Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security: npm upgrade packages #22

Closed
Tracked by #19
jfrerich opened this issue May 25, 2021 · 1 comment
Closed
Tracked by #19

Security: npm upgrade packages #22

jfrerich opened this issue May 25, 2021 · 1 comment
Labels
Difficulty/1:Easy Easy ticket Type/Task A general task
Milestone

Comments

@jfrerich
Copy link
Contributor

Hi @kosgrz

So far, following dependent npm packages are found to be vulnerable. Request you to upgrade the same. The security analysis is still in progress. I will post an update here once its complete. But meanwhile I thought to give you a heads up on the issues identified so far.

  • before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in .
    Severity: Moderate
    References: https://www.npmjs.com/advisories/1648
    Remediation: Upgrade to version 6.5.4 or later

  • before version 1.3.6 has a Prototype Pollution vulnerability.
    Severity: Low
    References: https://www.npmjs.com/advisories/1589
    Remediation: Upgrade to version 1.3.6 or later.

  • Node Fetch did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure.
    Severity: Low
    References: https://www.npmjs.com/advisories/1556
    Remediation: Upgrade to version 2.6.1 or 3.0.0-beta.9

  • before versions 3.2.2, 4.0.1, and 5.0.5 is vulnerable to prototype pollution.
    Severity: High
    References: https://www.npmjs.com/advisories/1654
    Remediation: Upgrade to version 3.2.2, 4.0.1, 5.0.5 or later

  • Affected versions of are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of , causing the addition or modification of an existing property that will exist on all objects.
    Severity: Low
    References: https://www.npmjs.com/advisories/1500
    Remediation: Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.

Originally posted by @srkgupta in #5 (comment)

@jfrerich jfrerich added the Type/Task A general task label May 26, 2021
@jfrerich jfrerich added this to the v1.1.0 milestone May 26, 2021
@hanzei hanzei added the Difficulty/1:Easy Easy ticket label Jul 1, 2021
@hanzei hanzei linked a pull request Aug 3, 2021 that will close this issue
@hanzei hanzei mentioned this issue Sep 28, 2021
5 tasks
@mickmister
Copy link
Contributor

Closing due to this project not actually using these dependencies that have these vulnerabilities

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Difficulty/1:Easy Easy ticket Type/Task A general task
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants