Visitar URL original
Whitesource vulnerability in package extend · Issue #674 · pkgcloud/pkgcloud · GitHub
Skip to content

Whitesource vulnerability in package extend  #674

Open

Description

@joginds4

The whitesource scan detected following package (extend) is vulnerable which is being pushed by pkgCloud:

pkgcloud: 2.1.0 |--> @google-cloud/storage: 2.5.0
|--> extend: 3.0.1
|--> @google-cloud/paginator: 0.2.0 --> extend: 3.0.1

Here is the details of vulnerability:

Name: CVE-2018-16492
Description: A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.
**Publish date:**2019-02-01
Resolution: Upgrade To Version v3.0.2,v2.0.2

Can you please share when this vulnerability be resolved and will it be resolved in all the pkgCloud version?

Activity

  1. joginds4 commented on Aug 12, 2019

    @joginds4
    Author

    Hi, This defect can be closed if you will update package.json with @google-cloud/storage v3.1.0. Please find details here:
    googleapis/nodejs-storage#796

    Can you please resolve it and release new version?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions