-
Notifications
You must be signed in to change notification settings - Fork 539
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix CVE in jsonpath-plus (again) #1960
Comments
@mstruebing |
No current eta, but probably within the week. fwiw, this library only uses this library for kubeconfig file loading. If you have malicious JSONPath in your kubeconfig, you have far worse problems than this RCE. Also, unless your kubeconfig contains a jsonpath value you're not impacted by this CVE. |
@brendandburns thanks for the update/ETA, and for the added info. FWIW, I am not concerned about the actual vulnerability, as I'd gathered that it's not truly exploitable. Rather it's about making the vulnerability scanners happy (remind me, do we work for them, or they for us?). But good to know about how it impacts this library - thanks again! |
@timd73 just pushed 0.22.2 to npm with the revised dependency. |
That actually makes sense as it seems like we also don't publish our |
Describe the bug
The jsonpath-plus dependency contains a critical CVE, even after upgrading to
10.0.0
: CVE-2024-21534The library has been fixed as of version 10.0.7 or higher.
There's an open dependabot PR for resolution.
** Client Version **
0.22.1
Environment (please complete the following information):
Additional context
The text was updated successfully, but these errors were encountered: