Update dependency mpath to 0.8.4 [SECURITY] - autoclosed

renovate[bot] commented 3 years ago

This PR contains the following updates:

Package	Change
mpath	`0.8.3` -> `0.8.4`

GitHub Vulnerability Alerts

CVE-2021-23438

This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['proto']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input.

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

[ ] If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

vercel[bot] commented 3 years ago

This pull request is being automatically deployed with Vercel (learn more).
To see the status of your deployments, click below or on the icon next to each commit.

batman – ./packages/ui/clients/batman

🔍 Inspect: https://vercel.com/yurikrupnik/batman/CYEmhSp7L7jdVREj7Qvrdp1Eknzu
✅ Preview: Failed

alfred – ./packages/ui/clients/alfred

🔍 Inspect: https://vercel.com/yurikrupnik/alfred/7qA3rXYfsvxxduMUh2b3Cht1Whk5
✅ Preview: Failed

secure-code-warrior-for-github[bot] commented 3 years ago

Micro-Learning Topic: Type confusion (Detected by phrase)

Matched on "type confusion"

What is this? (2min video)

When attackers are able to manipulate the memory reserved for objects directly, they can then pass a reference to a crafted block of memory to be used in the place of a valid object type. This triggers the run time engine to execute arbitrary code which is under the control of the attacker due to the induced type confusion.

yurikrupnik / mussia8