Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(security): remedy CVE-2021-3749 #1569

Closed
petermetz opened this issue Nov 23, 2021 · 0 comments · Fixed by #1571
Closed

fix(security): remedy CVE-2021-3749 #1569

petermetz opened this issue Nov 23, 2021 · 0 comments · Fixed by #1571
Assignees
@petermetz
Labels
dependencies Pull requests that update a dependency file Security Related to existing or potential security vulnerabilities

Comments

@petermetz
Copy link
Contributor

Description

1 axios vulnerability found in yarn.lock
Remediation
Upgrade axios to version 0.21.2 or later. For example:

axios@^0.21.2:
version "0.21.2"
Always verify the validity and compatibility of suggestions with your codebase.

Details
CVE-2021-3749: GHSA-cph5-m8f7-6c5x
high severity
Vulnerable versions: <= 0.21.1
Patched version: 0.21.2
axios is vulnerable to Inefficient Regular Expression Complexity
@petermetz petermetz added dependencies Pull requests that update a dependency file Security Related to existing or potential security vulnerabilities labels Nov 23, 2021
@petermetz petermetz self-assigned this Nov 23, 2021
petermetz added a commit to petermetz/cacti that referenced this issue Nov 23, 2021
@petermetz
fix(security): remedy CVE-2021-3749
1e260a8 
Upgrading the remainig two packages to the latest and greatest
version of the axios dependency which makes it consistent
across the monorepo plus eliminates the CVE in question.

Fixes hyperledger-cacti#1569

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
@petermetz petermetz mentioned this issue Nov 23, 2021
Merged
petermetz added a commit that referenced this issue Nov 28, 2021
@petermetz
fix(security): remedy CVE-2021-3749
b33aa90 
Upgrading the remainig two packages to the latest and greatest
version of the axios dependency which makes it consistent
across the monorepo plus eliminates the CVE in question.

Fixes #1569

Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@petermetz petermetz

Labels
dependencies Pull requests that update a dependency file Security Related to existing or potential security vulnerabilities
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix(security): remedy CVE-2021-3749 petermetz/cacti
1 participant
@petermetz