cordova-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "ASF GitHub Bot (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (CB-11484) coho test failure (library vulnerability)
Date Thu, 30 Jun 2016 17:44:10 GMT

    [ https://issues.apache.org/jira/browse/CB-11484?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15357528#comment-15357528
] 

ASF GitHub Bot commented on CB-11484:
-------------------------------------

Github user shazron commented on the issue:

    https://github.com/apache/cordova-coho/pull/128
  
    Let's get this in, I'd like status.cordova.io to be all green (this is the last red issue)
💯 
    
    For those wondering, bithound.io found that those two deps were not used.


> coho test failure (library vulnerability)
> -----------------------------------------
>
>                 Key: CB-11484
>                 URL: https://issues.apache.org/jira/browse/CB-11484
>             Project: Apache Cordova
>          Issue Type: Bug
>          Components: Coho
>            Reporter: Shazron Abdullah
>            Priority: Critical
>
> Our use of nlf@1.1.0 contains down the tree, a vulnerable library minimatch@2.0.10 
> {code}
> (+) 1 vulnerabilities found
> ┌───────────────┬────────────────────────────────────────────────────────────────────────────┐
> │               │ Regular Expression Denial of Service                          
            │
> ├───────────────┼────────────────────────────────────────────────────────────────────────────┤
> │ Name          │ minimatch                                                     
            │
> ├───────────────┼────────────────────────────────────────────────────────────────────────────┤
> │ Installed     │ 2.0.10                                                        
            │
> ├───────────────┼────────────────────────────────────────────────────────────────────────────┤
> │ Vulnerable    │ <=3.0.1                                                    
               │
> ├───────────────┼────────────────────────────────────────────────────────────────────────────┤
> │ Patched       │ >=3.0.2                                                    
               │
> ├───────────────┼────────────────────────────────────────────────────────────────────────────┤
> │ Path          │ cordova-coho@0.0.3 > nlf@1.1.0 > glob@4.5.3 > minimatch@2.0.10
            │
> ├───────────────┼────────────────────────────────────────────────────────────────────────────┤
> │ More Info     │ https://nodesecurity.io/advisories/118                        
            │
> └───────────────┴────────────────────────────────────────────────────────────────────────────┘
> {code}
> Filed for nlf:
> https://github.com/iandotkelly/nlf/issues/40
> Filed for glob-all (which later versions of nlf uses):
> https://github.com/jpillora/node-glob-all/issues/12
> glob-all uses glob, which patched this 4 days ago in 7.0.5:
> https://github.com/isaacs/node-glob/issues/268



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@cordova.apache.org
For additional commands, e-mail: issues-help@cordova.apache.org
Mime
View raw message