Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

tools(connector-besu): fix CVE-2022-21190 CVE-2023-36665 CVE-2022-2421 #2745

Closed
zondervancalvez opened this issue Oct 5, 2023 · 4 comments · Fixed by #3005
Closed

tools(connector-besu): fix CVE-2022-21190 CVE-2023-36665 CVE-2022-2421 #2745

zondervancalvez opened this issue Oct 5, 2023 · 4 comments · Fixed by #3005
Assignees
@aldousalvarez
Labels
Besu bug Something isn't working good-first-issue Good for newcomers good-first-issue-400-expert Hacktoberfest Hacktoberfest participants are welcome to take a stab at issues marked with this label. P2 Priority 2: High Security Related to existing or potential security vulnerabilities
Milestone
v2.0.0

Comments

@zondervancalvez
Copy link
Contributor

zondervancalvez commented Oct 5, 2023 •
edited
Loading

Description

Vulnerabilities were found during the container scan of connector-besu image using Trivy.
See the list below:

LIBRARY VULNERABILITY AFFECTED VERSION FIXED VERSION
libssl1.1
openssl		 CVE-2023-0286 1.1.1f-1ubuntu2.16 1.1.1f-1ubuntu2.17 
convict (package.json) CVE-2022-21190
CVE-2022-22143		 6.0.0 6.2.3

6.2.4
http-cache-semantics (package.json) CVE-2022-25881 4.1.0 4.1.1
node-forge (package.json) CVE-2022-24771
CVE-2022-24772		 1.0.0 1.3.0
protobufjs (package.json) CVE-2023-36665 6.11.3 7.2.4, 6.11.4
qs (package.json) CVE-2022-24999 6.7.0 6.10.3, 6.9.7, 6.8.3, 6.7.3,
6.6.1, 6.5.3, 6.4.1, 6.3.3,
socket.io-parser (package.json) CVE-2023-32695
CVE-2022-2421		 4.0.5
4.1.2		 4.2.3, 3.4.3
4.0.5, 4.2.1, 3.3.3, 3.4.2
@petermetz petermetz added bug Something isn't working Besu Security Related to existing or potential security vulnerabilities Hacktoberfest Hacktoberfest participants are welcome to take a stab at issues marked with this label. P2 Priority 2: High labels Oct 6, 2023
@petermetz petermetz added this to the v2.0.0 milestone Oct 6, 2023
@shubhankar-mern
Copy link

@petermetz @zondervancalvez assign me

@petermetz
Copy link
Contributor

@shubhankar-mern @aldousalvarez Please collaborate on it if possible (you've both volunteered to work on it)

@zondervancalvez zondervancalvez moved this from Todo to In Progress in Cacti_Scrum_Project_v2_Release Oct 10, 2023
@zondervancalvez zondervancalvez moved this from In Progress to Todo in Cacti_Scrum_Project_v2_Release Oct 10, 2023
@zondervancalvez
Copy link
Contributor Author

@shubhankar-mern @aldousalvarez see updated vulnerabilities from latest scan

@petermetz
Copy link
Contributor

@zondervancalvez Could you please make the issue title unique according to the guidelines we talked about previously?

@zondervancalvez zondervancalvez changed the title fix(security): vulnerabilities found in connector-besu tools(connector-besu): address CVEs: CVE-2022-21190, CVE-2023-36665, CVE-2022-2421 Nov 8, 2023
@jagpreetsinghsasan jagpreetsinghsasan moved this from Todo to In Progress in Cacti_Scrum_Project_v2_Release Jan 25, 2024
aldousalvarez added a commit to aldousalvarez/cactus that referenced this issue Jan 26, 2024
@aldousalvarez
tools(connector-besu): address CVEs: CVE-2022-21190, CVE-2023-36665, C…
dd13478 
…VE-2022-2421

Fixes hyperledger-cacti#2745

Primary Changes
----------------
1. Updated the version of the base image that is used in the Dockerfile

Signed-off-by: aldousalvarez <aldousss.alvarez@gmail.com>
@aldousalvarez aldousalvarez mentioned this issue Jan 26, 2024
Merged
5 tasks
aldousalvarez added a commit to aldousalvarez/cactus that referenced this issue Jan 29, 2024
@aldousalvarez
fix(connector-besu): address CVEs: CVE-2022-21190, CVE-2023-36665, CV…
779a061 
…E-2022-2421

Fixes hyperledger-cacti#2745

Primary Changes
----------------
1. Updated the version of the base image that is used in the Dockerfile

Signed-off-by: aldousalvarez <aldousss.alvarez@gmail.com>
@jagpreetsinghsasan jagpreetsinghsasan moved this from In Progress to In review in Cacti_Scrum_Project_v2_Release Jan 29, 2024
aldousalvarez added a commit to aldousalvarez/cactus that referenced this issue Jan 29, 2024
@aldousalvarez
fix(connector-besu): address CVEs: CVE-2022-21190, CVE-2023-36665, CV…
57dca71 
…E-2022-2421

Fixes hyperledger-cacti#2745

Primary Changes
----------------
1. Updated the version of the base image that is used in the Dockerfile
2. Updated the Dockerfile to use the yarn version 3
3. Updated the README to the new command to run the container

Signed-off-by: aldousalvarez <aldousss.alvarez@gmail.com>
aldousalvarez added a commit to aldousalvarez/cactus that referenced this issue Jan 30, 2024
@aldousalvarez
fix(connector-besu): address CVEs: CVE-2022-21190, CVE-2023-36665, CV…
ff2219b 
…E-2022-2421

Fixes hyperledger-cacti#2745

Primary Changes
----------------
1. Updated the version of the base image that is used in the Dockerfile
2. Updated the Dockerfile to use the yarn version 3
3. Updated the README to the new command to run the container

Signed-off-by: aldousalvarez <aldousss.alvarez@gmail.com>
aldousalvarez added a commit to aldousalvarez/cactus that referenced this issue Feb 2, 2024
@aldousalvarez
fix(connector-besu): address CVEs: CVE-2022-21190,
0f3e50b 
                    CVE-2023-36665, CVE-2022-2421

Primary Changes
----------------
1. Updated the version of the base image that is used in the Dockerfile
2. Updated the Dockerfile to use the yarn version 3
3. Updated the README to the new command to run the container

Fixes hyperledger-cacti#2745

Signed-off-by: aldousalvarez <aldousss.alvarez@gmail.com>
aldousalvarez added a commit to aldousalvarez/cactus that referenced this issue Feb 2, 2024
@aldousalvarez
fix(besu): address: CVE-2022-21190, CVE-2023-36665, CVE-2022-2421
2246097 
Primary Changes
----------------
1. Updated the version of the base image that is used in the Dockerfile
2. Updated the Dockerfile to use the yarn version 3
3. Updated the README to the new command to run the container

Fixes hyperledger-cacti#2745

Signed-off-by: aldousalvarez <aldousss.alvarez@gmail.com>
@petermetz petermetz changed the title tools(connector-besu): address CVEs: CVE-2022-21190, CVE-2023-36665, CVE-2022-2421 tools(connector-besu): fix CVE-2022-21190 CVE-2023-36665 CVE-2022-2421 Feb 7, 2024
aldousalvarez added a commit to aldousalvarez/cactus that referenced this issue Mar 18, 2024
@aldousalvarez
tools(connector-besu): fix CVE-2022-21190 CVE-2023-36665 CVE-2022-2421
145eb61 
Primary Changes
----------------
1. Updated the version of the base image that is used in the Dockerfile
2. Updated the Dockerfile to use the yarn version 3
3. Updated the README to the new command to run the container

Fixes hyperledger-cacti#2745

Signed-off-by: aldousalvarez <aldousss.alvarez@gmail.com>
aldousalvarez added a commit to aldousalvarez/cactus that referenced this issue Mar 19, 2024
@aldousalvarez
tools(connector-besu): fix CVE-2022-21190 CVE-2023-36665 CVE-2022-2421
8536cec 
Primary Changes
----------------
1. Updated the version of the base image that is used in the Dockerfile
2. Updated the Dockerfile to use the yarn version 3
3. Updated the README to the new command to run the container

Fixes hyperledger-cacti#2745

Signed-off-by: aldousalvarez <aldousss.alvarez@gmail.com>
aldousalvarez added a commit to aldousalvarez/cactus that referenced this issue Apr 1, 2024
@aldousalvarez
tools(connector-besu): fix CVE-2022-21190 CVE-2023-36665 CVE-2022-2421
5575ab4 
Primary Changes
----------------
1. Updated the version of the base image that is used in the Dockerfile
2. Updated the Dockerfile to use the yarn version 4
3. Updated the README to the new command to run the container

Fixes hyperledger-cacti#2745

Signed-off-by: aldousalvarez <aldousss.alvarez@gmail.com>
aldousalvarez added a commit to aldousalvarez/cactus that referenced this issue Apr 8, 2024
@aldousalvarez
build(connector-besu): fix CVE-2022-21190 CVE-2023-36665 CVE-2022-2421
60ad838 
Primary Changes
----------------
1. Updated the version of the base image that is used in the Dockerfile
2. Updated the Dockerfile to use the yarn version 4
3. Updated the README to the new command to run the container

Fixes hyperledger-cacti#2745

Signed-off-by: aldousalvarez <aldousss.alvarez@gmail.com>
aldousalvarez added a commit to aldousalvarez/cactus that referenced this issue Apr 9, 2024
@aldousalvarez
build(connector-besu): fix CVE-2022-21190 CVE-2023-36665 CVE-2022-2421
6953286 
Primary Changes
----------------
1. Updated the version of the base image that is used in the Dockerfile
2. Updated the Dockerfile to use the yarn version 4
3. Updated the README to the new command to run the container

Fixes hyperledger-cacti#2745

Signed-off-by: aldousalvarez <aldousss.alvarez@gmail.com>
petermetz pushed a commit to aldousalvarez/cactus that referenced this issue Jun 19, 2024
@aldousalvarez @petermetz
build(connector-besu): fix CVE-2022-21190 CVE-2023-36665 CVE-2022-2421
79f30fd 
Primary Changes
----------------
1. Updated the version of the base image that is used in the Dockerfile
2. Updated the Dockerfile to use the yarn version 4
3. Updated the README to the new command to run the container

Fixes hyperledger-cacti#2745

Signed-off-by: aldousalvarez <aldousss.alvarez@gmail.com>
petermetz pushed a commit to aldousalvarez/cactus that referenced this issue Jul 1, 2024
@aldousalvarez @petermetz
build(connector-besu): fix CVE-2022-21190 CVE-2023-36665 CVE-2022-2421
9888975 
Primary Changes
----------------
1. Updated the version of the base image that is used in the Dockerfile
2. Updated the Dockerfile to use the yarn version 4
3. Updated the README to the new command to run the container

Fixes hyperledger-cacti#2745

Signed-off-by: aldousalvarez <aldousss.alvarez@gmail.com>
@github-project-automation github-project-automation bot moved this from In review to Done in Cacti_Scrum_Project_v2_Release Jul 1, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@aldousalvarez aldousalvarez

Labels
Besu bug Something isn't working good-first-issue Good for newcomers good-first-issue-400-expert Hacktoberfest Hacktoberfest participants are welcome to take a stab at issues marked with this label. P2 Priority 2: High Security Related to existing or potential security vulnerabilities
Projects
None yet
Milestone
v2.0.0
Development

Successfully merging a pull request may close this issue.

build(connector-besu): fix CVE-2022-21190 CVE-2023-36665 CVE-2022-2421 aldousalvarez/cactus
4 participants
@petermetz @shubhankar-mern @zondervancalvez @aldousalvarez