hyperledger-cacti / cacti

Hyperledger Cacti is a new approach to the blockchain interoperability problem
https://wiki.hyperledger.org/display/cactus
Apache License 2.0
344 stars 286 forks source link

fix: address CVE-2022-24434, GHSA-wm7h-9275-46v2 caused by dicer #3420

Closed petermetz closed 4 months ago

petermetz commented 4 months ago

The process for this fix was to:

  1. yarn why -R dicer
  2. Then examine the output of that and see which dependencies are using dicer indirectly (transient dependencies)
  3. yarn up multer --exact
  4. yarn up express-openapi-validator --exact
  5. Profit, e.g. running yarn why -R dicer at this point shows that dicer has been eliminated from the dependency tree completely.

https://github.com/hyperledger/cacti/security/dependabot/176

Weaknesses CWE-248

CVE ID CVE-2022-24434

GHSA ID GHSA-wm7h-9275-46v2

Signed-off-by: Peter Somogyvari peter.somogyvari@accenture.com

Pull Request Requirements

Character Limit

A Must Read for Beginners For rebasing and squashing, here's a must read guide for beginners.