search

orchidhq / Orchid

Build and deploy beautiful documentation sites that grow with you
https://orchid.run
GNU General Public License v3.0
512 stars 53 forks source link

Could you help upgrade the vulnerble dependency in sass-gradle-plugin? #413

Open HelenParr opened 2 years ago

HelenParr commented 2 years ago

Hi, @cjbrooks12 , @singularsyntax , I'd like to report a vulnerability issue in io.github.javaeden.orchid:OrchidCore:v0.3.12.

Issue Description

I noticed that io.github.javaeden.orchid:OrchidCore:v0.3.12 directly depends on io.bit3:jsass_5.5.3. As shown in the following dependency graph. However, io.bit3:jsass_5.5.3 sufferes from the vulnerabilites which the libsass(version:3.4.5) exposed, containing the following 25 CVEs: CVE-2019-18797, CVE-2019-18798,CVE-2019-18799, CVE-2018-20821, CVE-2018-19838, CVE-2018-19839, CVE-2018-19837, CVE-2018-11698, CVE-2018-11697, CVE-2018-11696, CVE-2018-11695, CVE-2018-11694, CVE-2018-11693, CVE-2018-11499, CVE-2017-12962, CVE-2017-12964, CVE-2017-12963, CVE-2017-11342, CVE-2017-11341, CVE-2017-10687, CVE-2017-11608, CVE-2017-11605, CVE-2017-11556, CVE-2017-11555, CVE-2017-11554

Dependency Graph between Java and Shared Libraries

image

Suggested Vulnerability Patch Versions

io.bit3:jsass:5.10.3 (>=5.10.3) has upgraded this vulnerable C library to the patch version.

Java build tools cannot report vulnerable shared libraries, which may induce potential security issues to many downstream Java projects. Could you please upgrade this vulnerable dependency?

Thanks for your help~ Best regards, Helen Parr