Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Dependencies] Update dependencies to resolve vulnerabilities #15

Closed
WeirdAlex03 opened this issue Oct 5, 2022 · 0 comments · Fixed by #16
Closed

[Dependencies] Update dependencies to resolve vulnerabilities #15

WeirdAlex03 opened this issue Oct 5, 2022 · 0 comments · Fixed by #16
Assignees
Labels
bug Something isn't working

Comments

@WeirdAlex03
Copy link
Collaborator

Subject of the issue


npm audit reports 14 vulnerabilities (9 moderate, 3 high, 2 critical) with dependencies. One of these (passport) requires a breaking change from ^0.4.1 to ^0.6.0.

Any relevant logs, error output, etc?


If it's long, please link to a relevant public GitHub Gist

npm audit report

npm audit report

ansi-regex 5.0.0
Severity: high
Inefficient Regular Expression Complexity in chalk/ansi-regex - GHSA-93q8-gq69-wqmw
fix available via npm audit fix
node_modules/ansi-regex

minimist <1.2.6
Severity: critical
Prototype Pollution in minimist - GHSA-xvch-5gv4-984h
fix available via npm audit fix
node_modules/minimist

node-forge <=1.2.1
Severity: high
Open Redirect in node-forge - GHSA-8fr3-hfg3-gpgp
Prototype Pollution in node-forge debug API. - GHSA-5rrq-pxf6-6jx5
Improper Verification of Cryptographic Signature in node-forge - GHSA-2r2c-g63r-vccr
Improper Verification of Cryptographic Signature in node-forge - GHSA-x4jg-mjrx-434g
Improper Verification of Cryptographic Signature in node-forge - GHSA-cfm4-qjh2-4765
URL parsing in node-forge could lead to undesired behavior. - GHSA-gf8q-jrpm-jvxq
fix available via npm audit fix
node_modules/node-forge
xml-encryption <=1.3.0
Depends on vulnerable versions of node-forge
Depends on vulnerable versions of xmldom
node_modules/xml-encryption
passport-saml 0.0.2 - 3.2.0
Depends on vulnerable versions of xml-encryption
Depends on vulnerable versions of xmldom
node_modules/passport-saml

passport <0.6.0
Severity: moderate
Passport before 0.6.0 vulnerable to session regeneration when a users logs in or out - GHSA-v923-w3x8-wh69
fix available via npm audit fix --force
Will install [email protected], which is a breaking change
node_modules/passport

shell-quote <=1.7.2
Severity: critical
Improper Neutralization of Special Elements used in a Command in Shell-quote - GHSA-g4rg-993r-mgx7
fix available via npm audit fix
node_modules/shell-quote

swagger-ui-dist <=4.1.2
Severity: moderate
Spoofing attack in swagger-ui-dist - GHSA-6c9x-mj3g-h47x
Server side request forgery in SwaggerUI - GHSA-qrmm-w75w-3wpx
fix available via npm audit fix
node_modules/swagger-ui-dist
swagger-ui-express 4.0.0 - 4.1.6
Depends on vulnerable versions of swagger-ui-dist
node_modules/swagger-ui-express

tmpl <1.0.5
Severity: high
tmpl vulnerable to Inefficient Regular Expression Complexity which may lead to resource exhaustion - GHSA-jgrx-mgxx-jf9v
fix available via npm audit fix
node_modules/tmpl

validator <=13.6.0
Severity: moderate
Inefficient Regular Expression Complexity in validator.js - GHSA-qgmg-gppg-76g5
Inefficient Regular Expression Complexity in Validator.js - GHSA-xx4c-jj58-r7x6
fix available via npm audit fix
node_modules/validator
node_modules/z-schema/node_modules/validator
z-schema 4.2.3 || 5.0.0
Depends on vulnerable versions of validator
node_modules/z-schema

xmldom *
Severity: moderate
Misinterpretation of malicious XML input - GHSA-5fg8-2547-mr8q
fix available via npm audit fix
node_modules/xmldom
xml-crypto <=1.5.5 || 2.0.0 - 2.1.2
Depends on vulnerable versions of xmldom
node_modules/xml-crypto

@WeirdAlex03 WeirdAlex03 added the bug Something isn't working label Oct 5, 2022
@WeirdAlex03 WeirdAlex03 self-assigned this Oct 5, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Development

Successfully merging a pull request may close this issue.

1 participant