angular-cli (v11.2.13) audit fails from dns-packet vulnerability

[dr-shakya]

Installing angular-cli version 11.2.13 and running an npm audit shows high security vulnerability from dns-packet. The package.json for my setup has devDependencies:
"@angular-devkit/build-angular": "~0.1102.13", "@angular/cli": "~11.2.13"

The npm-audit response is:

High            Memory Exposure                                               
                                                                                
Package         dns-packet                                                    
                                                                                
Patched in      >=5.2.2                                                       
                                                                                
Dependency of   @angular-devkit/build-angular [dev]                           
                                                                                
Path            @angular-devkit/build-angular > webpack-dev-server > bonjour  
                  > multicast-dns > dns-packet                                  
                                                                                
More info       https://npmjs.com/advisories/1745

The issue is also reported in #20795 but only for angular 12

[alan-agius4]

webpack-dev-server is using bonjour which is using an outdated version of multicast-dns, and therefore this is not actionable by the Angular CLI.

This vulnerability doesn't impact Angular CLI and Webpack Dev-Server as these tools are not meant to be used in production where this security vulnerability can be exploited.

Related upstream issues;
webpack/webpack-dev-server#3340
watson/bonjour#63

[andziaoo7]

I have the same issue. My package.json has:
"@angular-devkit/build-angular": "0.1102.11",
"@angular/cli": "11.2.11",

[zentoaku]

webpack-dev-server is using bonjour which is using an outdated version of multicast-dns, and therefore this is not actionable by the Angular CLI.

This vulnerability doesn't impact Angular CLI and Webpack Dev-Server as these tools are not meant to be used in production where this security vulnerability can be exploited.

Related upstream issues;
webpack/webpack-dev-server#3340
watson/bonjour#63

@alan-agius4
But it impacts security of the CI/CD. There's possibility to import dev packages in production code so npm audit should check all dependencies. Any project that cares heavily about security issues needs to block the whole deployment process if any issue is found.
This issue shouldn't be closed and Angular team should really focus on providing a solution, not shifting the responsibility as anyone using angular has to deal with dependencies it creates.

Also the issue exist in v9

[alan-agius4]

Hi @zentoaku,

• In general the NPM audits should be taken with a pinch of salt , one of the problems with npm audit is that there is no way to control if the reported vulnerability is relevant.
• Unless in CI/CD enviorment you are spawning the dev-server, it is running in an un-secure network and sometime within that network is crafting malicious domain queries this vulnerability cannot be exploited.
• The NPM advisory is also outdated as this issue has been addressed in dns-packet version 1.3.4.

This issue shouldn't be closed and Angular team should really focus on providing a solution, not shifting the responsibility

Unfortunately this is caused by a transitive dependency of a transitive dependency, literally in this case there is nothing we can do but wait for an upstream fix.

[zentoaku]

@alan-agius4 I understand and agree that for know you can only wait. But in long term angular should track and care, and if needed replace problematic dependency.
As an example I can tell that in banking any kind of security issue is taken very seriously and therefore checked on the earliest stage possible. For js it will be npm audit unfortunately.

[ElinOlundForsling]

@alan-agius4 I just want to point out that Bonjour was last updated five years ago, it seems unlikely we'll get an upstream fix for this one.

[alan-agius4]

The NPM advisory is also outdated as this issue has been addressed directly in dns-packet version 1.3.4, therefore it doesn’t require any action from bonjour.

[angular-automatic-lock-bot]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}