Skip to content

Update node-forge dependency #1529

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
rrnara opened this issue Jan 9, 2022 · 6 comments
Closed

Update node-forge dependency #1529

rrnara opened this issue Jan 9, 2022 · 6 comments

Comments

@rrnara
Copy link

rrnara commented Jan 9, 2022

npm audit generates the following error for node-forge < 1.0.0:
Prototype Pollution in node-forge debug API. - GHSA-5rrq-pxf6-6jx5

@google-oss-bot
Copy link

I found a few problems with this issue:

  • I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.
  • This issue does not seem to follow the issue template. Make sure you provide all the required information.

@TheBrockEllis
Copy link

There was another advisory published a few days ago regarding firebase-admin and the node-forge dependency.

URL parsing in node-forge could lead to undesired behavior.

@lahirumaramba
Copy link
Member

It does not look like firebase-admin uses the forge.util.parseUrl API directly. We also updated the dependency in #1533
Thank you.

@AviVahl
Copy link

AviVahl commented Jan 11, 2022

@lahirumaramba
Appreciate you verifying vulnerable API is not used by firebase-admin 👍 I know I can ignore that one.
Any chance to release a patch version so we'll get a clean audit report? (or is it already planned for some future date?)

@lahirumaramba
Copy link
Member

This change will be included (along with other updates) in a release planned for next week. I will update this issue once the release is out. In the meantime please update to node-forge 1.0.0 in your server environments. Thank you for your patience!

@lahirumaramba
Copy link
Member

node-forge version update is included in today's release v10.0.2. Thank you for your patience everyone!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

5 participants