Merge branch 'main' into chore-embroider
This commit is contained in:
9 files changed
+38
-111
No files matched your search
@@ -19,23 +19,6 @@ jobs:
|
||||
if: steps.cache.outputs.cache-hit != 'true'
|
||||
- run: yarn run compliance:licenses
|
||||
|
||||
audit:
|
||||
name: Security Audit
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v2
|
||||
- uses: actions/cache@v2
|
||||
id: cache
|
||||
with:
|
||||
path: '**/node_modules'
|
||||
key: ${{ runner.os }}-${{ hashFiles('**/yarn.lock') }}
|
||||
- uses: actions/setup-node@v1
|
||||
with:
|
||||
node-version: '12.x'
|
||||
- run: yarn install
|
||||
if: steps.cache.outputs.cache-hit != 'true'
|
||||
- run: yarn run compliance:audit
|
||||
|
||||
lint:
|
||||
name: Lint
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
Regular → Executable
+11
-2
@@ -6,24 +6,33 @@ version: '3.8'
|
||||
|
||||
services:
|
||||
node: &node
|
||||
image: docker.mirror.hashicorp.services/node:12
|
||||
image: docker.mirror.hashicorp.services/node:14
|
||||
volumes:
|
||||
- './:/src'
|
||||
- 'icu_node_modules:/src/node_modules'
|
||||
- 'icu_addons_api_node_modules:/src/addons/api/node_modules'
|
||||
- 'icu_addons_auth_node_modules:/src/addons/auth/node_modules'
|
||||
- 'icu_addons_core_node_modules:/src/addons/core/node_modules'
|
||||
- 'icu_addons_rose_node_modules:/src/addons/rose/node_modules'
|
||||
- 'icu_ui_admin_node_modules:/src/ui/admin/node_modules'
|
||||
- 'icu_ui_desktop_node_modules:/src/ui/desktop/node_modules'
|
||||
working_dir: /src
|
||||
|
||||
build:
|
||||
build-admin:
|
||||
<<: *node
|
||||
entrypoint: bash
|
||||
command: '-c "yarn install && yarn build:ui:admin && chmod -R 777 ."'
|
||||
|
||||
build-desktop-production:
|
||||
<<: *node
|
||||
entrypoint: bash
|
||||
command: '-c "yarn install && yarn build:ui:desktop:production && chmod -R 777 ."'
|
||||
|
||||
volumes:
|
||||
icu_node_modules:
|
||||
icu_addons_api_node_modules:
|
||||
icu_addons_auth_node_modules:
|
||||
icu_addons_core_node_modules:
|
||||
icu_addons_rose_node_modules:
|
||||
icu_ui_admin_node_modules:
|
||||
icu_ui_desktop_node_modules:
|
||||
Regular → Executable
+4
-3
@@ -16,6 +16,7 @@
|
||||
"build": "yarn build:ui:admin",
|
||||
"build:ui:admin": "cd ui/admin && yarn build",
|
||||
"build:ui:desktop": "cd ui/desktop && yarn build",
|
||||
"build:ui:desktop:production": "cd ui/desktop && yarn build:production",
|
||||
"lint": "npm-run-all lint:*",
|
||||
"lint:addons-api": "cd addons/api && yarn lint",
|
||||
"lint:addons-auth": "cd addons/auth && yarn lint",
|
||||
@@ -30,8 +31,7 @@
|
||||
"test:addons-rose": "cd addons/rose && yarn test",
|
||||
"test:ui-admin": "cd ui/admin && yarn test",
|
||||
"test:ui-desktop": "cd ui/desktop && yarn test",
|
||||
"compliance:audit": "bash ./scripts/yarn-audit.sh",
|
||||
"precommit": "yarn compliance:licenses && yarn compliance:audit && yarn lint && yarn test",
|
||||
"precommit": "yarn compliance:licenses && yarn lint && yarn test",
|
||||
"commit": "git-cz",
|
||||
"compliance:licenses": "license-checker --onlyAllow 'Apache*;Apache License, Version 2.0;Apache-2.0;Apache 2.0;Artistic-2.0;BSD;BSD-3-Clause;CC-BY-3.0;CC-BY-4.0;CC0-1.0;ISC;MIT;MPL-2.0;Public Domain;Python-2.0;Unicode-TOU;Unlicense;WTFPL' --excludePackages 'boundary-ui;admin@0.0.0;desktop@0.0.0;base64-js@0.0.2;cycle@1.0.3'",
|
||||
"doc:toc": "doctoc README.md"
|
||||
@@ -64,7 +64,8 @@
|
||||
"xmlhttprequest-ssl": "^1.6.2",
|
||||
"underscore": "^1.12.1",
|
||||
"hosted-git-info": "3.0.8",
|
||||
"trim": "~1.0.1"
|
||||
"trim": "~1.0.1",
|
||||
"browserslist": "^4.16.5"
|
||||
},
|
||||
"config": {
|
||||
"commitizen": {
|
||||
|
||||
@@ -1,38 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Workaround to suppress yarn audit report for issues without known resolutions.
|
||||
# Audit level: Moderate
|
||||
# https://github.com/yarnpkg/yarn/issues/6669
|
||||
|
||||
set -u
|
||||
|
||||
set +e
|
||||
output=$(yarn audit --level=moderate --json)
|
||||
result=$?
|
||||
set -e
|
||||
|
||||
if [ $result -eq 0 ]; then
|
||||
# everything is fine
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [ -f yarn-audit-known-issues ] && echo "$output" | grep auditAdvisory | diff -q yarn-audit-known-issues - > /dev/null 2>&1; then
|
||||
echo
|
||||
echo Ignorning known vulnerabilities
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo
|
||||
echo Security vulnerabilities were found that were not ignored
|
||||
echo
|
||||
echo Check to see if these vulnerabilities apply to production
|
||||
echo and/or if they have fixes available. If they do not have
|
||||
echo fixes and they do not apply to production, you may ignore them
|
||||
echo
|
||||
echo To ignore these vulnerabilities, run:
|
||||
echo
|
||||
echo "yarn audit --level=moderate --json | grep auditAdvisory > yarn-audit-known-issues"
|
||||
echo
|
||||
echo and commit the yarn-audit-known-issues file
|
||||
|
||||
exit "$result"
|
||||
@@ -4,7 +4,7 @@
|
||||
<meta charset="utf-8">
|
||||
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
||||
<title>Admin</title>
|
||||
<meta name="description" content="">
|
||||
<meta name="description" content="Simple and secure remote access with HashiCorp Boundary.">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
|
||||
{{content-for "head"}}
|
||||
@@ -12,7 +12,7 @@
|
||||
<link integrity="" rel="stylesheet" href="{{rootURL}}assets/vendor.css">
|
||||
<link integrity="" rel="stylesheet" href="{{rootURL}}assets/admin.css">
|
||||
|
||||
<link rel="icon" type="image/svg+xml" href="{{rootURL}}logo-app.svg">
|
||||
<link rel="icon" type="image/svg+xml" href="{{rootURL}}core/logo-app.svg">
|
||||
|
||||
{{content-for "head-footer"}}
|
||||
</head>
|
||||
|
||||
@@ -33,12 +33,12 @@ const findLatestVersion = (url) => {
|
||||
|
||||
// Find zip archive for update
|
||||
const findUpdateArchive = (version) => {
|
||||
const url = `${releasesUrl}boundary-desktop_${version}/boundary-desktop_${version}_darwin_amd64.zip`;
|
||||
const url = `${releasesUrl}${version}/boundary-desktop_${version}_darwin_amd64.zip`;
|
||||
return new Promise((resolve, reject) => {
|
||||
https.get(url, (response) => {
|
||||
if (response.statusCode === 403)
|
||||
reject({ message: 'Archive not available' });
|
||||
response.on('end', () => resolve(url));
|
||||
if (response.statusCode === 200) resolve(url);
|
||||
response.on('error', (err) => reject(err));
|
||||
});
|
||||
});
|
||||
@@ -136,7 +136,10 @@ module.exports = {
|
||||
latestVersion = semver.coerce(latestVersion);
|
||||
}
|
||||
|
||||
// Update not available - do nothing
|
||||
/**
|
||||
* Update not available - do nothing
|
||||
* lte(v1, v2): v1 <= v2
|
||||
**/
|
||||
if (semver.lte(latestVersion, currentVersion)) {
|
||||
if (!suppressNoUpdatePrompt) displayInfoPrompt();
|
||||
return;
|
||||
|
||||
Regular → Executable
+2
-1
@@ -11,7 +11,8 @@
|
||||
},
|
||||
"scripts": {
|
||||
"doc:toc": "doctoc README.md",
|
||||
"build": "EMBER_CLI_ELECTRON=true ember build --environment=production && yarn build:desktop",
|
||||
"build": "EMBER_CLI_ELECTRON=true yarn build:production && yarn build:desktop",
|
||||
"build:production": "ember build --environment=production",
|
||||
"build:development": "ember build",
|
||||
"prebuild:desktop": "cp -r dist/ electron-app/ember-dist/",
|
||||
"build:desktop": "cd electron-app && yarn make",
|
||||
|
||||
@@ -1,14 +0,0 @@
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}
|
||||
@@ -5962,32 +5962,14 @@ browserify-zlib@^0.2.0:
|
||||
dependencies:
|
||||
pako "~1.0.5"
|
||||
|
||||
browserslist@4.14.2:
|
||||
version "4.14.2"
|
||||
resolved "https://registry.yarnpkg.com/browserslist/-/browserslist-4.14.2.tgz#1b3cec458a1ba87588cc5e9be62f19b6d48813ce"
|
||||
integrity sha512-HI4lPveGKUR0x2StIz+2FXfDk9SfVMrxn6PLh1JeGUwcuoDkdKZebWiyLRJ68iIPDpMI4JLVDf7S7XzslgWOhw==
|
||||
browserslist@4.14.2, browserslist@^3.2.6, browserslist@^4.0.0, browserslist@^4.12.0, browserslist@^4.14.5, browserslist@^4.16.3, browserslist@^4.16.5:
|
||||
version "4.16.6"
|
||||
resolved "https://registry.yarnpkg.com/browserslist/-/browserslist-4.16.6.tgz#d7901277a5a88e554ed305b183ec9b0c08f66fa2"
|
||||
integrity sha512-Wspk/PqO+4W9qp5iUTJsa1B/QrYn1keNCcEP5OvP7WBwT4KaDly0uONYmC6Xa3Z5IqnUgS0KcgLYu1l74x0ZXQ==
|
||||
dependencies:
|
||||
caniuse-lite "^1.0.30001125"
|
||||
electron-to-chromium "^1.3.564"
|
||||
escalade "^3.0.2"
|
||||
node-releases "^1.1.61"
|
||||
|
||||
browserslist@^3.2.6:
|
||||
version "3.2.8"
|
||||
resolved "https://registry.yarnpkg.com/browserslist/-/browserslist-3.2.8.tgz#b0005361d6471f0f5952797a76fc985f1f978fc6"
|
||||
integrity sha512-WHVocJYavUwVgVViC0ORikPHQquXwVh939TaelZ4WDqpWgTX/FsGhl/+P4qBUAGcRvtOgDgC+xftNWWp2RUTAQ==
|
||||
dependencies:
|
||||
caniuse-lite "^1.0.30000844"
|
||||
electron-to-chromium "^1.3.47"
|
||||
|
||||
browserslist@^4.0.0, browserslist@^4.12.0, browserslist@^4.14.5, browserslist@^4.16.3:
|
||||
version "4.16.4"
|
||||
resolved "https://registry.yarnpkg.com/browserslist/-/browserslist-4.16.4.tgz#7ebf913487f40caf4637b892b268069951c35d58"
|
||||
integrity sha512-d7rCxYV8I9kj41RH8UKYnvDYCRENUlHRgyXy/Rhr/1BaeLGfiCptEdFE8MIrvGfWbBFNjVYx76SQWvNX1j+/cQ==
|
||||
dependencies:
|
||||
caniuse-lite "^1.0.30001208"
|
||||
caniuse-lite "^1.0.30001219"
|
||||
colorette "^1.2.2"
|
||||
electron-to-chromium "^1.3.712"
|
||||
electron-to-chromium "^1.3.723"
|
||||
escalade "^3.1.1"
|
||||
node-releases "^1.1.71"
|
||||
|
||||
@@ -6323,7 +6305,7 @@ caniuse-api@^3.0.0:
|
||||
lodash.memoize "^4.1.2"
|
||||
lodash.uniq "^4.5.0"
|
||||
|
||||
caniuse-lite@^1.0.0, caniuse-lite@^1.0.30000844, caniuse-lite@^1.0.30001109, caniuse-lite@^1.0.30001125, caniuse-lite@^1.0.30001157, caniuse-lite@^1.0.30001208:
|
||||
caniuse-lite@^1.0.0, caniuse-lite@^1.0.30001109, caniuse-lite@^1.0.30001157, caniuse-lite@^1.0.30001219:
|
||||
version "1.0.30001228"
|
||||
resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001228.tgz#bfdc5942cd3326fa51ee0b42fbef4da9d492a7fa"
|
||||
integrity sha512-QQmLOGJ3DEgokHbMSA8cj2a+geXqmnpyOFT0lhQV6P3/YOJvGDEwoedcwxEQ30gJIwIIunHIicunJ2rzK5gB2A==
|
||||
@@ -8140,10 +8122,10 @@ electron-rebuild@^2.0.3:
|
||||
tar "^6.0.5"
|
||||
yargs "^16.0.0"
|
||||
|
||||
electron-to-chromium@^1.3.47, electron-to-chromium@^1.3.564, electron-to-chromium@^1.3.712:
|
||||
version "1.3.712"
|
||||
resolved "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.3.712.tgz#ae467ffe5f95961c6d41ceefe858fc36eb53b38f"
|
||||
integrity sha512-3kRVibBeCM4vsgoHHGKHmPocLqtFAGTrebXxxtgKs87hNUzXrX2NuS3jnBys7IozCnw7viQlozxKkmty2KNfrw==
|
||||
electron-to-chromium@^1.3.723:
|
||||
version "1.3.738"
|
||||
resolved "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.3.738.tgz#aec24b091c82acbfabbdcce08076a703941d17ca"
|
||||
integrity sha512-vCMf4gDOpEylPSLPLSwAEsz+R3ShP02Y3cAKMZvTqule3XcPp7tgc/0ESI7IS6ZeyBlGClE50N53fIOkcIVnpw==
|
||||
|
||||
element-resize-detector@^1.2.2:
|
||||
version "1.2.2"
|
||||
@@ -9735,7 +9717,7 @@ es6-weak-map@^2.0.1:
|
||||
es6-iterator "^2.0.3"
|
||||
es6-symbol "^3.1.1"
|
||||
|
||||
escalade@^3.0.2, escalade@^3.1.1:
|
||||
escalade@^3.1.1:
|
||||
version "3.1.1"
|
||||
resolved "https://registry.yarnpkg.com/escalade/-/escalade-3.1.1.tgz#d8cfdc7000965c5a0174b4a82eaa5c0552742e40"
|
||||
integrity sha512-k0er2gUkLf8O0zKJiAhmkTnJlTvINGv7ygDNPbeIsX/TJjGJZHuh9B2UxbsaEkmlEo9MfhrSzmhIlhRlI2GXnw==
|
||||
@@ -15602,7 +15584,7 @@ node-pre-gyp@^0.11.0:
|
||||
semver "^5.3.0"
|
||||
tar "^4"
|
||||
|
||||
node-releases@^1.1.61, node-releases@^1.1.71:
|
||||
node-releases@^1.1.71:
|
||||
version "1.1.71"
|
||||
resolved "https://registry.yarnpkg.com/node-releases/-/node-releases-1.1.71.tgz#cb1334b179896b1c89ecfdd4b725fb7bbdfc7dbb"
|
||||
integrity sha512-zR6HoT6LrLCRBwukmrVbHv0EpEQjksO6GmFcZQQuCAy139BEsoVKPYnf3jongYW83fAa1torLGYwxxky/p28sg==
|
||||
|
||||
Reference in new issue
Block a user