apache / apache/openwhisk-wskdebug

Dependency dockerode depends on vulnerable version of tar-fs

Open
#123 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
7
Forks
7
PR merge metrics
No merged PRs in 30d

Description

As per `npm audit`, the dependency on version ^3.2.0 of `dockerode` means that a vulnerable version of `tar-fs` gets installed.

```
# npm audit report

tar-fs 2.0.0 - 2.1.3
Severity: high
tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball - https://github.com/advisories/GHSA-vj76-c3g6-qr5v
tar-fs can extract outside the specified dir with a specific tarball - https://github.com/advisories/GHSA-8cj5-5rvv-wf4v
tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File - https://github.com/advisories/GHSA-pq67-2wwv-3xjx
fix available via `npm audit fix --force`
Will install @openwhisk/wskdebug@1.2.0, which is a breaking change
node_modules/tar-fs
dockerode 3.0.0 - 4.0.4
Depends on vulnerable versions of tar-fs
node_modules/dockerode
@openwhisk/wskdebug >=1.3.0
Depends on vulnerable versions of dockerode
node_modules/@openwhisk/wskdebug

3 high severity vulnerabilities
```

Here is the advisory for `tar-fs`

https://github.com/advisories/GHSA-pq67-2wwv-3xjx

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.