Denial of Service in stellar-sdk dependency

[tylerlevine]

There is a known vulnerability in axios, a dependency of stellar-sdk. This issue serves to track fixes to the upstream dependencies, so that once a fix is released, this package can update stellar-sdk to a fixed version.

The vulnerability has been classified as medium severity, but there is currently no known way to exploit this issue via stellar-sdk. Therefore, to the best of our knowledge, the bitgo package is not affected and is not vulnerable to this DoS issue.

Vulnerability summary: https://snyk.io/vuln/SNYK-JS-AXIOS-174505
Issue in stellar-sdk: stellar/js-stellar-sdk#268
Issue in axios: axios/axios#1098
Fix attempt 1 in axios: axios/axios#1485

[tylerlevine]

This has now been fixed upstream.