Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to get rid of the ‘hoek’ vulnerabilities

Tags:

I recently pushed an Angular CLI 5 application to GitHub and it indicated the following:

We found a potential security vulnerability in one of your dependencies. A dependency defined in net-incident/package-lock.json has known security vulnerabilities and should be updated. Dependencies defined in net-incident/package-lock.json 816 hapijs / hoek Known security vulnerability in 2.16.3 

I have gone through the output from ‘npm audit’ and executed the various updates, including the following (which was not suggested):

npm install --save-dev [email protected]

The ‘request’ package contains ‘hawk’ which contains ‘hoek’. When I look at the ‘request’ package in node_modules the version has changed. But the following two updates from ‘npm audit’ do not seem to do anything:

npm update fsevents --depth 4 npm update stringstream --depth 5

And I am left with the following:

[!] 33 vulnerabilities found [12201 packages audited]     Severity: 5 Low | 24 Moderate | 4 High     Run `npm audit` for more detail 

And many of the vulnerabilities are like the following:

Moderate        Prototype pollution Package         hoek Patched in      > 4.2.0 < 5.0.0 || >= 5.0.3 Dependency of   karma Path            karma > log4js > loggly > request > hawk > boom > hoek More info       https://nodesecurity.io/advisories/566 

In the end, the application would not compile, so I replaced the the package and lock files, and now I am back to the beginning. I really want to fix the security issues. How do I get rid of the pesky ‘hoek’ vulnerabilities?

like image 456
Phil Huhn Avatar asked May 21 '18 17:05

Phil Huhn


People also ask

Is there any security risk in using Hoek?

It's unlikely that it causes any security risks in hoek package due to how it works, regardless of how the package is used (that's important as well). Additionally, karma > log4js > loggly > request > hawk > boom > hoek dependency chain means that the problem occurs in development dependency.

Why does the Hoek problem exist?

The hoek problem, in this case, doesn't arise because of package.json settings, it persists because it is layers of dependencies deep in the node_modules. If Karma requires a certain version of Request, which requires an insecure version of hawk (or whatever), then every time npm i is run, those specific versions will be installed.

How to fix the Hawk security vulnerability in Git?

Check the version of hawk against the one on npm hawk, if it doesn't tally, run npm i hawk --save or npm i hoek@latest --save, then you should also run: npm i karma@latest --save, then npm audit After which I again ran my normal git commands: Then you can go back to Github, the security vulnerability should be fixed.

What are the six strategies for reducing vulnerabilities?

Six Strategies for Reducing Vulnerability Risk 1. The Fire Brigade. Strategy: Incident Response. Treat vulnerabilities as incidents and respond to them individually,... 2. Building Blocks. Strategy: Asset Focused. Identify the highest risk assets and fix them first, regardless of specific... 3. ...


2 Answers

You should runrm package-lock.json && npm update && npm install, if this still doesn't fix your issue, you can then continue by running npm ls hoek, which should gave you:

├─┬ [email protected] │ └─┬ [email protected] │   └─┬ [email protected] │     ├─┬ [email protected] │     │ └── [email protected] │     ├── [email protected] │     └─┬ [email protected] │       └── [email protected] └── [email protected] 

Check the version of hawk against the one on npm hawk, if it doesn't tally, run npm i hawk --save or npm i hoek@latest --save, then you should also run: npm i karma@latest --save, then npm audit After which I again ran my normal git commands:

git add . git commit -m 'whatever_message' git push  

Then you can go back to Github, the security vulnerability should be fixed.

like image 181
antzshrek Avatar answered Sep 25 '22 12:09

antzshrek


This answer addresses similar hoek problem, and this answer explains non-vulnerability audit reports in detail.

npm audit reports possible problems. It's unnecessary that they are real problems that should be solved.

A nested dependency like karma > log4js > loggly > request > hawk > boom > hoek may require to fork numerous packages in dependency chain in case it has to be fixed.

Prototype pollution diagnosis indicates code smell. The reason why prototype pollution smells is that it can cause security problems. This is the reason why it's labeled as Moderate. It's unlikely that it causes any security risks in hoek package due to how it works, regardless of how the package is used (that's important as well).

Additionally, karma > log4js > loggly > request > hawk > boom > hoek dependency chain means that the problem occurs in development dependency. Most security problems are primarily applicable to dependencies that are used in production. This problem is specific to tests and Karma. It's virtually impossible it is a threat.

TL;DR: this is not a vulnerability. It has to be ignored. Any npm audit report should pass sanity check before any efforts to fix it will be made.

like image 35
Estus Flask Avatar answered Sep 23 '22 12:09

Estus Flask