Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fixed packages vulnerability from backend #463

Merged

Conversation

manishdas12
Copy link
Contributor

What this PR does / why we need it: update the vulnerable packages from backend explorer

Which issue(s) this PR fixes: packages vulnerabilities from backend application

Fixes #458

Special notes for your reviewer:

Does this PR introduce a user-facing change: None


Additional documentation, usage docs, etc.:

  1. "ejs":"^2.5.6" ----> "^3.1.9", [critical]
  2. "grpc": "^1.20.3" ----> "^1.24.11"
  3. "jsonwebtoken":"^8.5.0", ----> "^9.0.2" [moderate]

NOTE: jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC
ref url: GHSA-hjrf-2m68-5959
jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()
ref url: GHSA-qwph-4952-7xr6

  1. "multer": "^1.3.0" ----> "^1.4.5-lts.1", ---> dicer[Severity: high],
    busboy(Depends on vulnerable versions of dicer),
    multer(Depends on vulnerable versions of busboy)

NOTE- busboy---> dependency package of multer
dicer----> dependency package of busboy

  1. "passport": "^0.4.0", ----> "^0.6.0", ----> Severity: moderate

NOTE: Passport vulnerable to session regeneration when a users logs in or out - GHSA-v923-w3x8-wh69

  1. "sequelize": "^6.12.2", ------> "^6.33.0",

  2. "mocha": "^8.2.1", ----> "^10.2.0", ----> mocha v5.1.0 - v9.2.1 Depends on vulnerable versions of "minimatch" and "nanoid"
    [minimatch <3.0.5 Severity: high]
    [nanoid 3.0.0 - 3.1.30 Severity: moderate]


Signed-off-by: manishdas12 <[email protected]>
@manishdas12 manishdas12 requested a review from a team as a code owner October 18, 2023 11:28
@ArchanaArige ArchanaArige self-requested a review October 31, 2023 06:07
Copy link
Contributor

@ArchanaArige ArchanaArige left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good.

@ArchanaArige ArchanaArige merged commit f471233 into hyperledger-labs:main Oct 31, 2023
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

BE - Package Updates
2 participants