bot bot commented Jan 23, 2025

Looks like this PR is not ready to merge, because of the following issues:

  • This PR is targeting the wrong base branch. It should target 7.4.0, but it targets 7.3.0

Please fix the issues and try again

If you have any trouble, please check the PR guidelines

@julio-rocketchat julio-rocketchat changed the title Potential fix for code scanning alert no. 399: Use of a weak cryptographic key fix: increase RSA key size in federationKeys Jan 23, 2025
@julio-rocketchat julio-rocketchat changed the title fix: increase RSA key size in federationKeys fix: increase RSA key size in FederationKeys.ts Jan 23, 2025
@julio-rocketchat julio-rocketchat marked this pull request as ready for review January 23, 2025 03:04
@github-actions
Copy link
Contributor

PR Preview Action v1.6.0

🚀 View preview at
https://RocketChat.github.io/Rocket.Chat/pr-preview/pr-35011/

Built to branch gh-pages at 2025-01-23 03:11 UTC.
Preview will be ready when the GitHub Pages deployment is complete.

@codecov
Copy link

codecov bot commented Jan 23, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 59.17%. Comparing base (0858ce5) to head (850bc54).
Report is 1 commits behind head on develop.

Additional details and impacted files

Impacted file tree graph

@@           Coverage Diff            @@
##           develop   #35011   +/-   ##
========================================
  Coverage    59.17%   59.17%           
========================================
  Files         2822     2822           
  Lines        68118    68118           
  Branches     15145    15145           
========================================
  Hits         40312    40312           
  Misses       24975    24975           
  Partials      2831     2831           
Flag Coverage Δ
unit 75.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

@julio-rocketchat julio-rocketchat added this to the 7.4.0 milestone Jan 23, 2025
@julio-rocketchat julio-rocketchat requested review from tassoevan and removed request for KevLehman January 23, 2025 12:06
@tassoevan tassoevan added the stat: QA assured Means it has been tested and approved by a company insider label Jan 23, 2025
@dionisio-bot dionisio-bot bot added the stat: ready to merge PR tested and approved waiting for merge label Jan 23, 2025
@kodiakhq kodiakhq bot merged commit e78c253 into develop Jan 23, 2025
49 checks passed
@kodiakhq kodiakhq bot deleted the fix-key-size branch January 23, 2025 14:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

stat: QA assured Means it has been tested and approved by a company insider stat: ready to merge PR tested and approved waiting for merge

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants