Closed renovate[bot] closed 4 years ago
Merging #123 into master will not change coverage. The diff coverage is
n/a
.
@@ Coverage Diff @@
## master #123 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 2 2
Lines 60 60
=========================================
Hits 60 60
Continue to review full report at Codecov.
Legend - Click here to learn more
Δ = absolute <relative> (impact)
,ø = not affected
,? = missing data
Powered by Codecov. Last update d625f4f...8532986. Read the comment docs.
This PR contains the following updates:
8.0.0
->8.0.1
GitHub Vulnerability Alerts
GHSA-7xcx-6wjh-7xp2
GitHub Security Lab (GHSL) Vulnerability Report:
GHSL-2020-111
The GitHub Security Lab team has identified a potential security vulnerability in standard-version.
Summary
The
standardVersion
function has a command injection vulnerability. Clients of thestandard-version
library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.Product
Standard Version
Tested Version
Commit 2f04ac8
Details
Issue 1: Command injection in
standardVersion
The following proof-of-concept illustrates the vulnerability. First install Standard Version and create an empty git repo to run the PoC in:
Now create a file with the following contents:
and run it:
Notice that a file named
exploit
has been created.This vulnerability is similar to command injection vulnerabilities that have been found in other Javascript libraries. Here are some examples: CVE-2020-7646, CVE-2020-7614, CVE-2020-7597, CVE-2019-10778, CVE-2019-10776, CVE-2018-16462, CVE-2018-16461, CVE-2018-16460, CVE-2018-13797, CVE-2018-3786, CVE-2018-3772, CVE-2018-3746, CVE-2017-16100, CVE-2017-16042.
We have written a CodeQL query, which automatically detects this vulnerability. You can see the results of the query on the
standard-version
project here.Impact
This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.
Remediation
We recommend not using an API that can interpret a string as a shell command. For example, use
child_process.execFile
instead ofchild_process.exec
.Credit
This issue was discovered and reported by GitHub Engineer @erik-krogh (Erik Krogh Kristensen).
Contact
You can contact the GHSL team at
securitylab@github.com
, please includeGHSL-2020-111
in any communication regarding this issue.Disclosure Policy
This report is subject to our coordinated disclosure policy.
Release Notes
conventional-changelog/standard-version
### [`v8.0.1`](https://togithub.com/conventional-changelog/standard-version/blob/master/CHANGELOG.md#801-httpswwwgithubcomconventional-changelogstandard-versioncomparev800v801-2020-07-12) [Compare Source](https://togithub.com/conventional-changelog/standard-version/compare/v8.0.0...v8.0.1)Renovate configuration
:date: Schedule: "" (UTC).
:vertical_traffic_light: Automerge: Disabled by config. Please merge this manually once you are satisfied.
:recycle: Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
:no_bell: Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by WhiteSource Renovate. View repository job log here.