Consider updating jQuery dependency to 3.4.0 or newer #20001
Assignees
Labels
area-mvc
Includes: MVC, Actions and Controllers, Localization, CORS, most templates
bug
This issue describes a behavior which is not expected - a bug.
Done
This issue has been fixed
Servicing-consider
Shiproom approval is required for the issue
Milestone
Comments
|
Note that this bug was filed against 2.2 - but we're still using jQuery 3.3.1 so this is still a relevant issue. @mkArtakMSFT |
rynowak
added
the
area-mvc
mkArtakMSFT
added
Servicing-consider
|
Other templates also use the old jQuery version. I'm creating a PR which updates them all to 3.4.1. |
|
Update: I found jQuery 2.2.0 - it's in the ClaimsTransformation and Cookies samples under src/Security/samples. |
wenz
added a commit
to wenz/aspnetcore
that referenced
this issue
Apr 1, 2020
Fixes dotnet#20001 Updated commit with unchanged line endings
HaoK
pushed a commit
that referenced
this issue
Apr 23, 2020
Fixes #20001 Updated commit with unchanged line endings
|
Fixed for 5.0 in #20356 will port to 3.1/2.2 next |
|
jQuery 3.5.1 was released. Should I open up a new issue, update the existing PR, or create a new one? |
|
Probably a new PR would be best, since the other PR was already merged, but might be worth considering updating to 3.5.1 before porting the first PR to servicing |
|
Will work on it today. |
|
@captainsafia is this done already? |
ghost
locked as resolved and limited conversation to collaborators
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
My team runs Azure DevOps Component Governance (per internal security requirements) and we received a notice that the following project template is impacted by CVE-2019-11358 affecting jQuery before 3.4.0.
I looked inside this template and found jQuery 3.3.1.
I also looked at the latest version of the template and the source code in this repository and see that 3.3.1 is still used: e.g.
aspnetcore/src/ProjectTemplates/Web.ProjectTemplates/content/StarterWeb-CSharp/wwwroot/lib/jquery/dist/jquery.js
Line 2 in 7def102
We don't specifically use this template but Component Governance picked up on it since we happened to install the CLI at build time inside the directory that it scans.
It's probably worth considering updating the template to jQuery 3.4.0 so consumers of the template don't have to be worried about this CVE.
I see there is another issue of removing jQuery (#8573) but I imagine updating the minor version of jQuery is a cheaper fix for this particular issue.
The text was updated successfully, but these errors were encountered: