Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Outdated dependencies with moderate severity security issues (CVE-2023-45857) #794

Closed
JamesBurnside opened this issue Jan 4, 2024 · 2 comments · Fixed by #862
Closed
Labels
dependencies Pull requests that update a dependency file priority: high (P0) High priority version: ga Issues related to major/GA releases
Milestone

Comments

@JamesBurnside
Copy link
Member

tl;dr - wait-on dependency needs updated to update axios sub-dependency version

Describe the bug
Nested dependency axios needs updated for CVE-2023-45857 (axios/axios#6006) this is fixed in axios.
This dependency appears to stem from the wait-on package that has since updated to fix this: jeffbski/wait-on#147

Expected outcome
Update wait-on dependency to v7.2.0+

@Roger-Sa
Copy link

Roger-Sa commented Feb 9, 2024

update-notifier also needs update:
yeoman/update-notifier#218

Fixed in 6.0.0 (Jun 23, 2022), latest version 7.0.0 (Oct 27, 2023).

Complete audit report:

axios  0.8.1 - 1.5.1
Severity: moderate
Axios Cross-Site Request Forgery Vulnerability - https://github.com/advisories/GHSA-wf5p-g6vw-rhxx
fix available via `npm audit fix --force`
Will install @azure/static-web-apps-cli@0.2.1, which is a breaking change
node_modules/axios
  wait-on  5.0.0-rc.0 - 7.1.0
  Depends on vulnerable versions of axios
  node_modules/wait-on
    @azure/static-web-apps-cli  >=0.3.0
    Depends on vulnerable versions of update-notifier
    Depends on vulnerable versions of wait-on
    node_modules/@azure/static-web-apps-cli

got  <11.8.5
Severity: moderate
Got allows a redirect to a UNIX socket - https://github.com/advisories/GHSA-pfrx-2q88-qq97
fix available via `npm audit fix --force`
Will install @azure/static-web-apps-cli@0.2.1, which is a breaking change
node_modules/got
  package-json  <=6.5.0
  Depends on vulnerable versions of got
  node_modules/package-json
    latest-version  0.2.0 - 5.1.0
    Depends on vulnerable versions of package-json
    node_modules/latest-version
      update-notifier  0.2.0 - 5.1.0
      Depends on vulnerable versions of latest-version
      node_modules/update-notifier

@adrianhall adrianhall added priority: high (P0) High priority dependencies Pull requests that update a dependency file version: ga Issues related to major/GA releases labels Jul 1, 2024
@adrianhall adrianhall added this to the 1.1.11 milestone Jul 1, 2024
@adrianhall
Copy link
Member

Let's generalize this and ensure all "npm audit" packages are upgraded.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file priority: high (P0) High priority version: ga Issues related to major/GA releases
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants