apache / apache/openwhisk-wskdebug
Dependency dockerode depends on vulnerable version of tar-fs
- Dominant language
- JavaScript
- Stars
- 7
- Forks
- 7
- PR merge metrics
- No merged PRs in 30d
Description
As per `npm audit`, the dependency on version ^3.2.0 of `dockerode` means that a vulnerable version of `tar-fs` gets installed.
```
# npm audit report
tar-fs 2.0.0 - 2.1.3
Severity: high
tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball - https://github.com/advisories/GHSA-vj76-c3g6-qr5v
tar-fs can extract outside the specified dir with a specific tarball - https://github.com/advisories/GHSA-8cj5-5rvv-wf4v
tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File - https://github.com/advisories/GHSA-pq67-2wwv-3xjx
fix available via `npm audit fix --force`
Will install @openwhisk/wskdebug@1.2.0, which is a breaking change
node_modules/tar-fs
dockerode 3.0.0 - 4.0.4
Depends on vulnerable versions of tar-fs
node_modules/dockerode
@openwhisk/wskdebug >=1.3.0
Depends on vulnerable versions of dockerode
node_modules/@openwhisk/wskdebug
3 high severity vulnerabilities
```
Here is the advisory for `tar-fs`
https://github.com/advisories/GHSA-pq67-2wwv-3xjx
Contributor guide
Assessment
This issue has not been assessed yet.