CVE-2022-0144 (High) detected in shelljs-0.6.1.tgz #1139
Assignees
Labels
cve
Security vulnerabilities detected by Dependabot or Mend
high severity
High severity CVE
Mend: dependency security vulnerability
Security vulnerability detected by Mend
v2.0.0
Comments
mend-for-github-com
bot
added
the
Mend: dependency security vulnerability
tmarkley
added
cve
mend-for-github-com
bot
changed the title
Closed
tmarkley
pushed a commit
to tmarkley/OpenSearch-Dashboards
that referenced
this issue
Feb 28, 2022
* Introduces standard scss rules from stylelint with only a few modifications. * `yarn lint` now runs `yarn lint:style` instead of `yarn lint:sass`. * Many of the files were updated with `yarn lint:style --fix`, but some of them had to be manually updated to adhere to the newly-introduced rules from the stylelint configuration. A major culprit was the `no-descending-specificity` rule. * Some of the automated fixes that changed function names (e.g. EUI functions like `lightOrDarkTheme`) had to be overridden because EUI doesn't adhere to all of the rules. We can address this after we fold in and replace `node-sass` with Dart Sass. Resolves opensearch-project#551 Resolves opensearch-project#1139 Resolves opensearch-project#1151 Resolves opensearch-project#1152 Resolves opensearch-project#1154 Signed-off-by: Tommy Markley <markleyt@amazon.com>
tmarkley
pushed a commit
to tmarkley/OpenSearch-Dashboards
that referenced
this issue
Feb 28, 2022
* Introduces standard scss rules from stylelint with only a few modifications. * `yarn lint` now runs `yarn lint:style` instead of `yarn lint:sass`. * Many of the files were updated with `yarn lint:style --fix`, but some of them had to be manually updated to adhere to the newly-introduced rules from the stylelint configuration. A major culprit was the `no-descending-specificity` rule. * Some of the automated fixes that changed function names (e.g. EUI functions like `lightOrDarkTheme`) had to be overridden because EUI doesn't adhere to all of the rules. We can address this after we fold in and replace `node-sass` with Dart Sass. * Includes a couple fixes such as fixing the class selector for `osdnSuggestionItem--value .osdSuggestionItem__text`. Resolves opensearch-project#551 Resolves opensearch-project#1139 Resolves opensearch-project#1151 Resolves opensearch-project#1152 Resolves opensearch-project#1154 Signed-off-by: Tommy Markley <markleyt@amazon.com>
tmarkley
pushed a commit
to tmarkley/OpenSearch-Dashboards
that referenced
this issue
Mar 1, 2022
* Introduces standard scss rules from stylelint with only a few modifications. * `yarn lint` now runs `yarn lint:style` instead of `yarn lint:sass`. * Many of the files were updated with `yarn lint:style --fix`, but some of them had to be manually updated to adhere to the newly-introduced rules from the stylelint configuration. A major culprit was the `no-descending-specificity` rule. * Some of the automated fixes that changed function names (e.g. EUI functions like `lightOrDarkTheme`) had to be overridden because EUI doesn't adhere to all of the rules. We can address this after we fold in and replace `node-sass` with Dart Sass. * Includes a couple fixes such as fixing the class selector for `osdnSuggestionItem--value .osdSuggestionItem__text`. Resolves opensearch-project#551 Resolves opensearch-project#1139 Resolves opensearch-project#1151 Resolves opensearch-project#1152 Resolves opensearch-project#1154 Signed-off-by: Tommy Markley <markleyt@amazon.com>
tmarkley
pushed a commit
to tmarkley/OpenSearch-Dashboards
that referenced
this issue
Mar 2, 2022
* Introduces standard scss rules from stylelint with only a few modifications. * `yarn lint` now runs `yarn lint:style` instead of `yarn lint:sass`. * Many of the files were updated with `yarn lint:style --fix`, but some of them had to be manually updated to adhere to the newly-introduced rules from the stylelint configuration. A major culprit was the `no-descending-specificity` rule. * Some of the automated fixes that changed function names (e.g. EUI functions like `lightOrDarkTheme`) had to be overridden because EUI doesn't adhere to all of the rules. We can address this after we fold in and replace `node-sass` with Dart Sass. * Includes a couple fixes such as fixing the class selector for `osdnSuggestionItem--value .osdSuggestionItem__text`. Resolves opensearch-project#551 Resolves opensearch-project#1139 Resolves opensearch-project#1151 Resolves opensearch-project#1152 Resolves opensearch-project#1154 Signed-off-by: Tommy Markley <markleyt@amazon.com>
tmarkley
pushed a commit
to tmarkley/OpenSearch-Dashboards
that referenced
this issue
Mar 2, 2022
* Introduces standard scss rules from stylelint with only a few modifications. * `yarn lint` now runs `yarn lint:style` instead of `yarn lint:sass`. * Many of the files were updated with `yarn lint:style --fix`, but some of them had to be manually updated to adhere to the newly-introduced rules from the stylelint configuration. A major culprit was the `no-descending-specificity` rule. * Some of the automated fixes that changed function names (e.g. EUI functions like `lightOrDarkTheme`) had to be overridden because EUI doesn't adhere to all of the rules. We can address this after we fold in and replace `node-sass` with Dart Sass. * Includes a couple fixes such as fixing the class selector for `osdnSuggestionItem--value .osdSuggestionItem__text`. Resolves opensearch-project#551 Resolves opensearch-project#1139 Resolves opensearch-project#1151 Resolves opensearch-project#1152 Resolves opensearch-project#1154 Signed-off-by: Tommy Markley <markleyt@amazon.com>
tmarkley
pushed a commit
to tmarkley/OpenSearch-Dashboards
that referenced
this issue
Mar 4, 2022
* Introduces standard scss rules from stylelint with only a few modifications. * `yarn lint` now runs `yarn lint:style` instead of `yarn lint:sass`. * Many of the files were updated with `yarn lint:style --fix`, but some of them had to be manually updated to adhere to the newly-introduced rules from the stylelint configuration. A major culprit was the `no-descending-specificity` rule. * Some of the automated fixes that changed function names (e.g. EUI functions like `lightOrDarkTheme`) had to be overridden because EUI doesn't adhere to all of the rules. We can address this after we fold in and replace `node-sass` with Dart Sass. * Includes a couple fixes such as fixing the class selector for `osdnSuggestionItem--value .osdSuggestionItem__text`. Resolves opensearch-project#551 Resolves opensearch-project#1139 Resolves opensearch-project#1151 Resolves opensearch-project#1152 Resolves opensearch-project#1154 Signed-off-by: Tommy Markley <markleyt@amazon.com>
tmarkley
pushed a commit
to tmarkley/OpenSearch-Dashboards
that referenced
this issue
Mar 4, 2022
* Introduces standard scss rules from stylelint with only a few modifications. * `yarn lint` now runs `yarn lint:style` instead of `yarn lint:sass`. * Many of the files were updated with `yarn lint:style --fix`, but some of them had to be manually updated to adhere to the newly-introduced rules from the stylelint configuration. A major culprit was the `no-descending-specificity` rule. * Some of the automated fixes that changed function names (e.g. EUI functions like `lightOrDarkTheme`) had to be overridden because EUI doesn't adhere to all of the rules. We can address this after we fold in and replace `node-sass` with Dart Sass. * Includes a couple fixes such as fixing the class selector for `osdnSuggestionItem--value .osdSuggestionItem__text`. Resolves opensearch-project#551 Resolves opensearch-project#1139 Resolves opensearch-project#1151 Resolves opensearch-project#1152 Resolves opensearch-project#1154 Signed-off-by: Tommy Markley <markleyt@amazon.com>
tmarkley
pushed a commit
to tmarkley/OpenSearch-Dashboards
that referenced
this issue
Mar 16, 2022
* Introduces standard scss rules from stylelint with only a few modifications. * `yarn lint` now runs `yarn lint:style` instead of `yarn lint:sass`. * Many of the files were updated with `yarn lint:style --fix`, but some of them had to be manually updated with overrides to adhere to the newly-introduced rules from the stylelint configuration. * Includes a couple fixes such as fixing the class selector for `osdnSuggestionItem--value .osdSuggestionItem__text`. Resolves opensearch-project#551 Resolves opensearch-project#1139 Resolves opensearch-project#1151 Resolves opensearch-project#1152 Resolves opensearch-project#1154 Signed-off-by: Tommy Markley <markleyt@amazon.com>
tmarkley
pushed a commit
to tmarkley/OpenSearch-Dashboards
that referenced
this issue
Mar 16, 2022
* Introduces standard scss rules from stylelint with only a few modifications. * `yarn lint` now runs `yarn lint:style` instead of `yarn lint:sass`. * Many of the files were updated with `yarn lint:style --fix`, but some of them had to be manually updated with overrides to adhere to the newly-introduced rules from the stylelint configuration. * Includes a couple fixes such as fixing the class selector for `osdnSuggestionItem--value .osdSuggestionItem__text`. Resolves opensearch-project#551 Resolves opensearch-project#1139 Resolves opensearch-project#1151 Resolves opensearch-project#1152 Resolves opensearch-project#1154 Signed-off-by: Tommy Markley <markleyt@amazon.com>
tmarkley
pushed a commit
to tmarkley/OpenSearch-Dashboards
that referenced
this issue
Mar 17, 2022
* Introduces standard scss rules from stylelint with only a few modifications. * `yarn lint` now runs `yarn lint:style` instead of `yarn lint:sass`. * Many of the files were updated with `yarn lint:style --fix`, but some of them had to be manually updated with overrides to adhere to the newly-introduced rules from the stylelint configuration. * Includes a couple fixes such as fixing the class selector for `osdnSuggestionItem--value .osdSuggestionItem__text`. Resolves opensearch-project#551 Resolves opensearch-project#1139 Resolves opensearch-project#1151 Resolves opensearch-project#1152 Resolves opensearch-project#1154 Signed-off-by: Tommy Markley <markleyt@amazon.com>
tmarkley
pushed a commit
to tmarkley/OpenSearch-Dashboards
that referenced
this issue
Mar 23, 2022
* Introduces standard scss rules from stylelint with only a few modifications. * `yarn lint` now runs `yarn lint:style` instead of `yarn lint:sass`. * Many of the files were updated with `yarn lint:style --fix`, but some of them had to be manually updated with overrides to adhere to the newly-introduced rules from the stylelint configuration. * Includes a couple fixes such as fixing the class selector for `osdnSuggestionItem--value .osdSuggestionItem__text`. Resolves opensearch-project#551 Resolves opensearch-project#1139 Resolves opensearch-project#1151 Resolves opensearch-project#1152 Resolves opensearch-project#1154 Signed-off-by: Tommy Markley <markleyt@amazon.com>
tmarkley
pushed a commit
to tmarkley/OpenSearch-Dashboards
that referenced
this issue
Mar 25, 2022
* Introduces standard scss rules from stylelint with only a few modifications. * `yarn lint` now runs `yarn lint:style` instead of `yarn lint:sass`. * Many of the files were updated with `yarn lint:style --fix`, but some of them had to be manually updated with overrides to adhere to the newly-introduced rules from the stylelint configuration. * Includes a couple fixes such as fixing the class selector for `osdnSuggestionItem--value .osdSuggestionItem__text`. Resolves opensearch-project#551 Resolves opensearch-project#1139 Resolves opensearch-project#1151 Resolves opensearch-project#1152 Resolves opensearch-project#1154 Signed-off-by: Tommy Markley <markleyt@amazon.com>
ashwin-pc
pushed a commit
to ashwin-pc/OpenSearch-Dashboards
that referenced
this issue
Apr 1, 2022
* Introduces standard scss rules from stylelint with only a few modifications. * `yarn lint` now runs `yarn lint:style` instead of `yarn lint:sass`. * Many of the files were updated with `yarn lint:style --fix`, but some of them had to be manually updated with overrides to adhere to the newly-introduced rules from the stylelint configuration. * Includes a couple fixes such as fixing the class selector for `osdnSuggestionItem--value .osdSuggestionItem__text`. Resolves opensearch-project#551 Resolves opensearch-project#1139 Resolves opensearch-project#1151 Resolves opensearch-project#1152 Resolves opensearch-project#1154 Signed-off-by: Tommy Markley <markleyt@amazon.com>
mend-for-github-com
bot
changed the title
ashwin-pc
pushed a commit
to ashwin-pc/OpenSearch-Dashboards
that referenced
this issue
Apr 1, 2022
* Introduces standard scss rules from stylelint with only a few modifications. * `yarn lint` now runs `yarn lint:style` instead of `yarn lint:sass`. * Many of the files were updated with `yarn lint:style --fix`, but some of them had to be manually updated with overrides to adhere to the newly-introduced rules from the stylelint configuration. * Includes a couple fixes such as fixing the class selector for `osdnSuggestionItem--value .osdSuggestionItem__text`. Resolves opensearch-project#551 Resolves opensearch-project#1139 Resolves opensearch-project#1151 Resolves opensearch-project#1152 Resolves opensearch-project#1154 Signed-off-by: Tommy Markley <markleyt@amazon.com>
ashwin-pc
added a commit
that referenced
this issue
Apr 1, 2022
* Replaces `sass-lint` with `stylelint` * Introduces standard scss rules from stylelint with only a few modifications. * `yarn lint` now runs `yarn lint:style` instead of `yarn lint:sass`. * Many of the files were updated with `yarn lint:style --fix`, but some of them had to be manually updated with overrides to adhere to the newly-introduced rules from the stylelint configuration. * Includes a couple fixes such as fixing the class selector for `osdnSuggestionItem--value .osdSuggestionItem__text`. Resolves #551 Resolves #1139 Resolves #1151 Resolves #1152 Resolves #1154 Signed-off-by: Tommy Markley <markleyt@amazon.com> * fix(Style): Fixes flex style Signed-off-by: Ashwin Pc <ashwinpc@amazon.com> * fix(lint): Fixes empty comment lint issue Signed-off-by: Ashwin Pc <ashwinpc@amazon.com> * chore: rebase and updates yarn.lock Signed-off-by: Ashwin Pc <ashwinpc@amazon.com> Co-authored-by: Tommy Markley <markleyt@amazon.com>
|
this issue is closed but I still have this CVE detected in the 1.3.2 versions or 2.0.0-rc1 version of opensearch dashboard. Anyone can explain if this issue is really done or not ? |
|
Hi @minutolc, as you can see by our labels, this CVE is fixed in v2.0.0, but not any other version. We cannot merge the fix in any 1.x branch because it is a breaking change. |
|
hi @tmarkley , thank you for your answer , this means that v2.0.0 label is not referring to 2.0.0-rc1 version but only 2.0.0 version ? |
|
In this case, the fix was merged into our The CVE is mitigated in 2.0.0-rc1. |
|
I still detect the CVE in the 2.0.0-rc1. Do you think there is any chance that the 2.0.0 correct entirely this CVE ? |
|
Can you provide details about how you're detecting the CVE in 2.0.0-rc1? |
|
Scan of the docker image with anchore |
5 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
CVE-2022-0144 - High Severity Vulnerability
Portable Unix shell commands for Node.js
Library home page: https://registry.npmjs.org/shelljs/-/shelljs-0.6.1.tgz
Dependency Hierarchy:
Found in base branch: main
shelljs is vulnerable to Improper Privilege Management
Publish Date: 2022-01-11
URL: CVE-2022-0144
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: shelljs/shelljs@d919d22
Release Date: 2022-01-11
Fix Resolution: shelljs - 0.8.5
The text was updated successfully, but these errors were encountered: