New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 13 vulnerabilities #592

Open

leojoy95 wants to merge 1 commit into master from snyk-fix-249157b5221d4aa607199672ee92a3ad

Owner

leojoy95 commented Oct 19, 2022

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- packages/faucet/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	554/1000 Why? Has a fix available, CVSS 6.8	Cryptographic Issues SNYK-JS-ELLIPTIC-1064899	No	No Known Exploit
	509/1000 Why? Has a fix available, CVSS 5.9	Timing Attack SNYK-JS-ELLIPTIC-511941	No	No Known Exploit
	706/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.7	Cryptographic Issues SNYK-JS-ELLIPTIC-571484	No	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-FIREBASEUTIL-1038324	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-JSONBIGINT-608659	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Open Redirect SNYK-JS-NODEFORGE-2330875	Yes	Proof of Concept
	529/1000 Why? Has a fix available, CVSS 6.3	Prototype Pollution SNYK-JS-NODEFORGE-2331908	Yes	No Known Exploit
	494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430337	Yes	No Known Exploit
	579/1000 Why? Has a fix available, CVSS 7.3	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430339	Yes	No Known Exploit
	494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430341	Yes	No Known Exploit
	596/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.5	Arbitrary Code Injection SNYK-JS-UNDERSCORE-1080984	No	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-WS-1296835	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: firebase-tools

The new version differs by 250 commits.

4482156 11.14.0
5504f7c Version bump emulator UI to 1.10.0. (celocli multisig:show --all will show transaction data as null celo-org/celo-monorepo#5065)
210a40e Fix Hosting validation ([Wallet] Adding signer to GethNativeBridgeWallet if it hasn't already been added celo-org/celo-monorepo#5060)
7d9ece6 Single project mode (#4890)
cd737c9 Adds emulator support for v2 rtdb triggers (setup monitoring of stats.celo.org on web roation celo-org/celo-monorepo#5045)
443d13b Wire up pinTag ([N01] Unnecessary imports celo-org/celo-monorepo#5047)
3a92daf Depend on API library
6e3eff7 Consolidate config utilities and add better typing (Native CELO transfers don't appear in the feed celo-org/celo-monorepo#5017)
2358663 upgrade superstatic ([FLAKEY TEST] cli-test -> cli -> account metadata cmds -> Modifying the metadata file -> account:create-metadata cmd celo-org/celo-monorepo#4935)
9e524c1 [firebase-release] Removed change log and reset repo after 11.13.0 release
001a6bd 11.13.0
3b48be0 Adds test lab triggers to firebase deploy ([Attestation Service] get_attestations endpoint, HA support for delivery receipts celo-org/celo-monorepo#5011)
3b4d850 Allow emulators to work offline (MOTD fail) ([Wallet] Failed to sync after Verification Countdown + Restart celo-org/celo-monorepo#4998)
4184ad7 moves esbuild to an optional dependency; requires node 16 for frameworks (Sane minimum values for governance process parameters celo-org/celo-monorepo#5052)
a7d1133 fix(webframeworks) Rename frameworkawareness -> webframeworks (upgrade React-native-web to 13 celo-org/celo-monorepo#5043)
b38d0c7 Set default values properly for selector params ([Wallet] Remove fee calculation for CELO withdrawals celo-org/celo-monorepo#5042)
02c4e41 [Function-NoOp] Integration test to verify skipping deploy is WAI ([FLAKEY TEST] end-to-end-mobile-test-android -> mobile -> Run tests -> Withdraw CELO -> Return to the Exchange CELO screen after confirming. celo-org/celo-monorepo#4993)
cadc9ef [Function-NoOp] Enable Skipping NoOp Deploys by Default ([L14] Solidity compiler version is not pinned and it is not the same for all contracts celo-org/celo-monorepo#5032)
c3ec450 Implement Experiments feature ([FLAKEY TEST] end-to-end-mobile-test-android -> mobile -> Run tests -> Withdraw CELO -> Fill the information and confirm withdrawal celo-org/celo-monorepo#4994)
20d3d7c [firebase-release] Removed change log and reset repo after 11.12.0 release
8cfedbd 11.12.0
3719991 Fix changelog for websocket port ([Wallet] Fix escrow failing randomly with local currency celo-org/celo-monorepo#5039)
2ec0a60 fetch hosting site instead of default instance for opening a hosting site (#5030)
a376bcf upgrade some deps to address audit issues ([N05] Lack of outcome validation celo-org/celo-monorepo#5036)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Cryptographic Issues
🦉 Cryptographic Issues
🦉 More lessons are available in Snyk Learn


          fix: packages/faucet/package.json to reduce vulnerabilities

5d35665

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899
- https://snyk.io/vuln/SNYK-JS-ELLIPTIC-511941
- https://snyk.io/vuln/SNYK-JS-ELLIPTIC-571484
- https://snyk.io/vuln/SNYK-JS-FIREBASEUTIL-1038324
- https://snyk.io/vuln/SNYK-JS-JSONBIGINT-608659
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2330875
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2331908
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430337
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430339
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430341
- https://snyk.io/vuln/SNYK-JS-UNDERSCORE-1080984
- https://snyk.io/vuln/SNYK-JS-WS-1296835

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet