-
-
Notifications
You must be signed in to change notification settings - Fork 1
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
CVE-2022-1214 (High) detected in axios-0.21.4.tgz, axios-0.25.0.tgz - autoclosed #65
Labels
Mend: dependency security vulnerability
Security vulnerability detected by WhiteSource
Comments
✔️ This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory. |
pustovitDmytro
pushed a commit
that referenced
this issue
Feb 24, 2023
| datasource | package | from | to | | ---------- | ----------------------------------------- | ------ | ------- | | npm | @babel/cli | 7.15.7 | 7.16.8 | | npm | @babel/core | 7.15.5 | 7.16.12 | | npm | @babel/node | 7.15.4 | 7.16.8 | | npm | @babel/plugin-proposal-class-properties | 7.14.5 | 7.16.7 | | npm | @babel/plugin-proposal-decorators | 7.15.4 | 7.16.7 | | npm | @babel/plugin-proposal-object-rest-spread | 7.15.6 | 7.16.7 | | npm | @babel/plugin-proposal-optional-chaining | 7.14.5 | 7.16.7 | | npm | @babel/preset-env | 7.15.6 | 7.16.11 | | npm | @babel/runtime | 7.15.4 | 7.16.7 | | npm | @commitlint/cli | 13.2.0 | 13.2.1 | | npm | @semantic-release/changelog | 6.0.0 | 6.0.1 | | npm | @semantic-release/git | 10.0.0 | 10.0.1 | | npm | danger | 10.8.0 | 10.8.0 | | npm | eslint-config-incredible | 2.3.4 | 2.4.0 | | npm | eslint-plugin-censor | 1.5.1 | 1.5.2 | | npm | eslint-plugin-import | 2.24.2 | 2.25.4 | | npm | eslint-plugin-promise | 5.1.0 | 5.2.0 | | npm | eslint-plugin-regexp | 1.3.1 | 1.5.1 | | npm | eslint-plugin-sonarjs | 0.10.0 | 0.11.0 | | npm | husky | 7.0.2 | 7.0.4 | | npm | jscpd | 3.3.26 | 3.4.5 | | npm | mocha | 9.2.0 | 9.2.0 | | npm | node-package-tester | 1.1.24 | 1.1.28 | | npm | semantic-release-telegram | 1.5.0 | 1.5.1 | Co-authored-by: Renovate Bot <bot@renovateapp.com>
pustovitDmytro
pushed a commit
that referenced
this issue
Feb 24, 2023
## [1.3.9](v1.3.8...v1.3.9) (2023-02-24) ### Chore * anti-terrorism disclaimer ([96327fe](96327fe)) * fixes eslint-plugin-unicorn version ([dd45e9a](dd45e9a)) * fixes npm audit ([0500470](0500470)) * fixes some npm audit vulnerabilities ([b913fee](b913fee)) * fixes some npm audit vulnerabilities (#82) ([fd23d8e](fd23d8e)), closes [#82](#82) * fixes some npm audit vulnerabilities (#86) ([eb549de](eb549de)), closes [#86](#86) * Lock file maintenance ([85b7c09](85b7c09)) * Update dependency danger to v11 ([1779a27](1779a27)) * Update dependency nanoid to 3.1.31 [SECURITY] (#83) ([89d3014](89d3014)), closes [#83](#83) * Update dependency node-fetch to 2.6.7 [SECURITY] (#84) ([11e82bc](11e82bc)), closes [#84](#84) * Update devDependencies (non-major) ([01bd6c0](01bd6c0)) * Update devDependencies (non-major) ([85a0161](85a0161)) * Update devDependencies (non-major) (#65) ([d60ef28](d60ef28)), closes [#65](#65) * Update devDependencies (non-major) (#66) ([69aac8f](69aac8f)), closes [#66](#66) * Update devDependencies (non-major) (#92) ([f492769](f492769)), closes [#92](#92) ### Docs * add logo ([0f77537](0f77537)) * drop lgtm ([b1841f2](b1841f2)) * update year in license ([64521cb](64521cb))
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
Mend: dependency security vulnerability
Security vulnerability detected by WhiteSource
0 participants
CVE-2022-1214 - High Severity Vulnerability
axios-0.21.4.tgz
Promise based HTTP client for the browser and node.js
Library home page: https://registry.npmjs.org/axios/-/axios-0.21.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/base-api-client/node_modules/axios/package.json
Dependency Hierarchy:
axios-0.25.0.tgz
Promise based HTTP client for the browser and node.js
Library home page: https://registry.npmjs.org/axios/-/axios-0.25.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/axios/package.json
Dependency Hierarchy:
Found in HEAD commit: 415bb9a321527a52154a3ded11ed251389a0961b
Found in base branch: master
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository axios/axios prior to 0.26.
Publish Date: 2022-05-03
URL: CVE-2022-1214
Base Score Metrics:
Type: Upgrade version
Origin: https://huntr.dev/bounties/ef7b4ab6-a3f6-4268-a21a-e7104d344607/
Release Date: 2022-05-03
Fix Resolution: 0.26.0
Step up your Open Source Security Game with WhiteSource here
The text was updated successfully, but these errors were encountered: