Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix CVE-2024-21538 vulnerability #3153

Open
mkurapov opened this issue Dec 5, 2024 · 0 comments
Open

Fix CVE-2024-21538 vulnerability #3153

mkurapov opened this issue Dec 5, 2024 · 0 comments
Assignees

Comments

@mkurapov
Copy link
Contributor

mkurapov commented Dec 5, 2024

Context

Our Docker image scanning checks are failing because of cross-spawn v7.0.3 vulnerability CVE-2024-21538 :

NAME         INSTALLED  FIXED-IN  TYPE  VULNERABILITY        SEVERITY 
cross-spawn  7.0.3      7.0.5     npm   GHSA-3xgq-45jj-v275  High      
libcrypto3   3.1.7-r0   3.1.7-r1  apk   CVE-2024-9143        Medium    
libssl3      3.1.7-r0   3.1.7-r1  apk   CVE-2024-9143        Medium    
micromatch   4.0.5      4.0.8     npm   GHSA-952p-6rrq-rcjv  Medium

More details: after adding overrides in #3154, we are still failing our vulnerability scans. This is because the package is used in npm, and even though npm was updated with the fix in 10.9.1: npm/cli#7902, npm needs to be updated in our node 20 version as well, which seems to be blocked. Once Node is updated with the latest npm version, this vulnerability will be fixed.

@mkurapov mkurapov self-assigned this Dec 5, 2024
@github-project-automation github-project-automation bot moved this to Backlog in Rafiki Dec 5, 2024
@mkurapov mkurapov moved this from Backlog to In Progress in Rafiki Dec 6, 2024
@mkurapov mkurapov changed the title Fix cross-spawn vulnerability Fix CVE-2024-21538 vulnerability Dec 6, 2024
@mkurapov mkurapov moved this from In Progress to Backlog in Rafiki Dec 6, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: Backlog
Development

No branches or pull requests

1 participant