Dependabot alert for node-forge vulnerability (CVE-2022-24773)

[mabubakar2]

Hi everyone,

I'm encountering a Dependabot alert for a vulnerability in the node-forge package used by @vue/cli-service. This vulnerability can potentially allow for RSA signature forgery under certain conditions.

Details:

• Vulnerable package: node-forge (versions below 1.3.0)
• Impact: Improper verification of cryptographic signatures can lead to signature forgery.
• Affected versions of @vue/cli-service: 4.5.17 (due to a transitive dependency on selfsigned)
• References:
  • CVE details: https://security.snyk.io/vuln/SNYK-JS-NODEFORGE-2330875

The issue:
Dependabot is unable to update node-forge to a patched version (1.3.0 or later) due to a conflicting dependency with @vue/cli-service at version 4.5.17. Specifically, @vue/cli-service requires node-forge@^0.10.0 through a transitive dependency on selfsigned.

Questions:

1. Has anyone else encountered this specific issue with node-forge and @vue/cli-service?
2. Are there any known workarounds or solutions to address this vulnerability while using @vue/cli-service 4.5.17?
3. If upgrading node-forge is recommended, is there a timeline for when a compatible, patched version of @vue/cli-service might be available?

Thank you!

[jacekkarczmarczyk]

is there a timeline for when a compatible, patched version of @vue/cli-service might be available?

Vue CLI is not maintained any longer

[mabubakar2]

Thanks for letting me know that Vue CLI is no longer under active maintenance. That's definitely something to consider. While a permanent solution might involve migrating to a different CLI tool, do you happen to know of any workarounds for the specific node-forge vulnerability in the context of using Vue CLI 4.5.17? Perhaps there's a way to manually patch the dependency or implement a mitigation strategy until a compatible, patched version of another package becomes available?

[jacekkarczmarczyk]

Maybe something like yarn resolutions (or equivalent in other package managers). In the worst case you could clone vue cli and patch it yourself. If you don't want to chnage the tool you can also consider upgrading vue cli to 5

[mabubakar2]

Legend @jacekkarczmarczyk! Thanks heaps, yarn resolution solved the issue!