Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update node-forge to fix security issue #1532

Closed
ahmednaser94 opened this issue Jan 10, 2022 · 1 comment · Fixed by #1533
Closed

Update node-forge to fix security issue #1532

ahmednaser94 opened this issue Jan 10, 2022 · 1 comment · Fixed by #1533

Comments

@ahmednaser94
Copy link

[READ] Step 1: Are you in the right place?

  • For issues related to the code in this repository file a Github issue.

  • If the issue pertains to Cloud Firestore, read the instructions in the "Firestore issue"
    template.

  • For general technical questions, post a question on StackOverflow
    with the firebase tag.

  • For general Firebase discussion, use the firebase-talk
    google group.

  • For help troubleshooting your application that does not fall under one
    of the above categories, reach out to the personalized
    Firebase support channel.

    please update node-forge to fix this issue: GHSA-gf8q-jrpm-jvxq

[REQUIRED] Step 2: Describe your environment

  • Operating System version: windows 11
  • Firebase SDK version: _____
  • Firebase Product: firebase-admin
  • Node.js version: 16.13.0
  • NPM version: 8.1.3

[REQUIRED] Step 3: Describe the problem

Steps to reproduce:

npm i firebase-admin@10.0.1
npm audit fix

What happened? How can we make the problem occur?
This could be a description, log/console output, etc.
node-forge <1.0.0
URL parsing in node-forge could lead to undesired behavior. - GHSA-gf8q-jrpm-jvxq
fix available via npm audit fix --force
Will install firebase-admin@4.2.1, which is a breaking change
node_modules/node-forge
firebase-admin >=5.0.0

Relevant Code:

npm i firebase-admin@10.0.1
npm audit fix
@google-oss-bot
Copy link

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants