[
https://issues.apache.org/jira/browse/CB-7736?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14227640#comment-14227640
]
ASF GitHub Bot commented on CB-7736:
------------------------------------
GitHub user kant2002 opened a pull request:
https://github.com/apache/cordova-lib/pull/125
CB-7736 Update dependencies to promote qs module to 1.0
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/kant2002/cordova-lib CB-7736
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/cordova-lib/pull/125.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #125
----
commit 92b6ab279300e652b6b3445e6ac47aca56907e02
Author: Andrey Kurdyumov <[email protected]>
Date: 2014-10-30T11:58:49Z
Merge pull request #1 from apache/master
Merge with upstream
commit 9ad6b3c5e16ade064868e7002de9764c555695f3
Author: Andrey Kurdyumov <[email protected]>
Date: 2014-11-27T11:39:28Z
Merge pull request #2 from apache/master
Merge with upstream
commit b2e072cc9817a9600d67d2bd8f47b88b5c4e72d1
Author: Andrey Kurdyumov <[email protected]>
Date: 2014-11-27T13:13:42Z
Update NPM to don't have vulnerable qs dependency
----
> Vulnerability in qs dependency
> ------------------------------
>
> Key: CB-7736
> URL: https://issues.apache.org/jira/browse/CB-7736
> Project: Apache Cordova
> Issue Type: Bug
> Components: CLI
> Affects Versions: 3.6.0
> Reporter: Victor Adrian Sosa Herrera
> Priority: Critical
>
> There is a very well documented vulnerability issue in the qs module that
> comes as a dependency in request in cordova-cli
> https://nodesecurity.io/advisories/qs_dos_memory_exhaustion
> Here the tree of modules
> [email protected]
> ┬ [email protected]
> ├─┬ [email protected]
> │ └─┬ [email protected]
> │ └── [email protected]
> └─┬ [email protected]
> └── [email protected]
> Even though the tree says it is in a Cordova 3.5.0, the same versions are
> found in 3.6.3
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
