Critical vulnerability in `tough-cookie`

[justinmchase]

Which service(blob, file, queue, table) does this issue concern?

all

Which version of the Azurite was used?

latest

Where do you get Azurite? (npm, DockerHub, NuGet, Visual Studio Code Extension)

docker hub and npm

What's the Node.js version?

20

What problem was encountered?

CVE-2023-26136 found in [email protected]

Steps to reproduce the issue?

npm i
npm ls tough-cookie

Have you found a mitigation/solution?

Upgrade to latest version of @azure/ms-rest-js, which has removed tough-cookie.

npm i @azure/[email protected]

[blueww]

@EmmaZhu

Would you please help to look at the dependency issue?

[EmmaZhu]

Upgrading to the latest @azure/ms-rest-js may not be able to resolve the issue. Azurite still has dependency on [email protected] which may be indirectly introduced by some Azurite's dependencies. I'll work on this to find out which dependencies introduce to see how we can fix this vulnerability.

[justinmchase]

I was able to workaround this by building a Docker image which includes this line:

RUN npm install azureite -g && \
    cd /usr/local/lib/node_modules/azurite && \
    npm upgrade && \
    npm i @azure/[email protected]

The result is an upgraded and functioning azurite that no longer has any security vulnerabilities.

Which leads me to believe that all you need to do to get this resolved in this repo is to run:

npm upgrade
npm i @azure/[email protected]

[justinmchase]

This is still an issue, tough-cookie has another critical and ms-rest-js needs to be updated still.