claudiajs / claudia

Deploy Node.js projects to AWS Lambda and API Gateway easily
https://claudiajs.com
MIT License
3.8k stars 276 forks source link

High severity vulnerability found due to https-proxy-agent dependency #207

Closed GoossensMichael closed 4 years ago

GoossensMichael commented 4 years ago

When running the npm audit command the following vulnerability pops up since 18th of october 2019. To resolve it an upgrade is needed of the https-proxy-agent to >= 3.0.0.

=== npm audit security report ===                        

┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Machine-In-The-Middle                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ https-proxy-agent                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=3.0.0                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ claudia                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ claudia > https-proxy-agent                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/1184                      │
└───────────────┴──────────────────────────────────────────────────────────────┘
gojko commented 4 years ago

fixed in claudia@5.9.1, now on NPM; thanks for reporting this