Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bump axios to v0.21.1 to fix vuln (CVE-2020-28168) #722

Merged
merged 2 commits into from
Jan 4, 2021

Conversation

brendan-miller-snyk
Copy link
Contributor

@brendan-miller-snyk brendan-miller-snyk commented Jan 4, 2021

Summary

Issue: #721

Axios NPM package <=0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Exploit Maturity
medium severity 402/1000
Why? Proof of Concept exploit, CVSS 5.9 - https://app.snyk.io/test/npm/@slack/bolt/2.5.0
Server-Side Request Forgery (SSRF)
SNYK-JS-AXIOS-1038255
Proof of Concept

Requirements (place an x in each [ ])

@gitwave gitwave bot added the untriaged label Jan 4, 2021
@CLAassistant
Copy link

CLAassistant commented Jan 4, 2021

CLA assistant check
All committers have signed the CLA.

@brendan-miller-snyk brendan-miller-snyk changed the title Issue 721: bump axios to v0.21.1 to fix vuln (CVE-2020-28168) bump axios to v0.21.1 to fix vuln (CVE-2020-28168) Jan 4, 2021
@codecov
Copy link

codecov bot commented Jan 4, 2021

Codecov Report

Merging #722 (df2b579) into main (305ae9a) will not change coverage.
The diff coverage is n/a.

Impacted file tree graph

@@           Coverage Diff           @@
##             main     #722   +/-   ##
=======================================
  Coverage   82.32%   82.32%           
=======================================
  Files           8        8           
  Lines         758      758           
  Branches      250      250           
=======================================
  Hits          624      624           
  Misses         78       78           
  Partials       56       56           

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 305ae9a...df2b579. Read the comment docs.

@seratch seratch added security and removed untriaged labels Jan 4, 2021
@seratch
Copy link
Member

seratch commented Jan 4, 2021

Thanks for taking time to report this issue and send this fix! LGTM 👍 This will be merged on Monday, Pacific Time.

@brendan-miller-snyk
Copy link
Contributor Author

No worries! Appreciate the quick turnaround 👍

@stevengill stevengill merged commit 8c7434a into slackapi:main Jan 4, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants