kevva / kevva/caw

Security vulnerability in `tunnel-agent`

Open
#22 13 comments 22 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
41
Forks
8
PR merge metrics
No merged PRs in 30d

Description

You may already be aware of this issue, but I figured I'd post it here anyway, just in case I'm wrong. (I don't see it already posted.)

When running an `npm audit` on my Laravel project, I get several Moderate security vulnerabilities related to the `tunnel-agent` dependency. It seems there _is_ a patch available, but it requires that you update `caw` so that it will use `tunnel-agent` version `>=0.6.0`:

```
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Memory Exposure │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=0.6.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ laravel-mix [dev] │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ laravel-mix > img-loader > imagemin-gifsicle > gifsicle > │
│ │ bin-build > download > caw > tunnel-agent │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/598 │
└───────────────┴──────────────────────────────────────────────────────────────┘
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by inspecting caw's dependency declarations and running the reported npm audit path for tunnel-agent. Confirm that the dependency resolves to version 0.6.0 or newer, then verify that the vulnerability is no longer reported.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, nodejs
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.