search

alhazmy13 / serverless-offline-python

Emulate AWS λ and API Gateway locally when developing your Serverless project
MIT License
35 stars 18 forks source link

cryptiles vulnerability found for versions < 4.1.2 #10

Open marcosfede opened 5 years ago

marcosfede commented 5 years ago

Serverless-offline-python installs the cryptiles package (hapi dependency) with a know vulnerability https://nvd.nist.gov/vuln/detail/CVE-2018-1000620

Robospecta commented 4 years ago

I am also experiencing the same issue. Running npm audit lists these vulnerabilities. Trying to run npm audit fix provides an error indicating these vulnerabilities cannot be fixed automatically.

To elaborate, the reason behind this is because the current hapi package has been moved/deprecated, and is not receiving critical updates to address these vulnerabilities. The newer version of the hapi package lives at a different address and I believe has resolved these security vulnerabilities.

I recommend updating the hapi dependency in the package.json to point to the location of the new package (@hapi/hapi).

Robospecta commented 4 years ago

Have opened a pull request for this #17.