jquery dependency needs to be updated to 3.5.0 or newer

[breser]

Currently you're requring jquery 3.4.0 or newer, 3.5.0 has a vulnerability against it.

CVE-2020-11022

Change is needed to these two lines:
https://github.com/apache/airflow/blob/master/airflow/www/package.json#L70
https://github.com/apache/airflow/blob/master/airflow/www/package.json#L48

[boring-cyborg]

Thanks for opening your first issue here! Be sure to follow the issue template!

[potiuk]

Would you be so kind to make a PR with that? It shoudl be rather easy?

BTW. When you open a new "security" issue from template, you should get information that the right way of raising security issues is through [email protected] -> that's the responsible disclosure policy that is valid fora all Apache organisation. https://www.apache.org/security/

Then such a vulnerability can be fixed before it gets disclosed.

[breser]

Pull request made.

I did not email [email protected] because I frankly don't consider this to be worth going through that process. This vulnerability is not in any way "secret". It's a vulnerability in a dependency, that Nessus is already alerting on against running airflow servers (mostly because of some networking equipment that happens to put jquery on a similar path not because they coded it specifically for airflow). I'm not providing any information about a working exploit against airflow. I'm not even sure one exists because I didn't sit down and research how you used jquery to see if you're using the functionality that has issues.

[potiuk]

Pull request made.

Thanks! I saw that the Astronomer's team will test it once they get the .lock file . Thanks for that :)

I did not email [email protected] because I frankly don't consider this to be worth going through that process. This vulnerability is not in any way "secret". It's a vulnerability in a dependency, that Nessus is already alerting on against running airflow servers (mostly because of some networking equipment that happens to put jquery on a similar path not because they coded it specifically for airflow). I'm not providing any information about a working exploit against airflow. I'm not even sure one exists because I didn't sit down and research how you used jquery to see if you're using the functionality that has issues.

Sure. I understand the reasons :). I just think in such cases it's better to be safe than sorry - I understand it's not secret, but just mentioning it publicly and mentioning CVE with clear information "it's not yet fixed" might be something dangerous. It's likely, not - in this case, and it is just strongly encouraged (not required) by the ASF policy menttioned. Not a big problem I think for now, but something to look out in the future.

[breser]

See this comment on the PR I opened for past attempts to fix this:
#10684 (comment)