Outdated jQuery version (3.3.1) in Autopilot Manager package

[maxim366]

Dear Olivier,

Thank you for your contribution to the IT community. We have been using the Autopilot Manager solution for a long time and it has been very helpful!

Our security team reported that the package includes jQuery 3.3.1, which has known vulnerabilities. The affected file is:
https://ourwebsite/lib/jquery/dist/jquery.min.js

Since this solution is configured to update automatically from your repository by design, the fix needs to be applied on your side.

Vulnerability details

The version currently bundled (jQuery 3.3.1) includes multiple known security issues:

CVE-2020-11022 (Cross-Site Scripting in .html() / .append() methods)
Reference: https://nvd.nist.gov/vuln/detail/CVE-2020-11022

CVE-2020-11023 (Cross-Site Scripting in elements)
Reference: https://nvd.nist.gov/vuln/detail/CVE-2020-11023

CVE-2019-11358 (Prototype Pollution vulnerability)
Proof-of-Concept: https://www.exploit-db.com/exploits/52141

General jQuery security advisories:
GitHub Advisories: https://github.com/jquery/jquery/security/advisories

Snyk Security report for jQuery 3.3.1: https://security.snyk.io/package/npm/jquery/3.3.1

According to Snyk, the latest safe version is jQuery 3.7.1:
https://security.snyk.io/package/npm/jquery

Request

Could you please confirm if updating to the latest stable version (currently 3.7.1) is planned as part of an upcoming release? Since the package is pulled directly from your repository, we cannot resolve this issue on our side without the update being applied upstream.

Contact

If you need any information/collaboration, you are more than welcome to contact me here on GitHub or email maxim.ogoreltsev@jti.com.

Thank you very much in advance for your support.

[okieselbach]

I'll release a updated version with the latest dependencies. It may take 2 weeks+ as I'm on vacation at the moment and be back in 2 weeks. I did a quick test already and it looks good. Thanks for bringing this to attenation.

[maxim366]

Hi Olivier,

Thank you for quick response!

To keep our environment secure I've downloaded zip file with the whole solution and updated 3 files from JQuery official website. No one complained so far and it seems to be working.

I think we will switch probably to auto update back once it will be in production on your side.

Have a nice vacation and wish you the best!

[maxim366]

Dear @okieselbach,

May I ask when should be expect updated version with this fix included?

Thank you!

[okieselbach]

I had a longer time out due to a sports accident. But I'm nearly fine again now. Will have a look and update the server soon.

[maxim366]

Hope it is not knees? I have both knees injured and surgeries after soccer/football.
I wish you good recovery!