search

equinor / flyt

Equinor Flyt (aka. VSM - Value Stream Mapping)
https://flyt.equinor.com
MIT License
4 stars 1 forks source link

[Snyk] Security upgrade node from 18.19.1-alpine3.18 to 18.20.2-alpine3.18 #739

Closed KaterynaBasik closed 4 months ago

KaterynaBasik commented 4 months ago

This PR was automatically created by Snyk using the credentials of a real user.


![snyk-top-banner](https://github.com/andygongea/OWASP-Benchmark/assets/818805/c518c423-16fe-447e-b67f-ad5a49b5d123) ### Snyk has created this PR to fix 3 vulnerabilities in the dockerfile dependencies of this project. Keeping your Docker base image up-to-date means you’ll benefit from security fixes in the latest version of your chosen image. #### Snyk changed the following file(s): - `Dockerfile` We recommend upgrading to `node:18.20.2-alpine3.18`, as this image has only **3** known vulnerabilities. To do this, merge this pull request, then verify your application still works as expected. #### Vulnerabilities that will be fixed with an upgrade: | | Issue | Score | :-------------------------:|:-------------------------|:------------------------- ![high severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/h.png 'high severity') | Allocation of Resources Without Limits or Throttling
[SNYK-UPSTREAM-NODE-6564548](https://snyk.io/vuln/SNYK-UPSTREAM-NODE-6564548) |   **147**   ![high severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/h.png 'high severity') | Improper Control of Generation of Code ('Code Injection')
[SNYK-UPSTREAM-NODE-6615824](https://snyk.io/vuln/SNYK-UPSTREAM-NODE-6615824) |   **113**   ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png 'medium severity') | Out-of-bounds Write
[SNYK-ALPINE318-BUSYBOX-6913411](https://snyk.io/vuln/SNYK-ALPINE318-BUSYBOX-6913411) |   **80**   ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png 'medium severity') | Out-of-bounds Write
[SNYK-ALPINE318-BUSYBOX-6913411](https://snyk.io/vuln/SNYK-ALPINE318-BUSYBOX-6913411) |   **80**   ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png 'medium severity') | Out-of-bounds Write
[SNYK-ALPINE318-BUSYBOX-6913411](https://snyk.io/vuln/SNYK-ALPINE318-BUSYBOX-6913411) |   **80**   --- > [!IMPORTANT] > > - Check the changes in this PR to ensure they won't cause issues with your project. > - Max score is 1000. Note that the real score may have changed since the PR was raised. > - This PR was automatically created by Snyk using the credentials of a real user. --- **Note:** _You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs._ For more information: 🧐 [View latest project report](https://app.snyk.io/org/dsd-mobile/project/b2e8eed6-c04a-4ff8-af50-a79b02294195?utm_source=github&utm_medium=referral&page=fix-pr) 📜 [Customise PR templates](https://docs.snyk.io/scan-using-snyk/pull-requests/snyk-fix-pull-or-merge-requests/customize-pr-templates) 🛠 [Adjust project settings](https://app.snyk.io/org/dsd-mobile/project/b2e8eed6-c04a-4ff8-af50-a79b02294195?utm_source=github&utm_medium=referral&page=fix-pr/settings) 📚 [Read about Snyk's upgrade logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Allocation of Resources Without Limits or Throttling](https://learn.snyk.io/lesson/no-rate-limiting/?loc=fix-pr) 🦉 [Improper Control of Generation of Code ('Code Injection')](https://learn.snyk.io/lesson/malicious-code-injection/?loc=fix-pr) [//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"node","from":"18.19.1-alpine3.18","to":"18.20.2-alpine3.18"}],"env":"prod","issuesToFix":[{"exploit_maturity":"No Known Exploit","id":"SNYK-UPSTREAM-NODE-6564548","priority_score":147,"priority_score_factors":[{"name":"confidentiality","value":"none"},{"name":"integrity","value":"none"},{"name":"availability","value":"high"},{"name":"scope","value":"unchanged"},{"name":"exploitCodeMaturity"},{"name":"userInteraction","value":"none"},{"name":"privilegesRequired","value":"none"},{"name":"attackComplexity","value":"low"},{"name":"attackVector","value":"network"},{"name":"epss","value":0.00045},{"name":"isTrending","value":false},{"name":"publicationDate","value":"Thu Apr 04 2024 20:31:57 GMT+0000 (Coordinated Universal Time)"},{"name":"isReachable","value":false},{"name":"isTransitive","value":false},{"name":"isMalicious","value":false},{"name":"businessCriticality","value":"high"},{"name":"relativeImportance","value":"high"},{"name":"relativePopularityRank","value":0},{"name":"impact","value":5.99},{"name":"likelihood","value":2.44},{"name":"scoreVersion","value":"V5"}],"severity":"high","title":"Allocation of Resources Without Limits or Throttling"},{"exploit_maturity":"No Known Exploit","id":"SNYK-UPSTREAM-NODE-6615824","priority_score":113,"priority_score_factors":[{"name":"confidentiality","value":"low"},{"name":"integrity","value":"low"},{"name":"availability","value":"none"},{"name":"scope","value":"changed"},{"name":"exploitCodeMaturity"},{"name":"userInteraction","value":"none"},{"name":"privilegesRequired","value":"none"},{"name":"attackComplexity","value":"low"},{"name":"attackVector","value":"network"},{"name":"epss","value":0.01055},{"name":"isTrending","value":false},{"name":"publicationDate","value":"Tue Apr 16 2024 12:51:51 GMT+0000 (Coordinated Universal Time)"},{"name":"isReachable","value":false},{"name":"isTransitive","value":false},{"name":"isMalicious","value":false},{"name":"businessCriticality","value":"high"},{"name":"relativeImportance","value":"high"},{"name":"relativePopularityRank","value":0},{"name":"impact","value":4.54},{"name":"likelihood","value":2.47},{"name":"scoreVersion","value":"V5"}],"severity":"high","title":"Improper Control of Generation of Code ('Code Injection')"},{"exploit_maturity":"No Known Exploit","id":"SNYK-ALPINE318-BUSYBOX-6913411","priority_score":80,"priority_score_factors":[{"name":"confidentiality","value":"none"},{"name":"integrity","value":"none"},{"name":"availability","value":"high"},{"name":"scope","value":"unchanged"},{"name":"exploitCodeMaturity"},{"name":"userInteraction","value":"required"},{"name":"privilegesRequired","value":"none"},{"name":"attackComplexity","value":"low"},{"name":"attackVector","value":"local"},{"name":"epss","value":0.00044},{"name":"isTrending","value":false},{"name":"publicationDate","value":"Sun May 19 2024 02:17:18 GMT+0000 (Coordinated Universal Time)"},{"name":"isReachable","value":false},{"name":"isTransitive","value":false},{"name":"isMalicious","value":false},{"name":"businessCriticality","value":"high"},{"name":"relativeImportance","value":"medium"},{"name":"relativePopularityRank","value":0},{"name":"impact","value":5.99},{"name":"likelihood","value":1.33},{"name":"scoreVersion","value":"V5"}],"severity":"medium","title":"Out-of-bounds Write"},{"exploit_maturity":"No Known Exploit","id":"SNYK-ALPINE318-BUSYBOX-6913411","priority_score":80,"priority_score_factors":[{"name":"confidentiality","value":"none"},{"name":"integrity","value":"none"},{"name":"availability","value":"high"},{"name":"scope","value":"unchanged"},{"name":"exploitCodeMaturity"},{"name":"userInteraction","value":"required"},{"name":"privilegesRequired","value":"none"},{"name":"attackComplexity","value":"low"},{"name":"attackVector","value":"local"},{"name":"epss","value":0.00044},{"name":"isTrending","value":false},{"name":"publicationDate","value":"Sun May 19 2024 02:17:18 GMT+0000 (Coordinated Universal Time)"},{"name":"isReachable","value":false},{"name":"isTransitive","value":false},{"name":"isMalicious","value":false},{"name":"businessCriticality","value":"high"},{"name":"relativeImportance","value":"medium"},{"name":"relativePopularityRank","value":0},{"name":"impact","value":5.99},{"name":"likelihood","value":1.33},{"name":"scoreVersion","value":"V5"}],"severity":"medium","title":"Out-of-bounds Write"},{"exploit_maturity":"No Known Exploit","id":"SNYK-ALPINE318-BUSYBOX-6913411","priority_score":80,"priority_score_factors":[{"name":"confidentiality","value":"none"},{"name":"integrity","value":"none"},{"name":"availability","value":"high"},{"name":"scope","value":"unchanged"},{"name":"exploitCodeMaturity"},{"name":"userInteraction","value":"required"},{"name":"privilegesRequired","value":"none"},{"name":"attackComplexity","value":"low"},{"name":"attackVector","value":"local"},{"name":"epss","value":0.00044},{"name":"isTrending","value":false},{"name":"publicationDate","value":"Sun May 19 2024 02:17:18 GMT+0000 (Coordinated Universal Time)"},{"name":"isReachable","value":false},{"name":"isTransitive","value":false},{"name":"isMalicious","value":false},{"name":"businessCriticality","value":"high"},{"name":"relativeImportance","value":"medium"},{"name":"relativePopularityRank","value":0},{"name":"impact","value":5.99},{"name":"likelihood","value":1.33},{"name":"scoreVersion","value":"V5"}],"severity":"medium","title":"Out-of-bounds Write"}],"prId":"77797acb-a493-4d31-bd8a-debc701dfed8","prPublicId":"77797acb-a493-4d31-bd8a-debc701dfed8","packageManager":"dockerfile","priorityScoreList":[147,113,80],"projectPublicId":"b2e8eed6-c04a-4ff8-af50-a79b02294195","projectUrl":"https://app.snyk.io/org/dsd-mobile/project/b2e8eed6-c04a-4ff8-af50-a79b02294195?utm_source=github&utm_medium=referral&page=fix-pr","prType":"fix","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":["updated-fix-title","priorityScore"],"type":"auto","upgrade":["SNYK-ALPINE318-BUSYBOX-6913411","SNYK-ALPINE318-BUSYBOX-6913411","SNYK-ALPINE318-BUSYBOX-6913411","SNYK-UPSTREAM-NODE-6564548","SNYK-UPSTREAM-NODE-6615824"],"vulns":["SNYK-UPSTREAM-NODE-6564548","SNYK-UPSTREAM-NODE-6615824","SNYK-ALPINE318-BUSYBOX-6913411"],"patch":[],"isBreakingChange":false,"remediationStrategy":"vuln"}'
github-actions[bot] commented 4 months ago

Pull request title linting :rotating_light:

In order to merge this pull request, the title of the pull request should be prefixed by one of the available types.

Available types:

Examples ``` feat(grpc): add new endpoint refactor: combine class A and class B ci: update pull request linter style: change format of strings ```

:tipping_hand_person: For more examples, visit https://www.conventionalcommits.org/en/v1.0.0/#examples.