Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Is it possible to remove the vulnerability introduced by ajv? #467

Open
evansrobert opened this issue Aug 10, 2021 · 2 comments
Open

Is it possible to remove the vulnerability introduced by ajv? #467

evansrobert opened this issue Aug 10, 2021 · 2 comments

Comments

@evansrobert
Copy link

Hi, @MikeRalphson, I stumbled upon a high severity vulnerability introduced by package [email protected]:

Issue Description

When I build my project, I notice that a vulnerability(high severity) CVE-2020-15366 detected in package ajv<6.12.3 is directly referenced by [email protected].
However, [email protected] is so popular that a large number of latest versions of active and popular downstream projects depend on it (79,470 downloads per week and about 42 downstream projects, e.g., @redocly/developer-portal 1.0.0-beta.161, @redocly/reference-docs-lib 1.3.26, @redocly/redoc-int 2.0.0-rc.62, @mojaloop/central-services-shared 13.0.5, @adobe/parliament-ui-components 4.6.2, etc.).
In this case, the vulnerability CVE-2020-15366 can be propagated into these downstream projects and expose security threats to them.
As you can see, [email protected] is introduced into the above projects via the following package dependency paths:
(1)@adobe/[email protected] ➔ @adobe/[email protected][email protected][email protected][email protected][email protected]
......

I know that it's kind of you to have removed the vulnerability since [email protected]. But, in fact, the above large amount of downstream projects cannot easily upgrade oas-validator from version 4.0.8 to (>=5.0.0):
The projects such as widdershins, which introduced [email protected], are not maintained anymore. These unmaintained packages can neither upgrade oas-validator nor be easily migrated by the large amount of affected downstream projects.

Given the large number of downstream users, is it possible to release a new patched version with the updated dependency to remove the vulnerability from package [email protected] ?

Suggested Solution

Since these inactive projects set a version constaint 4.0.* for oas-validator on the above vulnerable dependency paths, if oas-validator removes the vulnerability from 4.0.8 and releases a new patched version [email protected], such a vulnerability patch can be automatically propagated into the downstream projects.

In [email protected], maybe you can try to perform the following upgrade:
ajv ^5.5.2 ➔ ^6.12.3;
Note:
[email protected](>=6.12.3) has fixed the vulnerability CVE-2020-15366.

Thank you for your attention to this issue and welcome to share other ways to resolve the issue.

Best regards,
^_^

@MikeRalphson
Copy link
Contributor

widdershins is still maintained, and the next release will use the latest version of oas-validator. I'm not sure why any other projects would have problems migrating to the later version, unless you have specific information?

@evansrobert
Copy link
Author

evansrobert commented Aug 11, 2021

@MikeRalphson Thank you for your feedback. Since the latest version(4.0.1) of widdershins was released a year ago, I mistakenly assumed it was no longer maintained. Of course, if you can kindly release a new pached version [email protected] which uses the latest version of oas-validator, such a vulnerability patch can also be automatically propagated into the downstream projects. And please let me know that. Thanks again.^_^

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants