Skip to content

Conversation

@hellno
Copy link
Contributor

@hellno hellno commented Nov 9, 2021

Fixes

Security vulnerability in starbank-ecdsa <=2.0.0
see GHSA-9wx7-jrvc-28mm for details

A short description of what this PR does.
Fixes #1023

Checklist

  • I acknowledge that all my contributions will be made under the project's license
  • I have made a material change to the repo (functionality, testing, spelling, grammar)
  • I have read the Contribution Guidelines and my PR follows them
  • I have titled the PR appropriately
  • I have updated my branch with the main branch
  • I have added tests that prove my fix is effective or that my feature works
  • I have added the necessary documentation about the functionality in the appropriate .md file
  • I have added inline documentation to the code I modified

@thomwiggers
Copy link

Should probably update to 2.0.2, as there were more checks missing.

@kapilt
Copy link

kapilt commented Nov 9, 2021

@thomwiggers this should pick up 2.0.2 per the >= dep spec albeit setting the min to 2.0.2 is also good.

[update] 2.0.2 release seems a little odd as there haven't been any repo changes in the last 5 days (from 2.0.1) release.

@JenniferMah JenniferMah added status: code review request requesting a community code review or review from Twilio type: security known security issue labels Nov 9, 2021
@JenniferMah JenniferMah changed the title [fix] vulnerability in starbank-ecdsa dependency chore: fix vulnerability in starbank-ecdsa dependency Nov 9, 2021
Copy link
Contributor

@JenniferMah JenniferMah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR @hellno!

@kapilt
Copy link

kapilt commented Nov 10, 2021

this also needs a release, else all apps depending on sendgrid library get flagged for the cve

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

status: code review request requesting a community code review or review from Twilio type: security known security issue

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Dependency starkbank-ecdsa forces high-severity vulnerability

4 participants