Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: update protobufjs to fix critical vulnerability #4439

Merged
merged 1 commit into from
Apr 18, 2024
Merged

fix: update protobufjs to fix critical vulnerability #4439

merged 1 commit into from
Apr 18, 2024

Conversation

ekorenblum-simtlix
Copy link
Contributor

@ekorenblum-simtlix ekorenblum-simtlix commented Apr 15, 2024 •
edited
Loading

Description

  • A vulnerability was found on a package called protobufjs, version 6 and 7 are compromised
  • The vulneability is CVE-2023-36665, with a CRITICAL SEVERITY of 9.8
    • Both versions have patches against this issue, version 6.11.4 and 7.2.5
  • Some coin SDKs that we use are using protobufjs
    • The ones using version 6 are up to date
    • The ones using version 7 are vulnerable
  • HBAR, ISLM and TRX SDKs are affected

Issue Number

DX-314

Type of change

  • Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

Code builds and compiles, all tests pass

Checklist:

  • My code follows the style guidelines of this project
  • I have performed a self-review of my own code
  • My code compiles correctly for both Node and Browser environments
  • I have commented my code, particularly in hard-to-understand areas
  • My commits follow Conventional Commits and I have properly described any BREAKING CHANGES
  • The ticket or github issue was included in the commit message as a reference
  • I have made corresponding changes to the documentation and on any new/updated functions and/or methods - jsdoc
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes
    -->

@ekorenblum-simtlix ekorenblum-simtlix force-pushed the DX-314-update-vulnerable-protobufjs branch from 49cdde1 to 712ffd0 Compare April 15, 2024 20:05
@socket-security Socket Security
Copy link

socket-security bot commented Apr 15, 2024 •
edited
Loading

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher

🚮 Removed packages: npm/@hapi/[email protected], npm/@nodelib/[email protected], npm/@sideway/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@types/[email protected], npm/@webassemblyjs/[email protected], npm/@webassemblyjs/[email protected], npm/@webassemblyjs/[email protected], npm/@webassemblyjs/[email protected], npm/@webassemblyjs/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected], npm/[email protected]

View full report↗︎

@socket-security Socket Security
Copy link

socket-security bot commented Apr 15, 2024 •
edited
Loading

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report↗︎

@ekorenblum-simtlix ekorenblum-simtlix force-pushed the DX-314-update-vulnerable-protobufjs branch 3 times, most recently from 367d6fa to bbbf927 Compare April 16, 2024 16:52
@the-smooth-operator
Copy link

fyi: #4422

@alebusse alebusse force-pushed the DX-314-update-vulnerable-protobufjs branch from bbbf927 to 7066ada Compare April 17, 2024 16:11
@alebusse alebusse mentioned this pull request Apr 17, 2024
Closed
@alebusse alebusse marked this pull request as ready for review April 17, 2024 16:54
@alebusse alebusse requested review from a team as code owners April 17, 2024 16:54
@ekorenblum-simtlix ekorenblum-simtlix merged commit db1cc05 into master Apr 18, 2024
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@alebusse alebusse alebusse approved these changes

@margueriteblair margueriteblair margueriteblair approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@ekorenblum-simtlix @the-smooth-operator @margueriteblair @alebusse