Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: ignore security vulnerability 1098397 #2044

Merged
merged 1 commit into from
Aug 13, 2024

Conversation

shumkov
Copy link
Member

@shumkov shumkov commented Aug 12, 2024

Issue being fixed or feature implemented

❯ yarn npm audit --environment production --all --recursive
├─ elliptic
│  ├─ ID: 1098397
│  ├─ Issue: Elliptic's ECDSA missing check for whether leading bit of r and s is zero
│  ├─ URL: https://github.com/advisories/GHSA-977x-g7h5-7qgw
│  ├─ Severity: low
│  ├─ Vulnerable Versions: >=2.0.0 <=6.5.6
│  │ 
│  ├─ Tree Versions
│  │  └─ 6.5.6
│  │ 
│  └─ Dependents
│     └─ @dashevo/dashcore-lib@npm:0.21.3
│
├─ elliptic
│  ├─ ID: 1098398
│  ├─ Issue: Elliptic's EDDSA missing signature length check
│  ├─ URL: https://github.com/advisories/GHSA-f7q4-pwc6-w24p
│  ├─ Severity: low
│  ├─ Vulnerable Versions: >=4.0.0 <=6.5.6
│  │ 
│  ├─ Tree Versions
│  │  └─ 6.5.6
│  │ 
│  └─ Dependents
│     └─ @dashevo/dashcore-lib@npm:0.21.3
│
└─ elliptic
   ├─ ID: 1098560
   ├─ Issue: Elliptic allows BER-encoded signatures
   ├─ URL: https://github.com/advisories/GHSA-49q7-c7j4-3p7m
   ├─ Severity: low
   ├─ Vulnerable Versions: >=5.2.1 <=6.5.6
   │ 
   ├─ Tree Versions
   │  └─ 6.5.6
   │ 
   └─ Dependents
      └─ @dashevo/dashcore-lib@npm:0.21.3

What was done?

  • Ignore the warning since fix is not release yet

How Has This Been Tested?

None

Breaking Changes

None

Checklist:

  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have added or updated relevant unit/integration/functional/e2e tests
  • I have added "!" to the title and described breaking changes in the corresponding section if my code contains any
  • I have made corresponding changes to the documentation if needed

For repository code-owners and collaborators only

  • I have assigned this pull request to a milestone

@shumkov shumkov added this to the v1.1 milestone Aug 12, 2024
@QuantumExplorer QuantumExplorer merged commit deb0ae6 into v1.1-dev Aug 13, 2024
18 checks passed
@QuantumExplorer QuantumExplorer deleted the chore/disable-1098397 branch August 13, 2024 05:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants