There is a vulnerability in jquery 3.4.1 ,upgrade recommended

[QiAnXinCodeSafe]

airflow/airflow/www/yarn.lock

Lines 4208 to 4211 in 7490c6b

	jquery@>=1.7, jquery@>=3.4.0, "jquery@^1.8.3 || ^2.0 || ^3.0":
	version "3.4.1"
	resolved "https://registry.yarnpkg.com/jquery/-/jquery-3.4.1.tgz#714f1f8d9dde4bdfa55764ba37ef214630d80ef2"
	integrity sha512-36+AdBzCL+y6qjw5Tx7HgzeGCzC81MDDgaUP8ld2zhx58HdqXGoBd+tHdrBMiyjGQs0Hxs/MLZTu/eHNJJuWPw==

CVE-2020-11023 CVE-2020-11022

Recommended upgrade version：3.5.0

[kaxil]

FYI: The last time we upgraded to 3.5 -- FlaskAppbuilder (library we use for Airflow Webserver) broke..

Check the following 2 comments:

#10684 (comment)
#10684 (comment)

[zachliu]

in case anyone is interested

Vulnerable javascript library: jQuery
version: 3.4.1

Details:
jQuery versions below 3.5.0 used a regex in its jQuery.htmlPrefilter method. This regex which is used to ensure that all tags are XHTML-compliant could introduce a vulnerability to Cross-site Scripting(XSS) attack. Please refer to vendor documentation (https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ and https://jquery.com/upgrade-guide/3.5/) for the security fix details.

---

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0. Please refer GHSA-gxr4-xjj5-5px2 and https://nvd.nist.gov/vuln/detail/CVE-2020-11022 ...

[mik-laj]

Duplicate: #10429

[HardikVijayPatel]

What Airflow release version will have the jquery fix? and will this be available for both airflow 1 and airflow 2 ?

[kaxil]

What Airflow release version will have the jquery fix? and will this be available for both airflow 1 and airflow 2 ?

Will be in Airflow 2.1.2. Airflow 1.x has reached End of life so no new releases will be cut for it.

https://github.com/apache/airflow#version-life-cycle

[HardikVijayPatel]

What Airflow release version will have the jquery fix? and will this be available for both airflow 1 and airflow 2 ?

Will be in Airflow 2.1.2. Airflow 1.x has reached End of life so no new releases will be cut for it.

https://github.com/apache/airflow#version-life-cycle

thanks! aprrox ETA for the release?

[kaxil]

~1 or 2 months

[HardikVijayPatel]

@kaxil this fix has got moved from airflow 2.1.2 to 2.1.3, is that right? as i don't see the issue mentioned in change log for the 2.1.2 release:
https://airflow.apache.org/docs/apache-airflow/stable/changelog.html

[kaxil]

@HardikVijayPatel This is available in 2.1.2 -- looks like because of the bad commit message it wasn't captured in Changelog --

9b0b0c6#diff-04917bec1b0d3cdd9aeaaeb24b1309315aeff5835dc78ab60fdf57768303b725

I will fix the Changelog - PR: #17136

[HardikVijayPatel]

@kaxil I just updated my version to 2.1.2 and ran the following command in the console and see the version as 3.4.1:
console.log(jQuery().jquery);
VM58:1 3.4.1
undefined
am i checking something wrong or is there something missing here?

[kaxil]

cc @bbovenzi -- Any ideas ?