Hi, @shotamakino @jhullfly, I have reported a vulnerability issue in package google-p12-pem.
As far as I am aware, vulnerability(high severity) CVE-2020-7720 detected in package node-forge(<0.10.0) is directly referenced by google-p12-pem@1.0.4, on which your package dashbot@11.2.5 transitively depends. As such, this vulnerability can also affect dashbot@11.2.5 via the following path:
dashbot@11.2.5 ➔ redact-pii@3.2.3 ➔ @google-cloud/dlp@0.12.0 ➔ google-gax@0.25.6 ➔ google-auth-library@3.1.2 ➔ gtoken@2.3.3 ➔ google-p12-pem@1.0.4 ➔ node-forge@0.8.5(vulnerable version)
Since google-p12-pem has released a new patched version google-p12-pem@1.0.5 to resolve this issue (google-p12-pem@1.0.5 ➔ node-forge@0.10.0(fix version)), then this vulnerability patch can be automatically propagated into your project only if you update your package-lock.json file (delete package-lock.json and re-execute npm install command):
dashbot@11.2.5 ➔ redact-pii@3.2.3 ➔ @google-cloud/dlp@0.12.0 ➔ google-gax@0.25.6 ➔ google-auth-library@3.1.2 ➔ gtoken@2.3.3 ➔ google-p12-pem@1.0.5 ➔ node-forge@0.10.0(vulnerability fix version).
Thank you for your attention to this issue.^_^
Hi, @shotamakino @jhullfly, I have reported a vulnerability issue in package google-p12-pem.
As far as I am aware, vulnerability(high severity) CVE-2020-7720 detected in package node-forge(<0.10.0) is directly referenced by google-p12-pem@1.0.4, on which your package dashbot@11.2.5 transitively depends. As such, this vulnerability can also affect dashbot@11.2.5 via the following path:
dashbot@11.2.5 ➔ redact-pii@3.2.3 ➔ @google-cloud/dlp@0.12.0 ➔ google-gax@0.25.6 ➔ google-auth-library@3.1.2 ➔ gtoken@2.3.3 ➔ google-p12-pem@1.0.4 ➔ node-forge@0.8.5(vulnerable version)Since google-p12-pem has released a new patched version google-p12-pem@1.0.5 to resolve this issue (google-p12-pem@1.0.5 ➔ node-forge@0.10.0(fix version)), then this vulnerability patch can be automatically propagated into your project only if you update your package-lock.json file (delete package-lock.json and re-execute npm install command):
dashbot@11.2.5 ➔ redact-pii@3.2.3 ➔ @google-cloud/dlp@0.12.0 ➔ google-gax@0.25.6 ➔ google-auth-library@3.1.2 ➔ gtoken@2.3.3 ➔ google-p12-pem@1.0.5 ➔ node-forge@0.10.0(vulnerability fix version).Thank you for your attention to this issue.^_^