{"action":"created","issue":{"url":"https://api.github.com/repos/firebase/firebase-js-sdk/issues/813","repository_url":"https://api.github.com/repos/firebase/firebase-js-sdk","labels_url":"https://api.github.com/repos/firebase/firebase-js-sdk/issues/813/labels{/name}","comments_url":"https://api.github.com/repos/firebase/firebase-js-sdk/issues/813/comments","events_url":"https://api.github.com/repos/firebase/firebase-js-sdk/issues/813/events","html_url":"https://github.com/firebase/firebase-js-sdk/issues/813","id":322521216,"number":813,"title":"NSP vulnerability for protobufjs <=6.8.5","user":{"login":"olastor","id":7479641,"avatar_url":"https://avatars0.githubusercontent.com/u/7479641?v=4","gravatar_id":"","url":"https://api.github.com/users/olastor","html_url":"https://github.com/olastor","followers_url":"https://api.github.com/users/olastor/followers","following_url":"https://api.github.com/users/olastor/following{/other_user}","gists_url":"https://api.github.com/users/olastor/gists{/gist_id}","starred_url":"https://api.github.com/users/olastor/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/olastor/subscriptions","organizations_url":"https://api.github.com/users/olastor/orgs","repos_url":"https://api.github.com/users/olastor/repos","events_url":"https://api.github.com/users/olastor/events{/privacy}","received_events_url":"https://api.github.com/users/olastor/received_events","type":"User","site_admin":false},"labels":[{"id":606540090,"url":"https://api.github.com/repos/firebase/firebase-js-sdk/labels/needs-triage","name":"needs-triage","color":"b60205","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-05-12T15:44:23Z","updated_at":"2018-05-27T10:07:43Z","closed_at":"2018-05-20T18:39:58Z","author_association":"NONE","body":"<!-- Step 1 [READ THIS] -->\r\n<!--\r\nAre you in the right place?\r\n  * For issues or feature requests related to __the code in this repository__\r\n    file a Github issue.\r\n    * If this is a __feature request__ make sure the issue title starts with \"FR:\".\r\n  * For general technical questions, post a question on [StackOverflow](http://stackoverflow.com/)\r\n    with the firebase tag.\r\n  * For general Firebase discussion, use the [firebase-talk](https://groups.google.com/forum/#!forum/firebase-talk)\r\n    google group.\r\n  * For help troubleshooting your application that does not fall under one\r\n    of the above categories, reach out to the personalized\r\n    [Firebase support channel](https://firebase.google.com/support/).\r\n-->\r\n\r\n<!-- Step 2 -->\r\n\r\n### [REQUIRED] Describe your environment\r\n\r\n  * Firebase SDK version: 5.0.2\r\n  * Firebase Product: firestore\r\n<!-- Step 3 -->\r\n\r\n### [REQUIRED] Describe the problem\r\n\r\n#### Steps to reproduce:\r\n<!--\r\n  What happened? How can we make the problem occur?\r\n  This could be a description, log/console output, etc.\r\n-->\r\n`nsp check`\r\n\r\n#### Relevant Code:\r\n\r\n<!-- \r\n  Reproduce the issue on StackBlitz and provide your forked URL\r\n  or give us some sample code below\r\n-->\r\nDidn't find this in the existing issues. NSP finds this vulnerability with latest version 5.0.2 installed. Can somebody reproduce?\r\n\r\n```\r\n(+) 1 vulnerability found\r\n┌────────────┬────────────────────────────────────────────────────────────────────┐\r\n│            │ Denial of Service                                                  │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Name       │ protobufjs                                                         │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ CVSS       │ 5 (Medium)                                                         │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Installed  │ 5.0.2                                                              │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Vulnerable │ <=6.8.5                                                            │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Patched    │ >=6.8.6                                                            │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Path       │ meditation-plus-angular@0.0.0 > firebase@5.0.2 >                   │\r\n│            │ @firebase/firestore@0.5.2 > grpc@1.10.1 > protobufjs@5.0.2         │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ More Info  │ https://nodesecurity.io/advisories/605                             │\r\n└────────────┴────────────────────────────────────────────────────────────────────┘\r\n\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/firebase/firebase-js-sdk/issues/comments/392319554","html_url":"https://github.com/firebase/firebase-js-sdk/issues/813#issuecomment-392319554","issue_url":"https://api.github.com/repos/firebase/firebase-js-sdk/issues/813","id":392319554,"user":{"login":"mboughaba","id":3800584,"avatar_url":"https://avatars0.githubusercontent.com/u/3800584?v=4","gravatar_id":"","url":"https://api.github.com/users/mboughaba","html_url":"https://github.com/mboughaba","followers_url":"https://api.github.com/users/mboughaba/followers","following_url":"https://api.github.com/users/mboughaba/following{/other_user}","gists_url":"https://api.github.com/users/mboughaba/gists{/gist_id}","starred_url":"https://api.github.com/users/mboughaba/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mboughaba/subscriptions","organizations_url":"https://api.github.com/users/mboughaba/orgs","repos_url":"https://api.github.com/users/mboughaba/repos","events_url":"https://api.github.com/users/mboughaba/events{/privacy}","received_events_url":"https://api.github.com/users/mboughaba/received_events","type":"User","site_admin":false},"created_at":"2018-05-27T10:07:43Z","updated_at":"2018-05-27T10:07:43Z","author_association":"NONE","body":"Hi,\r\n\r\nThis is still an issue. Protobufjs 5.0.3 seems vulnerable too.\r\n\r\n```shell\r\nλ nsp check --reporter table\r\n(+) 1 vulnerability found\r\n┌────────────┬────────────────────────────────────────────────────────────────────┐\r\n│            │ Denial of Service                                                  │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Name       │ protobufjs                                                         │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ CVSS       │ 5 (Medium)                                                         │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Installed  │ 5.0.3                                                              │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Vulnerable │ <=6.8.5                                                            │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Patched    │ >=6.8.6                                                            │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Path       │ alita-web@0.1.2 > firebase@5.0.4 > @firebase/firestore@0.5.4 >     │\r\n│            │ grpc@1.11.3 > protobufjs@5.0.3                                     │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ More Info  │ https://nodesecurity.io/advisories/605                             │\r\n└────────────┴────────────────────────────────────────────────────────────────────┘\r\n```\r\n\r\nCheers"}}
{"actor":{"display_login":"mboughaba"}}