[GHSA-fwr7-v2mv-hh25] Prototype Pollution in async #1771
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
changed the base branch from
main
to
westonsteimel/advisory-improvement-1771
|
@westonsteimel Thank you! The 1.5 documentation didn't mention the mapValues function at all, so I did some spelunking and found that it was added in this PR, so the vulnerable code did not exist prior to 2.x. |
|
Ah great, thanks for taking a further look at this one. Much appreciated! |
|
No problem! |
westonsteimel
added a commit
to anchore/vulnerability-match-labels
that referenced
this pull request
Mar 13, 2023
Per GHSA-fwr7-v2mv-hh25, versions prior to 2.0.0 are not vulnerable as the method didn't exist in prior versions. Full discussion on this one at github/advisory-database#1771 Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
westonsteimel
added a commit
to anchore/vulnerability-match-labels
that referenced
this pull request
Mar 13, 2023
Per GHSA-fwr7-v2mv-hh25, versions prior to 2.0.0 are not vulnerable as the method didn't exist in prior versions. Full discussion on this one at github/advisory-database#1771 Signed-off-by: Weston Steimel <weston.steimel@anchore.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Updates
Comments
Apologies as I couldn't find much information on this one, but the NVD entry does suggest that prior to 2.x should be considered affected as well (I understand that isn't always particularly reliable though). I did see this comment which suggested perhaps the vulnerability doesn't actually apply to prior versions, but I wasn't really sure so would appreciate any help in verifying that. Thanks for maintaining such a great dataset!