Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk:High] Prototype Pollution (06/15/2022) #5125

Closed
2 tasks
pkfec opened this issue May 4, 2022 · 0 comments · Fixed by #5137 or #5141
Closed
2 tasks

[Snyk:High] Prototype Pollution (06/15/2022) #5125

pkfec opened this issue May 4, 2022 · 0 comments · Fixed by #5137 or #5141
Assignees
@cnlucas
Labels
Security: general General security concern or issue Security: high Remediate within 30 days
Milestone
Sprint 18.2

Comments

@pkfec
Copy link
Contributor

pkfec commented May 4, 2022 •
edited

Overview

Affected versions of this package are vulnerable to Prototype Pollution via the mapValues() method.

https://security.snyk.io/vuln/SNYK-JS-ASYNC-2441827

Detailed paths:

Introduced through: swagger-tools@0.10.4
Fix: Upgrade async to version 2.6.4, 3.2.2 or higher.

Remediation:

Upgrade async to version 2.6.4, 3.2.2 or higher inside package.json

Completion criteria:

  • Upgrade async to version 2.6.4, 3.2.2 or higher inside package.json
  • Generate and check-in package-lock.json
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@cnlucas cnlucas

Labels
Security: general General security concern or issue Security: high Remediate within 30 days
Projects
None yet
Milestone
Sprint 18.2
2 participants
@pkfec @cnlucas