Skip to content

Conversation

@rmkanda
Copy link
Contributor

@rmkanda rmkanda commented Jun 7, 2019

Upgrade module extend to fix CVE-2018-16492 Prototype pollution vulnerability

Fixes #643

The extend module used in pubsub package is 3.0.1 which has known vulnerability - Refer https://nvd.nist.gov/vuln/detail/CVE-2018-16492

This vulnerability is fixed in version 3.0.2 of extend module.

Upgrade module extend to fix CVE-2018-16492 Prototype pollution vulnerability
@googlebot
Copy link

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here (e.g. I signed it!) and we'll verify it.


What to do if you already signed the CLA

Individual signers
Corporate signers

ℹ️ Googlers: Go here for more info.

@googlebot googlebot added the cla: no This human has *not* signed the Contributor License Agreement. label Jun 7, 2019
@rmkanda
Copy link
Contributor Author

rmkanda commented Jun 7, 2019

I signed it!

@googlebot
Copy link

CLAs look good, thanks!

ℹ️ Googlers: Go here for more info.

@googlebot googlebot added cla: yes This human has signed the Contributor License Agreement. and removed cla: no This human has *not* signed the Contributor License Agreement. labels Jun 7, 2019
@rmkanda rmkanda changed the title Upgrade module extend to fix CVE-2018-16492 deps: Upgrade module extend to fix CVE-2018-16492 Jun 7, 2019
@rmkanda rmkanda changed the title deps: Upgrade module extend to fix CVE-2018-16492 deps: Upgrade extend dependency to 3.0.2 due to CVE-2018-16492 Jun 7, 2019
@bcoe bcoe changed the title deps: Upgrade extend dependency to 3.0.2 due to CVE-2018-16492 deps: upgrade extend dependency to 3.0.2 due to CVE-2018-16492 Jun 7, 2019
@bcoe bcoe added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Jun 7, 2019
Copy link

@bcoe bcoe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The good news is, since we use the ^ folks installing a fresh copy of this library will already get 3.0.2, however it's good to be explicit.

Thanks for the patch 👍

@JustinBeckwith JustinBeckwith merged commit cd54630 into googleapis:master Jun 7, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cla: yes This human has signed the Contributor License Agreement. kokoro:force-run Add this label to force Kokoro to re-run the tests.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Prototype pollution vulnerability was found in module extend - CVE-2018-16492

4 participants