fix(cactus-example-supply-chain-app): mitigate CVE-2022-24434 and CVE-2022-24999 #2242
Conversation
aldousalvarez
requested review from
petermetz,
takeutak,
izuru0,
jagpreetsinghsasan and
sandeepnRES
as code owners
|
Hello @petermetz , Most of the vulnerabilities are now fixed in cactus-example-supply-chain-app but there are still some that is not yet fixed as you can see here. The only vulnerability (CVE-2022-2421) is still a vulnerability because the latest version of the package that is being used is still the affected version. The changes committed on this PR will fix the 3 out of the 4 remaining vulnerabilities (CVE-2022-24434, CVE-2022-24999, and CVE-2022-24999) once the changes are applied and the new version is released and the packages are updated just like the v1.1 release. |
aldousalvarez
force-pushed
the
aldousalvarez/issue2041
branch
from
c5cd121
to
025e788
Compare
aldousalvarez
force-pushed
the
aldousalvarez/issue2041
branch
from
025e788
to
90d8e8a
Compare
aldousalvarez
requested review from
petermetz
and removed request for
sandeepnRES,
jagpreetsinghsasan and
takeutak
aldousalvarez
force-pushed
the
aldousalvarez/issue2041
branch
from
90d8e8a
to
5ea5f51
Compare
There was a problem hiding this comment.
@aldousalvarez Sorry, my bad, I do need to ask that you put CVE IDs in the commit subject so that it's unique across the commit log. Other than that, we are good to go.
️✅ There are no secrets present in this pull request anymore.If these secrets were true positive and are still valid, we highly recommend you to revoke them. 🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request. |
aldousalvarez
force-pushed
the
aldousalvarez/issue2041
branch
from
2d5cd84
to
9caa028
Compare
aldousalvarez
changed the title
|
Hello @petermetz also updated the commit subject and PR title as from your requested changes on this one. Thank you. |
…-2022-24999 Fixes hyperledger-cacti#2041 These changes will fixx the following vulnerabilities with their CVE IDs: - CVE-2022-24434 - CVE-2022-24999 (express) - CVE-2022-24999 (qs) Signed-off-by: aldousalvarez <[email protected]> Signed-off-by: Peter Somogyvari <[email protected]>
petermetz
force-pushed
the
aldousalvarez/issue2041
branch
from
9caa028
to
d28d5e8
Compare
Fixes #2041
Signed-off-by: aldousalvarez [email protected]