Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: fix vulnerability in starbank-ecdsa dependency #1022

Merged
merged 2 commits into from
Nov 9, 2021

Conversation

hellno
Copy link
Contributor

@hellno hellno commented Nov 9, 2021

Fixes

Security vulnerability in starbank-ecdsa <=2.0.0
see GHSA-9wx7-jrvc-28mm for details

A short description of what this PR does.
Fixes #1023

Checklist

  • I acknowledge that all my contributions will be made under the project's license
  • I have made a material change to the repo (functionality, testing, spelling, grammar)
  • I have read the Contribution Guidelines and my PR follows them
  • I have titled the PR appropriately
  • I have updated my branch with the main branch
  • I have added tests that prove my fix is effective or that my feature works
  • I have added the necessary documentation about the functionality in the appropriate .md file
  • I have added inline documentation to the code I modified

@thomwiggers
Copy link

Should probably update to 2.0.2, as there were more checks missing.

@kapilt
Copy link

kapilt commented Nov 9, 2021

@thomwiggers this should pick up 2.0.2 per the >= dep spec albeit setting the min to 2.0.2 is also good.

[update] 2.0.2 release seems a little odd as there haven't been any repo changes in the last 5 days (from 2.0.1) release.

@JenniferMah JenniferMah added status: code review request requesting a community code review or review from Twilio type: security known security issue labels Nov 9, 2021
@JenniferMah JenniferMah changed the title [fix] vulnerability in starbank-ecdsa dependency chore: fix vulnerability in starbank-ecdsa dependency Nov 9, 2021
Copy link
Contributor

@JenniferMah JenniferMah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR @hellno!

@kapilt
Copy link

kapilt commented Nov 10, 2021

this also needs a release, else all apps depending on sendgrid library get flagged for the cve

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
status: code review request requesting a community code review or review from Twilio type: security known security issue
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Dependency starkbank-ecdsa forces high-severity vulnerability
4 participants