APSL/redux-i18n

a vulnerability CVE-2020-7598 is introduced in redux-i18n

ayaka-kms opened this issue · 7 comments

ayaka-kms commented

Hi, @francescarpi, a vulnerability CVE-2020-7598 is introduced in redux-i18n via:
● redux-i18n@1.5.23 ➔ optimist@0.6.1 ➔ minimist@0.0.10

optimist is a legacy package. It has not been maintained for about 8 years, and is not likely to be updated.
Is it possible to migrate optimist to other package to remediate this vulnerability?

I noticed several migration records for optimist in other js repos, such as

  1. in handlebars, version 4.7.3-->4.7.4, migrate optimist to yargs via commit
  2. in db-migrate, version 1.0.0-beta.2-->1.0.0-beta.3, migrate optimist to yargs via commit
  3. in http-server, version 0.12.1-->0.12.2, deprecated optimist and directly use minimist via commit

Are there any efforts planned that would remediate this vulnerability or migrate optimist?

Thanks
; )

JoshMLeslie commented

Is this lib deprecated? This is a critical vulnerability I'd like to see fixed. The change is super small, I wouldn't mind making a PR for this, but it seems adding branches to this repo is prohibited

AndreeWille commented

I would also like to have it fixed. To me it looks like migrating to minimist is easily done. I would be willing to create a PR if that helps.

francescarpi commented

Hi @AndreeWille .
I will be grateful if you can send me a PR, please.
Thanks.

  • 👍1
AndreeWille commented

any feedback to the PR would be appreciated.

francescarpi commented

Hi @AndreeWille ,
yes, sorry. I need to be relaxed for look your PR (and comments) with calm. I'm going to answer you soon.
Thx

  • 👍1
AndreeWille commented

Hi @francescarpi,

thanks a lot. I totally understand that you are working on other things and might have limited time.

francescarpi commented

PR #150 merged! Thanks a lot.