fix(deps): update dependency convict to v6.2.4 [security] #263
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
6.0.0
->6.2.4
GitHub Vulnerability Alerts
CVE-2022-21190
This affects the package convict before 6.2.3. This is a bypass of CVE-2022-22143. The fix introduced, relies on the startsWith method and does not prevent the vulnerability: before splitting the path, it checks if it starts with proto or this.constructor.prototype. To bypass this check it's possible to prepend the dangerous paths with any string value followed by a dot, like for example foo.proto or foo.this.constructor.prototype.
CVE-2022-22143
Impact
The main use case of Convict is for handling server-side configurations written by the admins owning the servers, and not random users. So it's unlikely that an admin would deliberately sabotage their own server. Still a situation can happen where an admin not knowledgeable about JavaScript could be tricked by an attacker into writing the malicious JavaScript code into some config files.
Patches
The problem is patched in
[email protected]
. Users should upgrade to[email protected]
.Workarounds
No way for users to fix or remediate the vulnerability without upgrading
References
For more information
If you have any questions or comments about this advisory:
add your question as a comment in #384
CVE-2023-0163
Impact
The main use case of Convict is for handling server-side configurations written by the admins owning the servers, and not random users. So it's unlikely that an admin would deliberately sabotage their own server. Still a situation can happen where an admin not knowledgeable about JavaScript could be tricked by an attacker into writing the malicious JavaScript code into some config files.
Patches
The problem is patched in
[email protected]
. Users should upgrade to[email protected]
.Workarounds
No way for users to fix or remediate the vulnerability without upgrading
References
https://github.com/mozilla/node-convict/issues/410
Release Notes
mozilla/node-convict (convict)
v6.2.4
Compare Source
Bug Fixes
v6.2.3
Compare Source
Fixed
in #384 (Marc-Aurèle Darche @madarche, Snyk Security team)
v6.2.2
Compare Source
Fixed
#384 (Marc-Aurèle Darche @madarche)
v6.2.1
Compare Source
Fixed
v6.2.0
Compare Source
Changed
^11.1.0
→^13.6.0
(#390)^18.1.3
→^20.2.7
(#390)^2.24.0
→^2.29.1
(#390)v6.1.0
Compare Source
Added
v6.0.1
Compare Source
Fixed
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.