Vulnerability found in cybersource-rest-client SDK
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- javascript, node.js
Research direction
Start by reviewing the dependency tree described in the issue and the package manifest to see how cybersource-rest-client brings in node-forge. Check the reported advisory and run npm audit to confirm the vulnerability; done means the SDK no longer depends on a vulnerable node-forge version without reverting to the outdated client version.
Written by the indexing model from the issue text.
Description
Currently our application scanned that cybersource-rest-client SDK is introducing vulnerability since it is relying on node-forge v1.4.0 dependency.
node-forge *
Severity: high
node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements - https://github.com/advisories/GHSA-86w9-cpqp-85rv
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/node-forge
cybersource-rest-client >=0.0.27
Depends on vulnerable versions of node-forge
node_modules/cybersource-rest-client
2 high severity vulnerabilities
https://github.com/digitalbazaar/forge/issues/1149
Unfortunately, it has no update from node-forge for months already. And executing npm audit fix to rollback to [email protected] is not a resolution since it is outdated and introduce more other vulnerabilities. Is there any opportunity to get rid of the node-forge dependency at this moment?
- Dominant language
- JavaScript
- Stars
- 50
- Forks
- 50
- Avg merge
- 3d 19h
- Merged PRs (30d)
- 1
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from CyberSource/cybersource-rest-client-node
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative insteadOpen
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 55/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 52/100
CyberSource/cybersource-rest-client-node#173 · 1 reaction ·
-
Difficulty 3/5 Half a day Newbie friendliness 35/100
CyberSource/cybersource-rest-client-node#148 · 2 comments ·
All issues in CyberSource/cybersource-rest-client-node
Similar issues
-
bug confirmed issue
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
open-webui/open-webui#33196 · 2 comments ·
Maintainers usually reply within 1 day
-
area: apple-music area: build-release bug effort: small priority: high
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
ChristianTabor/Argon#32 ·
Maintainers usually reply within 1 day
-
0️⃣ phase/new
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100