Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Prototype Pollution in async #341

Closed
kr8n3r opened this issue Apr 13, 2022 · 2 comments · Fixed by #343
Closed

Prototype Pollution in async #341

kr8n3r opened this issue Apr 13, 2022 · 2 comments · Fixed by #343

Comments

@kr8n3r
Copy link

kr8n3r commented Apr 13, 2022

The latest possible version that can be installed is 1.5.2 because of the following conflicting dependency:

node-zendesk@2.1.1 requires async@^1.4.0 via nconf@0.11.3
The earliest fixed version is 3.2.2.
@neztEx
Copy link

neztEx commented Apr 13, 2022

+1 to this, there is also prototype pollution in node-zendesk@2.1.1 › nconf@0.11.3.

The earliest fixed version is nconf@0.11.4

@kr8n3r
Copy link
Author

kr8n3r commented Apr 19, 2022

nconf 0.12 containing a CVE mitigation has been released https://github.com/indexzero/nconf/releases/tag/v0.12.0

@jamesicon jamesicon mentioned this issue Apr 20, 2022
Merged
sw1tchdev added a commit to sw1tchdev/node-zendesk that referenced this issue Apr 27, 2022
@sw1tchdev
feat: passing update payload in user identity update
ca2522f 
ref: blakmatrix#308 blakmatrix#341
@sw1tchdev sw1tchdev mentioned this issue Apr 27, 2022
Merged
blakmatrix pushed a commit that referenced this issue Aug 25, 2023
@sw1tchdev
feat: passing update payload in user identity update
79b4dca 
ref: #308 #341
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Update nconf library due to Prototype Pollution in async vulnerability jamesicon/node-zendesk
2 participants
@kr8n3r @neztEx