-
Notifications
You must be signed in to change notification settings - Fork 12
Incorrect vulnerability details #305
Comments
* Update to owasp dep check 0.0.19, fixes dependency vulnerabilities * Remove omit=dev from npm audit compliance check, now owasp dep check dependencies are fixed * Latest package lock file for web api * Add false positive for CVE-2022-25878 in protobufjs 6.11.3 OSSIndex/vulns#305 * Allow WTFPL in allowed licenses for the web API (used by dependency of OWASP dep check, considered a permissive license) * False positives for vulnerabilities in AWS hotpatch for Log4j (we are not using AWS hotpatch) * False positives for vulnerabilities in AWS hotpatch for Log4j (we are not using AWS hotpatch)
Sorry for the delay. We have been working on getting appropriate internal processes defined for dealing with data issues in the new data set. We are now working on catching up on the backlog. This issue has been passed to the research team on our internal tracking system, and I will report back here once more is known. |
I just heard back. We have additional information from the researchers on this issue:
We are working on a feature to surface researcher comments when appropriate. |
Thanks for the update, much appreciated. I see protobufjs have now released a new major version as well: https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.0.0 |
Vulnerability URL
https://ossindex.sonatype.org/vulnerability/CVE-2022-25878?component-type=npm&component-name=protobufjs
Component URL
https://ossindex.sonatype.org/component/pkg:npm/protobufjs@6.11.3?utm_source=dependency-check&utm_medium=integration&utm_content=7.1.1
Description
This issue is fixed in protobufjsl 6.11.3, from 6.11.2. The vulnerability explicitly states so, and there is a commit here:
protobufjs/protobuf.js#1731
However, component version 6.11.3 is still flagged as having this vulnerability, and there is not yet a later version available.
Please can the component be updated so version 6.11.3 does not report this vulnerability? Alternatively, if there is still an issue, we'd need to update the vulnerability and report it to the package maintainer.
Hope this makes sense, apologies if I've missed something!
The text was updated successfully, but these errors were encountered: