JQ/GNU Patch Mitigation/Remediation

[lancemendelson]

WinMerge Findings.docx
Requesting assistance in potential mitigations/remediations for the two (2) components listed in the attached document:
JQ/GNU Patch
and, a letter, if available, that WinMerge keep OSS components up to date.

[lancemendelson]

@sdottaka - Thank you for the update. Is GNU Patch available to update? If not, can the component be removed w/ no adverse impact to WinMerge's core functionality? Also, the OSS component support portion. Does WinMerge have a forward-facing commitment (other than your appreciated proof of suggesting the JQ update for a future commit) to updating vulnerable components used by WinMerge?

[sdottaka]

Alternatives to patch.exe are under consideration.

patch.exe is only used by the Apply Patch plugin, so if you are not using this plugin you can remove it. Also, if you uncheck Plugins on the Select Components page of the installer, it will not be installed.

[lancemendelson]

Understood. Thank you for the response. Would there happen to be an estimate on the commit to mitigate the CVE making it into a release?

[sdottaka]

Updated jq and patch versions in WinMerge version 2.16.31 beta.