Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Latest Azurite version has vulnerable dependencies #2500

Open
joelverhagen opened this issue Nov 11, 2024 · 0 comments
Open

Latest Azurite version has vulnerable dependencies #2500

joelverhagen opened this issue Nov 11, 2024 · 0 comments
Assignees
Labels
dependencies Pull requests that update a dependency file

Comments

@joelverhagen
Copy link
Contributor

This may be blocked by #2470.

Steps to repro:

  1. npm init
  2. npm install azurite --save --include=dev
  3. npm audit

The audit report suggests a downgrade to Azurite 3.12.0 despite having just installed Azurite 3.33.0.

There is no clear way to resolve the vulnerable package errors while staying on the latest Azurite version.

The audit report is here:

up to date, audited 308 packages in 2s

67 packages are looking for funding
  run `npm fund` for details

# npm audit report

@azure/identity  <4.2.1
Severity: moderate
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability - https://github.com/advisories/GHSA-m5vv-6r4h-3vj9
fix available via `npm audit fix --force`
Will install azurite@3.12.0, which is a breaking change
node_modules/@azure/identity
  tedious  11.0.9 - 18.2.0
  Depends on vulnerable versions of @azure/identity
  node_modules/tedious
    azurite  >=3.0.0-preview
    Depends on vulnerable versions of @azure/ms-rest-js
    Depends on vulnerable versions of axios
    Depends on vulnerable versions of tedious
    node_modules/azurite

axios  0.8.1 - 0.27.2
Severity: moderate
Axios Cross-Site Request Forgery Vulnerability - https://github.com/advisories/GHSA-wf5p-g6vw-rhxx
fix available via `npm audit fix --force`
Will install azurite@3.12.0, which is a breaking change
node_modules/@azure/ms-rest-js/node_modules/axios
node_modules/axios
  @azure/ms-rest-js  <=2.6.6
  Depends on vulnerable versions of axios
  Depends on vulnerable versions of tough-cookie
  Depends on vulnerable versions of xml2js
  node_modules/@azure/ms-rest-js

tough-cookie  <4.1.3
Severity: moderate
tough-cookie Prototype Pollution vulnerability - https://github.com/advisories/GHSA-72xf-g2v4-qvf3
fix available via `npm audit fix --force`
Will install azurite@3.12.0, which is a breaking change
node_modules/tough-cookie

xml2js  <0.5.0
Severity: moderate
xml2js is vulnerable to prototype pollution - https://github.com/advisories/GHSA-776f-qx25-q3cc
fix available via `npm audit fix --force`
Will install azurite@3.12.0, which is a breaking change
node_modules/@azure/ms-rest-js/node_modules/xml2js

7 moderate severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force
@blueww blueww added the dependencies Pull requests that update a dependency file label Dec 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

No branches or pull requests

3 participants