Aspose.Slides for Node.js and Vulnerability Errors (CVE-2021-23358, CVE-2023-20569)

Aspose.Slides Product Family
,
1

We are trying to deploy Aspose.slides.via.java in deocker and we are getting the following SysDig vulnerability error:

CVE-2021-23358 2021-03-29 High v1.12.1 underscore 1.4.4

CVE-2023-20569 2023-08-08 High linux-libc-dev

2

@vigneshpmmc200,
Thank you for contacting support.

To investigate the case, we need more details. Could you please describe step by step how to reproduce the errors you encountering?

3

Hi ,
We are installing node-java and build-essential as mentioned in this link How to Create a Docker Image to Run Aspose.Cells for Node.js via Java

But node-java has a dependency on underscore 1.4.4 and has vulnerability and CID pipeline is failing during vulnerability scan

4

@vigneshpmmc200,
Thank you for the additional information. I am working on the issue and will get back to you soon.

5

@andrey.potapov Is the npm package node-java dependency for Apose.slides.via.java mandatory for aspose to work correctly

6

@vigneshpmmc200,
Thank you for the question and your patience, I will get back to you as soon as possible.

7

@vigneshpmmc200,
The article you mentioned above is related to Aspose.Cells for Node.js. It looks like you are trying to create a Docker container for Aspose.Slides for Node.js using that tutorial for Aspose.Cells for Node.js. Could you please confirm?

8

Yes you are right and also in this article Installation|Aspose.Slides for Node.js Documentation
it says that node-java is required to be installed for Aspose.sides.via.java.

If I remove that node-java installation step will the aspose library work?
I am using:
Node : 18x
Python: 3x

9

@vigneshpmmc200,
We have opened the following new ticket(s) in our internal issue tracking system and will consider your questions according to the terms mentioned in Free Support Policies.

Issue ID(s): SLIDESNODEJS-53

You can obtain Paid Support Services if you need support on a priority basis, along with the direct access to our Paid Support management team.

10

@vigneshpmmc200,
Our developers have investigated the case.

This link is related to Aspose.Cells. It looks like this code should work with Aspose.Slides for Node.js via Java as well, but you should change the following line RUN npm install -g node-java to RUN npm install -g java.

Please pay attention that point number 4 in the list that sound like this:

Install node-java bridge. You can run these commands in terminal.

But in the commands associated with this point number 4 you can see the following line npm install java.

As we now see, there is a typo in this article.

To be clear, we do not have a dependency on node-java (this is a typo). You should install the java package instead of node-java.

We have corrected the article accordingly.