search

protobufjs / protobuf.js

Protocol Buffers for JavaScript & TypeScript.
Other
9.76k stars 1.4k forks source link

Backport prototype setProperty checks to 6.11.3 #1909

Open ramy-abbas opened 1 year ago

ramy-abbas commented 1 year ago

Hey can you please backport the additional prototypesetProperty check added in #1899 to v.6.11.3 similar to how you backported the first check here

ramy-abbas commented 11 months ago

Hey @bcoe 👋 You reviewed the original PR so could you review @jportner PR?

mizevkon commented 11 months ago

This backport would be extremely helpful

Tom910 commented 11 months ago

This help to avoid https://nvd.nist.gov/vuln/detail/CVE-2023-36665 without upgrade a major version

levpachmanov commented 11 months ago

Hey @ramy-abbas @mizevkon , We're part of a startup called Seal Security that mitigates software vulnerabilities in older open source versions by backporting/creating standalone security patches - enabling more straightforward remediation in cases like this. We created an protobufjs 6.11.3-sp1 that's vulnerability-free. As with all of our patches, it's open-source and available for free.

If relevant, check out our GitHub repo if you wish to learn more, or start using our app.

Please feel free to reach us at info@seal.security if you have any requests/questions.

mizevkon commented 11 months ago

There is version 6.11.4 published to NPM, however there was no explicit changelog or other announcement. According to commits, changes are about the requested backport