New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Security upgrade solidity-bytes-utils from 0.0.9 to 0.8.2 #21

Open

Kashuhackerone wants to merge 1 commit into master from snyk-fix-32a67b30e7cdd0291ac2d67c27345361

Owner

Kashuhackerone commented Jan 15, 2024

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json

⚠️

Warning

Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	619/1000 Why? Has a fix available, CVSS 8.1	Prototype Pollution SNYK-JS-AJV-584908	No	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-ASYNC-2441827	No	Proof of Concept
	786/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 9.3	Incomplete List of Disallowed Inputs SNYK-JS-BABELTRAVERSE-5962462	No	Proof of Concept
	644/1000 Why? Has a fix available, CVSS 8.6	Prototype Pollution SNYK-JS-JSONSCHEMA-1920922	No	No Known Exploit
	539/1000 Why? Has a fix available, CVSS 6.5	Information Exposure SNYK-JS-NODEFETCH-2342118	No	No Known Exploit
	520/1000 Why? Has a fix available, CVSS 5.9	Denial of Service SNYK-JS-NODEFETCH-674311	No	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHPARSE-1077067	No	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Poisoning SNYK-JS-QS-3153490	No	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	No	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	No	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	No	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-WS-1296835	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: solidity-bytes-utils

The new version differs by 21 commits.

e0115c4 chore: release version 0.8.2
ed7bfb7 feat: foundry (R4R: add queryRequiredLockAmountForBind bnb-chain/bsc-genesis-contract#65)
42221d3 chore: release version 0.8.1
082ed28 Update README.md
1dff13e Add equal_nonAligned byte array method (R4R: replace addChannel or addOrUpdateChannel bnb-chain/bsc-genesis-contract#64)
6458fb2 Hotfix README install command 😬
83a5468 Merge branch 'develop'
5d251ad v0.8.0 - Solidity >0.8.0 support! 🎉 ( Validator count is not enforced in the smart contracts bnb-chain/bsc-genesis-contract#46)
9cb61ce Bump version to v0.1.2 + update README
e470a89 Fix zero-length slice taint bug (Potential integer underflow in RelayerHub bnb-chain/bsc-genesis-contract#43)
889455e Add Solidity syntax highlight. (perform the gas analyses for worst-case executions scenarios bnb-chain/bsc-genesis-contract#41)
f0cbe0d Bump version to v0.1.1
9491c70 Fix/critical bounds bug (Bump lodash from 4.17.15 to 4.17.19 bnb-chain/bsc-genesis-contract#40)
d36cc46 Fix/critical bounds bug v2 ([Snyk] Security upgrade web3 from 1.2.8 to 4.0.1 #39)
f6c9d14 Merge branch 'master' of github.com:GNSPS/solidity-bytes-utils
406e282 Bump version to v.0.1.0
916de66 Fix/critical bounds bug ([Snyk] Fix for 1 vulnerabilities #37)
8a52148 Merge branch 'develop'
358c9db Update pragmas to compile with Solidity v0.6.x + add SPDX comments + bump version
b1b22d1 Improve contracts ([Snyk] Security upgrade web3 from 1.2.8 to 4.0.1 #31)
c872be1 Minor updates ([Snyk] Security upgrade web3 from 1.2.8 to 4.0.1 #32)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Denial of Service
🦉 Server-side Request Forgery (SSRF)


          fix: package.json to reduce vulnerabilities

aa07951

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-AJV-584908
- https://snyk.io/vuln/SNYK-JS-ASYNC-2441827
- https://snyk.io/vuln/SNYK-JS-BABELTRAVERSE-5962462
- https://snyk.io/vuln/SNYK-JS-JSONSCHEMA-1920922
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-2342118
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-674311
- https://snyk.io/vuln/SNYK-JS-PATHPARSE-1077067
- https://snyk.io/vuln/SNYK-JS-QS-3153490
- https://snyk.io/vuln/SNYK-JS-REQUEST-3361831
- https://snyk.io/vuln/SNYK-JS-SEMVER-3247795
- https://snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873
- https://snyk.io/vuln/SNYK-JS-WS-1296835

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet