search

okta / okta-oidc-js

okta-oidc-js
https://github.com/okta/okta-oidc-js
Other
395 stars 232 forks source link

security vulnerabilities from lodash #934

Closed faizhasim closed 3 years ago

faizhasim commented 4 years ago

I'm submitting this issue for the package(s):

I'm submitting a:

Current behavior

we run security scan for all dependencies and we found out that jwt-verifier is using lodash which contains multiple high level vulnerabilities from our scan:

image

image

image

image

from the look of it, you can try to upgrade your jwks-rsa to latest version which is released 8 hours ago. seems like the auth0 folks updated already address this issue at https://github.com/auth0/node-jwks-rsa/issues/86 last year.

i honestly feel that you should expedite this due to security concerns.

Expected behavior

for all the reported vulnerabilities to be fixed

Minimal reproduction of the problem with instructions

Extra information about the use case/user story you are trying to implement

Environment

swiftone commented 4 years ago

@faizhasim - Thanks for the detailed report, we'll dig into it.

faizhasim commented 3 years ago

Thanks for the fix.