Skip to content
This repository has been archived by the owner on Aug 28, 2023. It is now read-only.

Update base64url to fix vunerability #383

Closed
mir4ef opened this issue May 17, 2018 · 2 comments
Closed

Update base64url to fix vunerability #383

mir4ef opened this issue May 17, 2018 · 2 comments

Comments

@mir4ef
Copy link

mir4ef commented May 17, 2018

There is a known vulnerability in base64url 2.0.0. Could you please update your dependency to a later version that has patched the vulnerability? We are using nsp as part of our build process and our builds are failing due to this.


┌────────────┬────────────────────────────────────────────────────────────────────┐
│            │ Out-of-bounds Read                                                 │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Name       │ base64url                                                          │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ CVSS       │ 7.1 (High)                                                         │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Installed  │ 2.0.0                                                              │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Vulnerable │ <3.0.0                                                             │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Patched    │ >=3.0.0                                                            │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Path       │ myapp@0.0.1 > passport-azure-ad@3.0.12 >                │
│            │ base64url@2.0.0                                                    │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ More Info  │ https://nodesecurity.io/advisories/658                             │
└────────────┴────────────────────────────────────────────────────────────────────┘
@leoschweizer
Copy link

See #382

@nehaagrawal
Copy link
Contributor

I have released 4.0.0. Please check. Closing this issue for now.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants