doc: provide info on impact of recent vulns #1547

mhdawson · 2018-01-08T18:06:15Z

No description provided.

mhdawson · 2018-01-08T18:08:16Z

@nodejs/security-wg @nodejs/website, draft based on discussion in private security repo.

bnb

LGTM

mhdawson · 2018-01-08T18:19:16Z

Pushed commit to address conflict.

mhdawson · 2018-01-08T18:21:06Z

actually looks like I got the wrong index.md. @fhemberger do we now need to update all of the index files ? for the banner ?

mhdawson · 2018-01-08T18:31:29Z

Pushed commit to update the rest of the banners, am wondering if there is a more efficient way of doing it.

mcollina

LGTM

hashseed · 2018-01-08T19:33:27Z

locale/en/blog/vulnerability/jan-2018-spectre-meltdown

+
+The risk from these attacks to systems running Node.js resides in the systems in which your Node.js applications run, as opposed to the Node.js runtime itself. The trust model for Node.js assumes you are running trusted code and does not provide any separation between code running within the runtime itself. Therefore, untrusted code that would be necessary to execute these attacks in Node.js could already affect the execution of your Node.js applications in ways that are more severe than possible through these new attacks.
+
+This does not mean that you don't need to protect yourself from these new attacks when running Node.js applications. To do so, apply the security patches for your operating system. You do not need to update the Node.js runtime.


Maybe there should be more explanation.

Both Meltdown and Spectre need to run malicious code - even if permissions are restricted - to perform an attack. However, if malicious code is allowed to run on Node.js, you've lost anyways. But only to a certain degree. That malicious code still only has user permissions. Except that with Meltdown you can even read out kernel memory, if you run on an unpatched OS on an Intel CPU.

Right, but I think the point we are trying to make is that you need to patch your OS, not Node.js. I'll pull in a few more words from what you have.

hashseed · 2018-01-08T19:35:27Z

locale/ja/index.md

@@ -1,7 +1,7 @@
 ---
 layout: index.hbs
 labels:
-  banner: Important security releases, please update now!
+  banner: Spectre and Meltdown in the context of Node.js - no current action required.


The OS needs to be updated. That's more than "no current action required".

I was on the edge on that, I'll come up with something better.

Perhaps, "No Node.js specific action required"?

Actually probably better to have people just read the blog so will remove the '- no current action required.'

jasnell · 2018-01-08T22:22:15Z

locale/en/blog/vulnerability/jan-2018-spectre-meltdown

+
+# Summary
+
+Project zero has recently announced some new attacks that have received a lot of attention: https://googleprojectzero.blogspot.ca/2018/01/reading-privileged-memory-with-side.html.


nit: would you please add line breaks. Makes reviewing easier.

That makes it more work to paste into the email list page as I then have to go and remove them all. I can do it but means more work on the other end.

mhdawson · 2018-01-08T22:37:21Z

@hashseed pushed commit to address comments.

matteocontrini · 2018-01-08T22:40:30Z

locale/en/blog/vulnerability/jan-2018-spectre-meltdown

+This does not mean that you don't need to protect yourself from
+these new attacks when running Node.js applications. If an attacker
+manages to run malicious code on an upatched OS (whether using
+javascript or something else) they may be able to access memory and or


Maybe "JavaScript" instead of "javascript" here?

Good point, thanks

@matteocontrini pushed commit to fix

mhdawson · 2018-01-08T23:35:16Z

@hashseed would be good to see if you are ok with my update.

@nodejs/website would be good to get confirmation that updating the banner in all of the index.md files is now the right way to go.

mhdawson · 2018-01-09T01:16:20Z

Will plan to send out first thing my morning (EST) unless there are other comments before then.

hashseed · 2018-01-09T03:05:39Z

locale/en/blog/vulnerability/jan-2018-spectre-meltdown

+manages to run malicious code on an upatched OS (whether using
+JavaScript or something else) they may be able to access memory and or
+data that they should not have access to.  In order to protect yourself
+from these cases, apply the security patches for your operating


does it make sense to link to these resources?

@hashseed I'm not sure what all links/patches are available for OS's so far. Maybe that is something we can add in later on.

fhemberger · 2018-01-09T06:28:37Z

@mhdawson Hmmm … not very happy to overwrite all local messages again. We didn't translate the security banner for exact this reason: Translation teams would never be able to make the adjustments so quickly in case of an urgent release.

But over time it was clear that the message used for the banners was always "Important security releases, please update now!" – so we decided to make it translatable as well.

I'm currently thinking about a "manual override" in the template instead of replacing all translations:

layouts/index.hbs#17:

- <a href="{{ project.banner.link }}">{{{ labels.banner }}}</a>
+ <a href="{{ project.banner.link }}">{{#if project.banner.text}}{{{ project.banner.text }}}{{else}}{{{ labels.banner }}}{{/if}}</a>

And just add the key back here: https://github.com/nodejs/nodejs.org/blob/master/build.js#L273

What do you think?

lpinca · 2018-01-09T06:49:05Z

👍 for @fhemberger's suggestion.

mhdawson · 2018-01-09T14:10:46Z

@fhemberger, the banner would go through at least a couple of steps for a security release. First telling people the release was going to come in ~ 1 week, and then being updated to to tell them to update.

I think the override makes sense. Is that something we should include as part of this update ? I would like to get it out today.

fhemberger · 2018-01-09T15:49:54Z

@mhdawson Yes, please feel free to add this switch with this PR so it can land.

mhdawson · 2018-01-09T16:58:04Z

Ok changes pushed to use override, should be good to go.

mhdawson · 2018-01-09T16:59:53Z

Plan to wait about 1 hour for any more comments and then will land/send out on nodejs-sec mailing list.

PR-URL: #1547 Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Yang Guo <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Mandeep Singh <[email protected]> Reviewed-By: Vladimir de Turckheim <[email protected]> Reviewed-By: Yang Guo <[email protected]> Reviewed-By: Tierney Cyren <[email protected]>

mhdawson · 2018-01-09T18:58:07Z

Landed as cdc4144

bnb approved these changes Jan 8, 2018

View reviewed changes

doc: provide info on impact of recent vulns

faffcc5

mhdawson force-pushed the side-channel branch from 5a52d27 to faffcc5 Compare January 8, 2018 18:19

squash: update banner for rest of locales

d56a789

mcollina approved these changes Jan 8, 2018

View reviewed changes

hashseed reviewed Jan 8, 2018

View reviewed changes

jasnell reviewed Jan 8, 2018

View reviewed changes

squash: address comments

67a7e6a

vdeturckheim approved these changes Jan 8, 2018

View reviewed changes

matteocontrini reviewed Jan 8, 2018

View reviewed changes

squash: address comments

d4df409

vdeturckheim approved these changes Jan 8, 2018

View reviewed changes

hashseed approved these changes Jan 9, 2018

View reviewed changes

daxlab approved these changes Jan 9, 2018

View reviewed changes

lpinca approved these changes Jan 9, 2018

View reviewed changes

mhdawson added 2 commits January 9, 2018 10:59

squash: address comments

985245e

squash: address comments

d9d70d0

mhdawson closed this Jan 9, 2018

This was referenced Sep 15, 2021

[Snyk] Fix for 1 vulnerabilities ryan-ally/nodejs.org#36

Open

[Snyk] Security upgrade standard from 11.0.1 to 15.0.0 Alexander1984z/nodejs.org#42

Open

ryan-ally mentioned this pull request Jun 20, 2023

[Snyk] Fix for 1 vulnerabilities ryan-ally/nodejs.org#64

Open

adamlaska mentioned this pull request Jun 21, 2023

[Snyk] Fix for 1 vulnerabilities adamlaska/nodejs.org#93

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

doc: provide info on impact of recent vulns #1547

doc: provide info on impact of recent vulns #1547

mhdawson commented Jan 8, 2018

mhdawson commented Jan 8, 2018

bnb left a comment

mhdawson commented Jan 8, 2018

mhdawson commented Jan 8, 2018

mhdawson commented Jan 8, 2018

mcollina left a comment

hashseed Jan 8, 2018

mhdawson Jan 8, 2018

hashseed Jan 8, 2018

mhdawson Jan 8, 2018

jasnell Jan 8, 2018

mhdawson Jan 8, 2018

jasnell Jan 8, 2018

mhdawson Jan 8, 2018

mhdawson commented Jan 8, 2018

matteocontrini Jan 8, 2018

mhdawson Jan 8, 2018

mhdawson Jan 8, 2018

mhdawson commented Jan 8, 2018

mhdawson commented Jan 9, 2018

hashseed Jan 9, 2018

mhdawson Jan 9, 2018

fhemberger commented Jan 9, 2018

lpinca commented Jan 9, 2018

mhdawson commented Jan 9, 2018

fhemberger commented Jan 9, 2018

mhdawson commented Jan 9, 2018

mhdawson commented Jan 9, 2018

mhdawson commented Jan 9, 2018


		The risk from these attacks to systems running Node.js resides in the systems in which your Node.js applications run, as opposed to the Node.js runtime itself. The trust model for Node.js assumes you are running trusted code and does not provide any separation between code running within the runtime itself. Therefore, untrusted code that would be necessary to execute these attacks in Node.js could already affect the execution of your Node.js applications in ways that are more severe than possible through these new attacks.

		This does not mean that you don't need to protect yourself from these new attacks when running Node.js applications. To do so, apply the security patches for your operating system. You do not need to update the Node.js runtime.


		# Summary

		Project zero has recently announced some new attacks that have received a lot of attention: https://googleprojectzero.blogspot.ca/2018/01/reading-privileged-memory-with-side.html.

doc: provide info on impact of recent vulns #1547

doc: provide info on impact of recent vulns #1547

Conversation

mhdawson commented Jan 8, 2018

mhdawson commented Jan 8, 2018

bnb left a comment

Choose a reason for hiding this comment

mhdawson commented Jan 8, 2018

mhdawson commented Jan 8, 2018

mhdawson commented Jan 8, 2018

mcollina left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mhdawson commented Jan 8, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mhdawson commented Jan 8, 2018

mhdawson commented Jan 9, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

fhemberger commented Jan 9, 2018

lpinca commented Jan 9, 2018

mhdawson commented Jan 9, 2018

fhemberger commented Jan 9, 2018

mhdawson commented Jan 9, 2018

mhdawson commented Jan 9, 2018

mhdawson commented Jan 9, 2018