[YARN-11109] many UI NPMs have published vulnerabilities

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Component/s: yarn-ui-v2
• Assignee: Unassigned
• Reporter: PJ Fanning
• Created: 07/Apr/22 10:52
• Updated: 07/Apr/22 14:51

Description

mainly associated with hadoop-yarn-project/hadoop-yarn/hadoop-yarn-ui/src/main/webapp/yarn.lock

 

dependabot reports issues in github forks but doesn't allow other users to see them - to see same results that I see, fork hadoop, go into security tab and enable Dependabot alerts (see https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts)

 

a brief summary of NPMs being reported

• lodash (critical cve) https://github.com/advisories/GHSA-jf85-cpcp-j695
• lodash.merge (critical cve)
• loadsh-es (critical cve)
• minimist (critical cve)
• cryptiles (critical cve) https://github.com/advisories/GHSA-rq8g-5pc5-wrhr
• ansi-regex
• follow-redirects
• ajv
• handlebars (critical cve)
• xmlhttprequest-ssl (critical cve)
• chownr
• node-sass
• mout
• shelljs
• xmldom
• markdown-it
• json-schema 
• jsonpointer
• tmpl
• tar
• path-parse
• socket.io-parser
• trim-newlines
• glob-parent 
• minimatch
• tough-cookie
• others with lower risks

 

hadoop-yarn-project/hadoop-yarn/hadoop-yarn-applications/hadoop-yarn-applications-catalog/hadoop-yarn-applications-catalog-webapp/package.json

• also has issues - notably with an old version of angular