Skip to content

Commit

Permalink
AngularJS 1.7.9 Security Update
Browse files Browse the repository at this point in the history
*Sourced from The GitHub Security Advisory Database.*

> **High severity vulnerability that affects angular**
> In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.
>
> Affected versions: ["< 1.7.9"]

This is similar to pull request #1229 but needed a manual patch since
this is part of the deprecated bower dependency management.
  • Loading branch information
lkiesow committed Nov 25, 2019
1 parent f877dda commit 42d26e4
Showing 1 changed file with 5 additions and 2 deletions.
7 changes: 5 additions & 2 deletions modules/admin-ui/bower.json
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
"jquery": "3.4.1",
"jquery-ui": "1.12.1",
"jqueryui-timepicker-addon": "1.6.3",
"angular": "1.7.8",
"angular": "1.7.9",
"angular-route": "1.7.8",
"angular-resource": "1.7.8",
"angular-animate": "1.7.8",
Expand All @@ -28,5 +28,8 @@
}
},
"appPath": "src/main/webapp",
"moduleName": "adminNg"
"moduleName": "adminNg",
"resolutions": {
"angular": "1.7.9"
}
}

0 comments on commit 42d26e4

Please sign in to comment.