watson / bonjour

A Bonjour/Zeroconf protocol implementation in JavaScript
MIT License
623 stars 143 forks source link

multicast-dns upgrade needed to address CVE #66

Open adlawren opened 3 years ago

adlawren commented 3 years ago

Greetings :wave:

A CVE was recently opened for dns-packet: https://nvd.nist.gov/vuln/detail/CVE-2021-23386. dns-packet is a dependency of multicast-dns. multicast-dns uses the fixed version of dns-packet as of version 7.2.3: https://github.com/mafintosh/multicast-dns/blob/309a1aa77fc85a81f04117ca16350b87a26faba1/package.json#L11, however bonjour currently only uses multicast-dns versions from the 6.x series: https://github.com/watson/bonjour/blob/master/package.json#L11; multicast-dns will need to be upgraded to pull in the fix for this CVE

Trunk89 commented 2 years ago

Any chance this dependency will be bumped into a newer version anytime soon?