|
| 1 | +# bson |
| 2 | + |
| 3 | +Endless Lifecycle Support (ELS) for bson from TuxCare provides security fixes for bson versions that have reached their end of life. This allows you to continue running bson applications without vulnerability concerns, even after official support has ended. |
| 4 | + |
| 5 | +## Supported bson Versions |
| 6 | + |
| 7 | +* bson 0.5.7, 1.0.9 |
| 8 | + |
| 9 | +## Connection to ELS for bson Library |
| 10 | + |
| 11 | +This guide outlines the steps needed to integrate the TuxCare ELS for the bson library. |
| 12 | + |
| 13 | +## Step 1: Get Token |
| 14 | + |
| 15 | +You need a token in order to use TuxCare ELS bson library. Anonymous access is disabled. To receive the token, please contact [sales@tuxcare.com](mailto:sales@tuxcare.com). |
| 16 | + |
| 17 | +## Step 2: Set Up ELS for bson |
| 18 | + |
| 19 | +TuxCare provides ELS for bson as an NPM package, hosted on a secure internal registry. Follow the steps below to add it to your project and get started. |
| 20 | + |
| 21 | +1. Navigate to the root directory of your bson project. |
| 22 | +2. Create a `.npmrc` file or update it if it already exists. |
| 23 | + |
| 24 | + **Example:** |
| 25 | + |
| 26 | + ```text |
| 27 | + my-bson-project/ |
| 28 | + ├── node_modules/ |
| 29 | + ├── package.json |
| 30 | + ├── .npmrc ⚠️ ← Create it here |
| 31 | + └── package-lock.json |
| 32 | + ``` |
| 33 | + |
| 34 | +3. Use an editor of your choice (e.g., VS Code) to add the following registry address line: |
| 35 | + |
| 36 | + <CodeWithCopy> |
| 37 | + |
| 38 | + ```text |
| 39 | + registry=https://registry.npmjs.org/ |
| 40 | + @els-js:registry=https://nexus.repo.tuxcare.com/repository/els_js/ |
| 41 | + //nexus.repo.tuxcare.com/repository/els_js/:_auth=${TOKEN} |
| 42 | + ``` |
| 43 | + |
| 44 | + </CodeWithCopy> |
| 45 | + |
| 46 | + :::warning |
| 47 | + Replace ${TOKEN} with the token you received from [sales@tuxcare.com](mailto:sales@tuxcare.com). |
| 48 | + ::: |
| 49 | + |
| 50 | +4. Update your `package.json` file to replace your bson dependencies with the TuxCare packages: |
| 51 | + |
| 52 | + <TableTabs label="Choose bson version: " > |
| 53 | + |
| 54 | + <template #bson_0.5.7> |
| 55 | + |
| 56 | + <CodeWithCopy> |
| 57 | + |
| 58 | + ```text |
| 59 | + "dependencies": { |
| 60 | + "bson": "npm:@els-js/bson@0.5.7-tuxcare.1" |
| 61 | + } |
| 62 | + ``` |
| 63 | +
|
| 64 | + </CodeWithCopy> |
| 65 | +
|
| 66 | + </template> |
| 67 | +
|
| 68 | + <template #bson_1.0.9> |
| 69 | +
|
| 70 | + <CodeWithCopy> |
| 71 | +
|
| 72 | + ```text |
| 73 | + "dependencies": { |
| 74 | + "bson": "npm:@els-js/bson@1.0.9-tuxcare.1" |
| 75 | + } |
| 76 | + ``` |
| 77 | +
|
| 78 | + </CodeWithCopy> |
| 79 | +
|
| 80 | + </template> |
| 81 | +
|
| 82 | + </TableTabs> |
| 83 | +
|
| 84 | +5. You need to remove the `node_modules` directory and the `package-lock.json` file, and also clear the `npm cache` before installing the patched packages. Use the following commands: |
| 85 | + |
| 86 | + <CodeWithCopy> |
| 87 | +
|
| 88 | + ```text |
| 89 | + rm -rf node_modules package-lock.json && npm cache clean --force |
| 90 | + ``` |
| 91 | + |
| 92 | + </CodeWithCopy> |
| 93 | + |
| 94 | +6. Run the following command to install the ELS version of the bson library (token for the TuxCare repository will be automatically picked up from your `.npmrc` file): |
| 95 | + |
| 96 | + <CodeWithCopy> |
| 97 | + |
| 98 | + ```text |
| 99 | + npm install |
| 100 | + ``` |
| 101 | + |
| 102 | + </CodeWithCopy> |
| 103 | + |
| 104 | + You will see an output like: |
| 105 | + |
| 106 | + ```text |
| 107 | + added 1 package, and audited 2 packages in 792ms |
| 108 | + |
| 109 | + found 0 vulnerabilities |
| 110 | + ``` |
| 111 | + |
| 112 | +7. You've successfully installed the Tuxcare ELS version of the bson library into your project. |
| 113 | + |
| 114 | +## Vulnerability Exploitability eXchange (VEX) |
| 115 | + |
| 116 | +VEX is a machine-readable format that tells you if a known vulnerability and is actually exploitable in your product. It reduces false positives, helps prioritize real risks. |
| 117 | + |
| 118 | +TuxCare provides VEX for bson ELS versions: [security.tuxcare.com/vex/cyclonedx/els_lang_javascript/bson/](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/bson/). |
| 119 | + |
| 120 | +## How to Upgrade to a Newer Version of TuxCare Packages |
| 121 | + |
| 122 | +If you have already installed a package with a `tuxcare.1` suffix and want to upgrade to a newer release (for example, `tuxcare.2`), there are two options: |
| 123 | + |
| 124 | +* **Option 1**. Run the `npm install` command with the specific version. This will automatically update both `package.json` and `package-lock.json`: |
| 125 | + |
| 126 | + <CodeWithCopy> |
| 127 | + |
| 128 | + ```text |
| 129 | + npm install bson@npm:@els-js/bson@1.0.9-tuxcare.2 |
| 130 | + ``` |
| 131 | + |
| 132 | + </CodeWithCopy> |
| 133 | + |
| 134 | +* **Option 2**. Update the version string in your `package.json`, remove installed files and clear npm cache to avoid conflicts: |
| 135 | + |
| 136 | + <CodeWithCopy> |
| 137 | + |
| 138 | + ```text |
| 139 | + rm -rf node_modules package-lock.json && npm cache clean --force |
| 140 | + npm install |
| 141 | + ``` |
| 142 | + |
| 143 | + </CodeWithCopy> |
| 144 | + |
| 145 | +## Resolved CVEs |
| 146 | + |
| 147 | +Fixes for the following vulnerabilities are available in ELS for bson from TuxCare versions: |
| 148 | + |
| 149 | +<TableTabs label="Choose bson version: " > |
| 150 | + |
| 151 | +<template #bson_0.5.7> |
| 152 | + |
| 153 | +| CVE ID | CVE Type | Severity | Affected Libraries | Vulnerable Versions | |
| 154 | +| :------------: | :------: |:--------:|:------------------:| :----------------: | |
| 155 | +| CVE-2020-7610 | Direct | Critical | bson | >= 1.0.0, < 1.1.4 | |
| 156 | +| CVE-2018-13863 | Direct | High | bson | >= 0.5.0, < 1.0.5 | |
| 157 | + |
| 158 | + </template> |
| 159 | + |
| 160 | +<template #bson_1.0.9> |
| 161 | + |
| 162 | +| CVE ID | CVE Type | Severity | Affected Libraries | Vulnerable Versions | |
| 163 | +| :------------: | :------: |:--------:|:------------------:| :----------------: | |
| 164 | +| CVE-2020-7610 | Direct | Critical | bson | >= 1.0.0, < 1.1.4 | |
| 165 | + |
| 166 | + </template> |
| 167 | + |
| 168 | +</TableTabs> |
| 169 | + |
| 170 | +If you are interested in the TuxCare Endless Lifecycle Support, contact [sales@tuxcare.com](mailto:sales@tuxcare.com). |
0 commit comments