Skip to content

Fix moderate and low issues from npm audit related to node-forge #80

@jasonhocker

Description

@jasonhocker

Please do not report security vulnerabilities here. The Responsible Disclosure Program details the procedure for disclosing security issues.

Thank you in advance for helping us to improve this library! Your attention to detail here is greatly appreciated and will help us respond as quickly as possible. For general support or usage questions, use the Auth0 Community or Auth0 Support. Finally, to avoid duplicates, please search existing Issues before submitting one here.

By submitting an Issue to this repository, you agree to the terms within the Auth0 Code of Conduct.

Describe the problem you'd like to have solved

No issues with npm audit

Describe the ideal solution

No issues with npm audit

Alternatives and current work-arounds

None

Additional context

Add any other context or screenshots about the feature request here.

                   === npm audit security report ===                        

┌──────────────────────────────────────────────────────────────────────────────┐
│ Manual Review │
│ Some vulnerabilities require your attention to resolve │
│ │
│ Visit https://go.npm.me/audit-guide for additional guidance │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low │ Prototype Pollution in node-forge debug API. │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ node-forge │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=1.0.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ saml │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ saml > xml-encryption > node-forge │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ GHSA-5rrq-pxf6-6jx5
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low │ URL parsing in node-forge could lead to undesired behavior. │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ node-forge │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=1.0.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ saml │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ saml > xml-encryption > node-forge │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ GHSA-gf8q-jrpm-jvxq
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate │ Open Redirect in node-forge │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ node-forge │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=1.0.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ saml │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ saml > xml-encryption > node-forge │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ GHSA-8fr3-hfg3-gpgp
└───────────────┴──────────────────────────────────────────────────────────────┘

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions