You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Our Docker image scanning checks are failing because of cross-spawn v7.0.3 vulnerability CVE-2024-21538 :
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
cross-spawn 7.0.3 7.0.5 npm GHSA-3xgq-45jj-v275 High
libcrypto3 3.1.7-r0 3.1.7-r1 apk CVE-2024-9143 Medium
libssl3 3.1.7-r0 3.1.7-r1 apk CVE-2024-9143 Medium
micromatch 4.0.5 4.0.8 npm GHSA-952p-6rrq-rcjv Medium
More details: after adding overrides in #3154, we are still failing our vulnerability scans. This is because the package is used in npm, and even though npm was updated with the fix in 10.9.1: npm/cli#7902, npm needs to be updated in our node 20 version as well, which seems to be blocked. Once Node is updated with the latest npm version, this vulnerability will be fixed.
The text was updated successfully, but these errors were encountered:
Context
Our Docker image scanning checks are failing because of cross-spawn v7.0.3 vulnerability CVE-2024-21538 :
More details: after adding overrides in #3154, we are still failing our vulnerability scans. This is because the package is used in npm, and even though npm was updated with the fix in 10.9.1: npm/cli#7902, npm needs to be updated in our node 20 version as well, which seems to be blocked. Once Node is updated with the latest npm version, this vulnerability will be fixed.
The text was updated successfully, but these errors were encountered: