Skip to content

Commit 801cf1b

Browse files
thetutlagethetutlage
committed
chore(release): 3.0.0
1 parent 1fa45d7 commit 801cf1b

File tree

3 files changed

+6
-162
lines changed

3 files changed

+6
-162
lines changed

‎npm-audit.html‎

Lines changed: 4 additions & 160 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
href="https://cdn.jsdelivr.net/gh/highlightjs/[email protected]/build/styles/atom-one-dark.min.css">
1616

1717
<title>NPM Audit Report</title>
18-
<meta name="description" content="47 known vulnerabilities found.">
18+
<meta name="description" content="44 known vulnerabilities found.">
1919

2020
<style>
2121
pre {
@@ -39,7 +39,7 @@ <h1 class="mt-5 text-center">NPM Audit Report</h1>
3939
<div class="card">
4040
<div class="card-body">
4141
<h5 class="card-title">
42-
47
42+
44
4343
</h5>
4444
<p class="card-text">Known vulnerabilities</p>
4545
</div>
@@ -55,7 +55,7 @@ <h5 class="card-title">
5555
<div class="card">
5656
<div class="card-body">
5757
<h5 class="card-title">
58-
October 4th 2020, 10:32:11 am
58+
October 4th 2020, 10:58:55 am
5959
</h5>
6060
<p class="card-text">Last updated</p>
6161
</div>
@@ -95,7 +95,7 @@ <h5 class="card-title">
9595
<div class="card">
9696
<div class="card-body">
9797
<h5 class="card-title">
98-
47
98+
44
9999
</h5>
100100
<p class="card-text">
101101
<span class="badge badge-primary">low</span>
@@ -128,20 +128,6 @@ <h5 class="card-title">
128128
</tr>
129129
</thead>
130130
<tbody>
131-
<tr>
132-
<th scope="row">
133-
<a href="https://npmjs.com/advisories/1179" data-toggle="modal" data-target="#advisory-modal-1179">Prototype Pollution</a>
134-
</th>
135-
<td>
136-
<a href="https://npmjs.com/package/minimist" target="_blank"
137-
rel="noopener">minimist</a>
138-
</td>
139-
<td data-order="4"><span
140-
class="badge badge-primary">low</span></td>
141-
<td>
142-
CWE-471
143-
</td>
144-
</tr>
145131
<tr>
146132
<th scope="row">
147133
<a href="https://npmjs.com/advisories/1490" data-toggle="modal" data-target="#advisory-modal-1490">Validation Bypass</a>
@@ -156,90 +142,13 @@ <h5 class="card-title">
156142
CWE-20
157143
</td>
158144
</tr>
159-
<tr>
160-
<th scope="row">
161-
<a href="https://npmjs.com/advisories/1523" data-toggle="modal" data-target="#advisory-modal-1523">Prototype Pollution</a>
162-
</th>
163-
<td>
164-
<a href="https://npmjs.com/package/lodash" target="_blank"
165-
rel="noopener">lodash</a>
166-
</td>
167-
<td data-order="4"><span
168-
class="badge badge-primary">low</span></td>
169-
<td>
170-
CWE-471
171-
, CVE-2019-10744
172-
</td>
173-
</tr>
174145
</tbody>
175146
</table>
176147
</div>
177148
</div>
178149
</div>
179150

180151

181-
<div class="modal" tabindex="-1" role="dialog" id="advisory-modal-1179">
182-
<div class="modal-dialog modal-lg" role="document">
183-
<div class="modal-content">
184-
<div class="modal-header">
185-
<h5 class="modal-title">
186-
<span class="badge badge-primary">low</span>
187-
Prototype Pollution
188-
</h5>
189-
<button type="button" class="close" data-dismiss="modal" aria-label="Close">
190-
<span aria-hidden="true">&times;</span>
191-
</button>
192-
</div>
193-
<div class="modal-body">
194-
<div class="row">
195-
<div class="col-md-6">
196-
<ul>
197-
<li>Module:
198-
<a href="https://npmjs.com/package/minimist" target="_blank"
199-
rel="noopener">minimist</a>
200-
</li>
201-
<li>Published: September 23rd 2019 </li>
202-
<li>Reported by: Checkmarx Research Team</li>
203-
<li>CWE-471</li>
204-
</ul>
205-
</div>
206-
<div class="col-md-6">
207-
<ul>
208-
<li>Vulnerable: &lt;0.2.1 || &gt;&#x3D;1.0.0 &lt;1.2.3</li>
209-
<li>Patched: &gt;&#x3D;0.2.1 &lt;1.0.0 || &gt;&#x3D;1.2.3</li>
210-
<li>Exploitability: 1</li>
211-
</ul>
212-
</div>
213-
</div>
214-
<h3>Overview</h3>
215-
<p class="card-text"><p>Affected versions of <code>minimist</code> are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of <code>Object</code>, causing the addition or modification of an existing property that will exist on all objects.<br>Parsing the argument <code>--__proto__.y=Polluted</code> adds a <code>y</code> property with value <code>Polluted</code> to all objects. The argument <code>--__proto__=Polluted</code> raises and uncaught error and crashes the application.<br>This is exploitable if attackers have control over the arguments being passed to <code>minimist</code>.</p>
216-
</p>
217-
218-
<h3>Findings</h3>
219-
<ul>
220-
<li>@adonisjs/sink&gt;mrm-core&gt;minimist </li>
221-
</ul>
222-
223-
<h3>Remediation</h3>
224-
<p class="card-text"><p>Upgrade to versions 0.2.1, 1.2.3 or later.</p>
225-
</p>
226-
227-
<h3>References</h3>
228-
<p class="card-text"><ul>
229-
<li><a href="https://github.com/substack/minimist/commit/4cf1354839cb972e38496d35e12f806eea92c11f#diff-a1e0ee62c91705696ddb71aa30ad4f95">GitHub commit 1</a></li>
230-
<li><a href="https://github.com/substack/minimist/commit/63e7ed05aa4b1889ec2f3b196426db4500cbda94">GitHub commit 2</a></li>
231-
</ul>
232-
</p>
233-
234-
</div>
235-
<div class="modal-footer">
236-
<a class="btn btn-raised mr-2 btn-primary" href="https://npmjs.com/advisories/1179" target="_blank" rel="noopener">More about
237-
this vulnerability</a>
238-
<button type="button" class="btn btn-raised btn-secondary" data-dismiss="modal">Close</button>
239-
</div>
240-
</div>
241-
</div>
242-
</div>
243152
<div class="modal" tabindex="-1" role="dialog" id="advisory-modal-1490">
244153
<div class="modal-dialog modal-lg" role="document">
245154
<div class="modal-content">
@@ -344,71 +253,6 @@ <h3>References</h3>
344253
</div>
345254
</div>
346255
</div>
347-
<div class="modal" tabindex="-1" role="dialog" id="advisory-modal-1523">
348-
<div class="modal-dialog modal-lg" role="document">
349-
<div class="modal-content">
350-
<div class="modal-header">
351-
<h5 class="modal-title">
352-
<span class="badge badge-primary">low</span>
353-
Prototype Pollution
354-
</h5>
355-
<button type="button" class="close" data-dismiss="modal" aria-label="Close">
356-
<span aria-hidden="true">&times;</span>
357-
</button>
358-
</div>
359-
<div class="modal-body">
360-
<div class="row">
361-
<div class="col-md-6">
362-
<ul>
363-
<li>Module:
364-
<a href="https://npmjs.com/package/lodash" target="_blank"
365-
rel="noopener">lodash</a>
366-
</li>
367-
<li>Published: May 20th 2020 </li>
368-
<li>Reported by: posix</li>
369-
<li>CWE-471</li>
370-
<li>CVE-2019-10744</li>
371-
</ul>
372-
</div>
373-
<div class="col-md-6">
374-
<ul>
375-
<li>Vulnerable: &lt;4.17.19</li>
376-
<li>Patched: &gt;&#x3D;4.17.19</li>
377-
<li>Exploitability: 3</li>
378-
</ul>
379-
</div>
380-
</div>
381-
<h3>Overview</h3>
382-
<p class="card-text"><p>Versions of <code>lodash</code> prior to 4.17.19 are vulnerable to Prototype Pollution. The function <code>zipObjectDeep</code> allows a malicious user to modify the prototype of <code>Object</code> if the property identifiers are user-supplied. Being affected by this issue requires zipping objects based on user-provided property arrays. </p>
383-
<p>This vulnerability causes the addition or modification of an existing property that will exist on all objects and may lead to Denial of Service or Code Execution under specific circumstances.</p>
384-
</p>
385-
386-
<h3>Findings</h3>
387-
<ul>
388-
<li>@adonisjs/sink&gt;mrm-core&gt;lodash </li>
389-
<li>@adonisjs/sink&gt;mrm-core&gt;webpack-merge&gt;lodash </li>
390-
</ul>
391-
392-
<h3>Remediation</h3>
393-
<p class="card-text"><p>Upgrade to version 4.17.19 or later.</p>
394-
</p>
395-
396-
<h3>References</h3>
397-
<p class="card-text"><ul>
398-
<li><a href="https://hackerone.com/reports/712065">HackerOne Report</a></li>
399-
<li><a href="https://github.com/lodash/lodash/issues/4744">GitHub Issue</a></li>
400-
</ul>
401-
</p>
402-
403-
</div>
404-
<div class="modal-footer">
405-
<a class="btn btn-raised mr-2 btn-primary" href="https://npmjs.com/advisories/1523" target="_blank" rel="noopener">More about
406-
this vulnerability</a>
407-
<button type="button" class="btn btn-raised btn-secondary" data-dismiss="modal">Close</button>
408-
</div>
409-
</div>
410-
</div>
411-
</div>
412256

413257
<script src="https://code.jquery.com/jquery-3.3.1.slim.min.js"
414258
integrity="sha384-q8i/X+965DzO0rT7abK41JStQIAqVgRVzpbzo5smXKp4YfRvH+8abtTE1Pi6jizo"

‎package-lock.json‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@adonisjs/assembler",
3-
"version": "2.1.5",
3+
"version": "3.0.0",
44
"description": "Core commands to compiler and build AdonisJs project",
55
"main": "build/ace-manifest.json",
66
"files": [

0 commit comments

Comments
 (0)