atomist-skills / docker-build-skill

Atomist Skill to build and push Docker images
Apache License 2.0
1 stars 0 forks source link

Fix tar > 6.1.6 #342

Closed atomist[bot] closed 3 years ago

atomist[bot] commented 3 years ago

This pull request fixes all 2 high security vulnerabilities open on 1a06655.

npm audit fix updated the following npm dependencies:


Fixed vulnerabilities

Following security vulnerabilities are fixed:

tar

Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization Upgrade to version 3.2.2, 4.4.14, 5.0.6, 6.1.1 or later high · <3.2.2 || >=4.0.0 <4.4.14 || >=5.0.0 <5.0.6 || >=6.0.0 <6.1.1 · CVE-2021-32804 · automatic fix available

tar@6.1.0 · 1 vulnerable path
  • @kubernetes/client-node > tar
  • Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning Upgrade to version 3.2.3, 4.4.15, 5.0.7, 6.1.2 or later high · <3.2.3 || >=4.0.0 <4.4.15 || >=5.0.0 <5.0.7 || >=6.0.0 <6.1.2 · CVE-2021-32803 · automatic fix available

    tar@6.1.0 · 1 vulnerable path
  • @kubernetes/client-node > tar

  • File changed:


    atomist/npm-vulnerability-scanner-skill · Configure

    atomist[bot] commented 3 years ago

    Pull request auto merged: