Hi Dan, > We've been made aware of a vulnerability with something called node.js > and have been asked to contact all our Third Parties. Does this affect > J Meter in any way?
No, it doesn't. JMeter is a Java application that runs on a Java Virtual Machine; it neither includes nor needs Node.js, which is a runtime for applications written in JavaScript. The advisories you mention don't apply to JMeter. Node.js might still be installed on some of your machines for other reasons, but not because of JMeter. Since questions like yours reach ASF projects quite often, I'd like to understand the process behind them, so we can make answering them easier for you: 1. Who asked you to contact your third parties: your security team, procurement/vendor management, compliance? 2. Did they give you one advisory to check against every product you use, or a list of products that might be affected? 3. What happens with the answer afterwards: does it go into a spreadsheet, a ticket, a vendor-risk tool? If possible, we would love a public answer on this list, even a sanitized one without names or internal details: many other companies go through the same process, and your answer could help us improve things for all of them. If that's not possible, feel free to answer me directly. One thing that could help: a small but growing number of ASF projects publish a Software Bill of Materials (SBOM) with their releases. An SBOM lists every component shipped with an application, so your security team could load it into a tool like Dependency-Track or SecObserve and check by themselves whether a new advisory applies, without having to email every supplier. Would an SBOM for JMeter be useful to them? Piotr --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
