Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Vulnerability in node-forge 0.9.0

See original GitHub issue

👋

It’d be great if a new version of selfsigned could be released with node-forge bumped to ^0.10.0. See https://nvd.nist.gov/vuln/detail/CVE-2020-7720

It’d be also great for the new release to be non-breaking if possible to allow the users of web-pack-dev-server to upgrade without fiddling with resolutions or waiting for a new release of web-pack-dev-server. Its package.json refers to ^1.10.7, so both ^1.11.0 and ^1.10.8 would match the range.

Issue Analytics

State:
Created 3 years ago
Reactions:60
Comments:12

Top GitHub Comments

22reactions

alexander-akaitcommented, Sep 15, 2020

Fixed https://github.com/jfromaniello/selfsigned/releases/tag/v1.10.8

9reactions

neharicacommented, Sep 9, 2020

+1 to @kachkaev 's ask. Waiting on the same. It would be great if we could get reply on the same from the team as well.

Top Results From Across the Web

node-forge@0.9.0 - Snyk Vulnerability Database

M · Prototype Pollution · node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

CVE-2022-24771 (High) detected in node-forge-0.9.0 ... - GitHub

The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds. ... Base Score Metrics: Exploitability Metrics: Attack Vector: ......

Vulnerability detected in node-forge - Stack Overflow

Vulnerability in node-forge 0.9.0 has been fixed in selfsigned recently. Try updating selfsigned. It fixed the issue for me.

NVD - Results - National Institute of Standards and Technology

The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the ......

Insecure Cryptography Vulnerability in the node-forge library ...

node -forge improperly verifies cryptographic signatures. The vulnerability exists through improper verification of DigestInfo in the `rsa.js` file allowing ...