Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update tunnel-ssh dependency for vulnerability CVE-2023-48795 #830

Open
1 of 3 tasks
coruscating opened this issue Jan 2, 2024 · 2 comments · May be fixed by #831
Open
1 of 3 tasks

Update tunnel-ssh dependency for vulnerability CVE-2023-48795 #830

coruscating opened this issue Jan 2, 2024 · 2 comments · May be fixed by #831

Comments

@coruscating
Copy link

I'm submitting a...

  • Bug report
  • Feature request
  • Question

Current behavior

The vulnerability CVE-2023-48795 requires ssh2 1.15 and above to fix: mscdex/ssh2#1354

The tunnel-ssh 4.x series, which is a dependency of db-migrate, only supports ssh2 up to 1.4.0: #755. This CVE can be resolved for db-migrate if the tunnel-ssh dependency is upgraded to 5.x (or if tunnel-ssh updates its 4.x dependencies, but it's been a year since 5.x was released).

Expected behavior

The security vulnerability should be addressed.
@MarkR87
Copy link

MarkR87 commented Feb 20, 2024

Any update on this?

@avilches avilches linked a pull request Feb 28, 2024 that will close this issue
Open
@mriedem
Copy link
Contributor

mriedem commented Mar 20, 2024

For anyone else looking at this, we're not using the tunnel config with db-migrate so we're just overriding the transitive dependency in our package.json:

"overrides": {
    "db-migrate": {
      "tunnel-ssh": "^5.1.2"
    }
  }

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Resolves CVE-2023-48795 vulnerability upgrading ssh2 to 1.15 avilches/node-db-migrate
3 participants
@mriedem @coruscating @MarkR87