Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

axios version update #8

Open
MarcusHong opened this issue Apr 25, 2022 · 1 comment
Open

axios version update #8

MarcusHong opened this issue Apr 25, 2022 · 1 comment

Comments

@MarcusHong
Copy link

`# npm audit report

axios <=0.21.1
Severity: high
Incorrect Comparison in axios - GHSA-cph5-m8f7-6c5x
Server-Side Request Forgery in Axios - GHSA-4w2v-q235-vp99
Depends on vulnerable versions of follow-redirects
No fix available
node_modules/iamport-rest-client-nodejs/node_modules/axios
iamport-rest-client-nodejs *
Depends on vulnerable versions of axios
node_modules/iamport-rest-client-nodejs

follow-redirects <=1.14.7
Severity: high
Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects - GHSA-pw2r-vq6v-hr8c
Exposure of sensitive information in follow-redirects - GHSA-74fj-2j2h-c42q
No fix available
node_modules/iamport-rest-client-nodejs/node_modules/follow-redirects
axios <=0.21.1
Depends on vulnerable versions of follow-redirects
node_modules/iamport-rest-client-nodejs/node_modules/axios
iamport-rest-client-nodejs *
Depends on vulnerable versions of axios
node_modules/iamport-rest-client-nodejs

3 high severity vulnerabilities
`

@leejh10003
Copy link

저도 본 이슈의 대응을 부탁드립니다. 현재 본 패키지가 사용중인 follow-redirects, axios 패키지에 보안 이슈가 있는 것으로 보입니다.
각각 다음과 같은 보안 문제를 포함하고 있습니다:

GHSA-4w2v-q235-vp99
GHSA-cph5-m8f7-6c5x
GHSA-74fj-2j2h-c42q
GHSA-pw2r-vq6v-hr8c

yarn audit은 follow-redirects >=1.14.8, axios >=0.21.2 를 사용할 것을 권고하고 있습니다.
package.json을 확인한 결과, follow-redirects는 axios의 의존성이니 이 부분 잘 참고해 주시길 부탁드립니다.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants