Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix moderate and low issues from npm audit related to node-forge #80

Open
jasonhocker opened this issue Feb 1, 2022 · 0 comments
Open

Comments

@jasonhocker
Copy link

Please do not report security vulnerabilities here. The Responsible Disclosure Program details the procedure for disclosing security issues.

Thank you in advance for helping us to improve this library! Your attention to detail here is greatly appreciated and will help us respond as quickly as possible. For general support or usage questions, use the Auth0 Community or Auth0 Support. Finally, to avoid duplicates, please search existing Issues before submitting one here.

By submitting an Issue to this repository, you agree to the terms within the Auth0 Code of Conduct.

Describe the problem you'd like to have solved

No issues with npm audit

Describe the ideal solution

No issues with npm audit

Alternatives and current work-arounds

None

Additional context

Add any other context or screenshots about the feature request here.

                   === npm audit security report ===                        

┌──────────────────────────────────────────────────────────────────────────────┐
│ Manual Review │
│ Some vulnerabilities require your attention to resolve │
│ │
│ Visit https://go.npm.me/audit-guide for additional guidance │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low │ Prototype Pollution in node-forge debug API. │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ node-forge │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=1.0.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ saml │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ saml > xml-encryption > node-forge │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ GHSA-5rrq-pxf6-6jx5
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low │ URL parsing in node-forge could lead to undesired behavior. │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ node-forge │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=1.0.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ saml │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ saml > xml-encryption > node-forge │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ GHSA-gf8q-jrpm-jvxq
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Open Redirect in node-forge │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ node-forge │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=1.0.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ saml │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ saml > xml-encryption > node-forge │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ GHSA-8fr3-hfg3-gpgp
└───────────────┴──────────────────────────────────────────────────────────────┘

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant