-
-
Notifications
You must be signed in to change notification settings - Fork 30
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Backport of v1.2.6 fixes to v0.2.x? #11
Comments
Yes, I’ll do a few backports. |
The Running manual tests against the proof of concept attacks in Sync:
A successful mitigation against pollution prints undefined. % npm i --silent [email protected]
% node poc1
value0
% node poc2
value1
% node poc3
bar
% npm i --silent [email protected]
% node poc1
undefined
% node poc2
undefined
% node poc3
bar
% npm i --silent [email protected]
% node poc1
undefined
% node poc2
undefined
% node poc3
undefined |
Which commits/PRs are still unbackported? |
I think we are good to go ahead with requesting update to vulnerability information (not that I have any idea of the process!). [email protected] includes the new backport: |
Awesome. I'm not sure how to go about that. If there's specific things (github and/or snyk) then with the links to those, I can pursue updating them to note that v0.2.4+ isn't vulnerable. |
The current audit link references advisories for the first vulnerability:
The Synk links for both vulnerabilities are in #11 (comment) |
https://security.snyk.io/vuln/SNYK-JS-MINIMIST-559764 is already fixed in v0.2.1+. I've pinged someone at Snyk for https://security.snyk.io/vuln/SNYK-JS-MINIMIST-2429795. Filed github/advisory-database#1725 for the npm audit one. |
For interest of gentle readers, the unit tests for prototype pollution on the v0.2.x branch are: https://github.com/minimistjs/minimist/blob/v0.2.x/test/proto.js |
|
I have submitted updates to the CVE entries themselves via the CVE numbering authority for the issues: https://cveform.mitre.org/ |
I think this is resolved; please file a new issue if there's any remaining vulnerabilities in a minor line. |
Thanks to the new maintainers for taking over this project. I see a new version of the v0.2.x line has been published even though it still seems to be covered by CVE-2021-44906.
Is there any possibility of the fix from v1.2.6 being backported, or is it necessary at all? I ask because the maintainers of one of the other packages we use have thus far not responded to suggestions to update and a patch update to the v0.2.x line would obviate the need for that.
And yes, I'm aware we can also use yarn resolutions, NPM overrides, etc. and the risk is probably fairly minimal in our use case – but I assume there's a reason the v0.2.x line is being maintained.
The text was updated successfully, but these errors were encountered: