Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix 'Arbitrary File Overwrite' high priority NPM vulnerability #12

Open
whatl3y opened this issue May 7, 2019 · 1 comment
Open

Fix 'Arbitrary File Overwrite' high priority NPM vulnerability #12

whatl3y opened this issue May 7, 2019 · 1 comment

Comments

@whatl3y
Copy link

whatl3y commented May 7, 2019

I know there's an open issue asking if this package is being maintained, but this issue will be to simply document the high priority vulnerability of a dependency of this package.

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Arbitrary File Overwrite                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ tar                                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.4.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ MYPRIVATEPACKAGE                                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ MYPRIVATEPACKAGE > pg-query-parser > pg-query-native >       │
│               │ node-gyp > tar                                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/803                             │
└───────────────┴──────────────────────────────────────────────────────────────┘
@pyramation
Copy link

https://www.npmjs.com/advisories/803

I'm maintaining a fork that the community is using (https://github.com/pyramation/pgsql-parser)

So this looks like pg-query-native would need to update node-gyp version?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants