Potential security vulnerability in one of your dependencies #13

Activity

1. gmacario

   added

   bugSomething isn't workingSomething isn't working

   help wantedExtra attention is neededExtra attention is needed

   on Jun 17, 2018
2. gmacario commented on Jun 17, 2018

   

   gmacario

   on Jun 17, 2018

   MemberAuthor

   More actions

   As shown in https://github.com/hackafake/hackafake-dashboard/network/dependencies

   
3. gmacario commented on Jun 17, 2018

   

   gmacario

   on Jun 17, 2018

   Last edited by gmacario

   MemberAuthor

   More actions

   @ludusrusso could you explain to a NodeJS-newbie like myself what I should do to fix this issue?
4. gmacario

   added a commit that references this issue on Jul 2, 2018

   Update package.json, package-lock.json

   ...

   230f141
5. gmacario

   closed this as completedin f495fcfon Jul 2, 2018
6. gmacario

   reopened this on Jul 2, 2018
7. gmacario commented on Jul 2, 2018

   

   gmacario

   on Jul 2, 2018

   MemberAuthor

   More actions

   Unfortunately the issue is still present.

   TODO: Check

   • https://github.com/hackafake/hackafake-dashboard/blob/master/package.json
   • https://github.com/hackafake/hackafake-dashboard/blob/master/package-lock.json
8. gmacario commented on Jul 2, 2018

   

   gmacario

   on Jul 2, 2018

   MemberAuthor

   More actions

   Inspecting NodeJS package dependencies

   gpmacario@nemo:~/github/hackafake/hackafake-dashboard (master)$ npm ll hoek
   hackafake-dashboard@0.0.0
   │ /home/gpmacario/github/hackafake/hackafake-dashboard
   │ ![Screen](screen.png)
   ├─┬ @angular/cli@1.7.4
   │ │ CLI tool for Angular
   │ │ git+https://github.com/angular/angular-cli.git
   │ │ https://github.com/angular/angular-cli
   │ └─┬ less@2.7.3
   │   │ Leaner CSS
   │   │ git+https://github.com/less/less.js.git
   │   │ http://lesscss.org
   │   └─┬ request@2.81.0
   │     │ Simplified HTTP request client.
   │     │ git+https://github.com/request/request.git
   │     │ https://github.com/request/request#readme
   │     └─┬ hawk@3.1.3
   │       │ HTTP Hawk Authentication Scheme
   │       │ git://github.com/hueniverse/hawk.git
   │       │ https://github.com/hueniverse/hawk#readme
   │       ├─┬ boom@2.10.1
   │       │ │ HTTP-friendly error objects
   │       │ │ git://github.com/hapijs/boom.git
   │       │ │ https://github.com/hapijs/boom#readme
   │       │ └── hoek@2.16.3  deduped
   │       │     General purpose node utilities
   │       │     git://github.com/hapijs/hoek.git
   │       │     https://github.com/hapijs/hoek#readme
   │       ├── hoek@2.16.3
   │       │   General purpose node utilities
   │       │   git://github.com/hapijs/hoek.git
   │       │   https://github.com/hapijs/hoek#readme
   │       └─┬ sntp@1.0.9
   │         │ SNTP Client
   │         │ git://github.com/hueniverse/sntp.git
   │         │ https://github.com/hueniverse/sntp#readme
   │         └── hoek@2.16.3  deduped
   │             General purpose node utilities
   │             git://github.com/hapijs/hoek.git
   │             https://github.com/hapijs/hoek#readme
   └─┬ @angular/compiler-cli@5.2.9
     │ Angular - the compiler CLI for Node.js
     │ git+https://github.com/angular/angular.git
     │ https://github.com/angular/angular/tree/master/packages/compiler-cli
     └─┬ chokidar@1.7.0
       │ A neat wrapper around node.js fs.watch / fs.watchFile / fsevents.
       │ git+https://github.com/paulmillr/chokidar.git
       │ https://github.com/paulmillr/chokidar
       └─┬ UNMET OPTIONAL DEPENDENCY fsevents@1.1.3
         └─┬ UNMET OPTIONAL DEPENDENCY node-pre-gyp@0.6.39
           └─┬ UNMET DEPENDENCY hawk@3.1.3
             ├─┬ UNMET DEPENDENCY boom@2.10.1
             │ └── UNMET DEPENDENCY hoek@2.16.3
             ├── UNMET DEPENDENCY hoek@2.16.3
             └─┬ UNMET DEPENDENCY sntp@1.0.9
               └── UNMET DEPENDENCY hoek@2.16.3
   
   npm ERR! missing: hawk@3.1.3, required by node-pre-gyp@0.6.39
   npm ERR! missing: boom@2.10.1, required by hawk@3.1.3
   npm ERR! missing: hoek@2.16.3, required by hawk@3.1.3
   npm ERR! missing: sntp@1.0.9, required by hawk@3.1.3
   npm ERR! missing: hoek@2.16.3, required by boom@2.10.1
   npm ERR! missing: hoek@2.16.3, required by sntp@1.0.9
   gpmacario@nemo:~/github/hackafake/hackafake-dashboard (master)$
   
9. gmacario commented on Jul 2, 2018

   

   gmacario

   on Jul 2, 2018

   MemberAuthor

   More actions

   @ludusrusso any suggestions here?
10. gmacario

    added a commit that references this issue on Jul 4, 2018

    Update package-lock.json

    ...

    993ffab
11. gmacario

    closed this as completedin #22on Jul 4, 2018
12. gmacario

    added a commit that references this issue on Jul 4, 2018

    Update package-lock.json (#22)

    ...

    8c998c7
13. gmacario commented on Jul 4, 2018

    

    gmacario

    on Jul 4, 2018

    MemberAuthor

    More actions

    Even after merging #22 the dependency with known vulnerability

    

    is still present . See https://github.com/hackafake/hackafake-dashboard/blob/master/package-lock.json#L1148-L1156

    ...
        "boom": {
          "version": "2.10.1",
          "resolved": "https://registry.npmjs.org/boom/-/boom-2.10.1.tgz",
          "integrity": "sha1-OciRjO/1eZ+D+UkqhI9iWt0Mdm8=",
          "dev": true,
          "requires": {
            "hoek": "2.x.x"
          }
        },
    ...
    
14. gmacario

    reopened this on Jul 4, 2018