Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security vulnerability in Folly (CVE-2019-11934) #27640

Closed
jmp opened this issue Dec 30, 2019 · 3 comments
Closed

Security vulnerability in Folly (CVE-2019-11934) #27640

jmp opened this issue Dec 30, 2019 · 3 comments
Labels
Bug Resolution: Locked This issue was locked by the bot.

Comments

@jmp
Copy link

jmp commented Dec 30, 2019 •
edited
Loading

React Native is using an old, insecure version of Folly.

The current version of Folly in master is 2018.10.22.00. This version has a "critical" security vulnerability CVE-2019-11934 related to SSL sockets.

The latest version of Folly at the moment is 2019.12.30.00, where the above vulnerability has already been fixed, here.

Could you please update Folly to a newer, patched version?

React Native version:

react-native: 0.61.5

Steps To Reproduce

  1. Run react-native init new_project
  2. Open new_project/node_modules/react-native/third-party-podspecs/Folly.podspec in a text editor
  3. Observe how spec.version is 2018.10.22.00

As a consequence, spec.source tells CocoaPods to pull Folly from tag v2018.10.22.00 which contains an unpatched version of Folly without the fix to CVE-2019-11934.

Some additional info:

I noticed this when running dependency-check-cli against a React Native project.
@jmp jmp added the Bug label Dec 30, 2019
@dulmandakh
Copy link
Contributor

@Kudo could you please bump folly version if possible. Thanks

@Kudo
Copy link
Contributor

Kudo commented Jan 14, 2020

For OSS RN we only use and compile partial folly implementations.
Scoket and AsyncSocket are not being imported.

Well, even we should be have the CVE problem, the folly is outdated for a while.
I will working on upgrading folly anyway.

This was referenced Jan 20, 2020
Closed
Closed
facebook-github-bot pushed a commit that referenced this issue Jan 21, 2020
@Kudo @facebook-github-bot
Upgrade Folly to v2020.01.13.00 (#27810)
a27e31c 
Summary:
Upgrade Folly to v2020.01.13.00. Fixes #27640

## Changelog

[iOS] [Changed] - Upgrade Folly to v2020.01.13.00
Pull Request resolved: #27810

Test Plan: Test by building and running RNTester

Reviewed By: mdvacca

Differential Revision: D19483115

Pulled By: fkgozali

fbshipit-source-id: 4a85325a95b5f7857da75995d587218740d8b077
@dulmandakh
Copy link
Contributor

Thank you @Kudo 👍

osdnk pushed a commit to osdnk/react-native that referenced this issue Mar 9, 2020
@Kudo @osdnk
Upgrade Folly to v2020.01.13.00 (facebook#27811)
2c5dac2 
Summary:
Upgrade Folly to v2020.01.13.00. Fixes facebook#27640

## Changelog

[Android] [Changed] - Upgrade Folly to v2020.01.13.00
Pull Request resolved: facebook#27811

Test Plan:
Test by building and running RNTester:
`./gradlew :RNTester:android:app:installJscDebug`
`./gradlew :RNTester:android:app:installHermesDebug`
And the native debug builds:
`NATIVE_BUILD_TYPE=Debug ./gradlew :RNTester:android:app:installJscDebug`
`NATIVE_BUILD_TYPE=Debug ./gradlew :RNTester:android:app:installHermesDebug`

Reviewed By: mdvacca

Differential Revision: D19474027

Pulled By: fkgozali

fbshipit-source-id: 1c680dd80413b63aad66b587213de7499197177c
osdnk pushed a commit to osdnk/react-native that referenced this issue Mar 9, 2020
@Kudo @osdnk
Upgrade Folly to v2020.01.13.00 (facebook#27810)
98fe330 
Summary:
Upgrade Folly to v2020.01.13.00. Fixes facebook#27640

## Changelog

[iOS] [Changed] - Upgrade Folly to v2020.01.13.00
Pull Request resolved: facebook#27810

Test Plan: Test by building and running RNTester

Reviewed By: mdvacca

Differential Revision: D19483115

Pulled By: fkgozali

fbshipit-source-id: 4a85325a95b5f7857da75995d587218740d8b077
@facebook facebook locked as resolved and limited conversation to collaborators Oct 2, 2021
@react-native-bot react-native-bot added the Resolution: Locked This issue was locked by the bot. label Oct 2, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
Bug Resolution: Locked This issue was locked by the bot.
Projects
None yet
Milestone
No milestone
4 participants
@Kudo @dulmandakh @jmp @react-native-bot