New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deps): update dependency simple-git to v3 [security] #81

Open

garykim-dev-renovate wants to merge 1 commit into master from renovate/npm-simple-git-vulnerability

garykim-dev-renovate bot commented May 20, 2022 •

edited

This PR contains the following updates:

Package	Type	Update	Change
simple-git	dependencies	major	`^2.42.0` -> `^3.0.0`

GitHub Vulnerability Alerts

CVE-2022-24433

The package simple-git before 3.3.0 is vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options, it was possible to get arbitrary command execution.

CVE-2022-24066

simple-git (maintained as git-js named repository on GitHub) is a light weight interface for running git commands in any node.js application.The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of CVE-2022-24433 which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover. A fix was released in simple-git@3.5.0.

CVE-2022-25912

The package simple-git before 3.15.0 is vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of CVE-2022-24066.

CVE-2022-25860

Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of CVE-2022-25912.

Release Notes

steveukx/git-js (simple-git)

`v3.16.0`

Minor Changes

97fde2c: Support the use of -B in place of the default -b in checkout methods
0a623e5: Adds vulnerability detection to prevent use of --upload-pack and --receive-pack without explicitly opting in.

Patch Changes

ec97a39: Include restricting the use of git push --exec with other allowUnsafePack exclusions, thanks to @stsewd for the suggestion.

`v3.15.1`

Patch Changes

de570ac: Resolves an issue whereby non-strings can be passed into the config switch detector.

`v3.15.0`

Minor Changes

7746480: Disables the use of inline configuration arguments to prevent unitentionally allowing non-standard remote protocols without explicitly opting in to this practice with the new allowUnsafeProtocolOverride property having been enabled.

Patch Changes

7746480: - Upgrade repo dependencies - lerna and jest
- Include node@19 in the test matrix

`v3.14.1`

Patch Changes

5a2e7e4: Add version parsing support for non-numeric patches (including "built from source" style 1.11.GIT)

`v3.14.0`

Minor Changes

19029fc: Create the abort plugin to allow cancelling all pending and future tasks.
4259b26: Add .version to return git version information, including whether the git binary is installed.

`v3.13.0`

Minor Changes

87b0d75: Increase the level of deprecation notices for use of simple-git/promise, which will be fully removed in the next major
d0dceda: Allow supplying just one of to/from in the options supplied to git.log

Patch Changes

6b3e05c: Use shared test utilities bundle in simple-git tests, to enable consistent testing across packages in the future

`v3.12.0`

Minor Changes

bfd652b: Add a new configuration option to enable trimming white-space from the response to git.raw

`v3.11.0`

Minor Changes

80d54bd: Added fields updated + deleted branch info to fetch response, closes #823

Patch Changes

75dfcb4: Add prettier configuration and apply formatting throughout.

`v3.10.0`

Minor Changes

2f021e7: Support for importing as an ES module with TypeScript moduleResolution node16 or newer by adding
simpleGit as a named export.

`v3.9.0`

Minor Changes

a0d4eb8: Branches that have been checked out as a linked work tree will now be included in the BranchSummary output, with a linkedWorkTree property set to true in the BranchSummaryBranch.

`v3.8.0`

Minor Changes

25230cb: Support for additional log formats in diffSummary / log / stashList.

Adds support for the --numstat, --name-only and --name-stat in addition to the existing --stat option.

Patch Changes

2cfc16f: Update CI environments to run build and test in node v18, drop node v12 now out of life.
13197f1: Update debug dependency to latest 4.x

`v3.7.1`

Patch Changes

adb4346: Resolves issue whereby renamed files no longer appear correctly in the response to git.status.

`v3.7.0`

Minor Changes

fa2c7f7: Enable the use of types when loading with module-resolution

Patch Changes

3805f6b: Timeout plugin no longer keeps short lived processes alive until timeout is hit

`v3.6.0`

Minor Changes

f2fc5c9: Show full commit hash in a CommitResult, prior to this change git.commit would result in a partial hash in the commit property if core.abbrev is unset or has a value under 40. Following this change the commit property will contain the full commit hash.

Patch Changes

c4a2a13: chore(deps): bump minimist from 1.2.5 to 1.2.6

`v3.5.0`

Minor Changes

2040de6: Resolves potential command injection vulnerability by preventing use of --upload-pack in git.clone

`v3.4.0`

Minor Changes

ed412ef: Use null separators in git.status to allow for non-ascii file names

`v3.3.0`

Minor Changes

d119ec4: Resolves potential command injection vulnerability by preventing use of --upload-pack in git.fetch

`v3.2.6`

Patch Changes

80651d5: Resolve issue in prePublish script

`v3.2.4`

Patch Changes

d35987b: Release with changesets

`v3.1.1`

`v3.1.0`

Features

optionally include ignored files in StatusResult (70e6767), closes #718

3.0.4 (2022-01-23)

Bug Fixes

support parsing empty responses (91eb7fb), closes #713

3.0.3 (2022-01-20)

Bug Fixes

allow branches without labels (07a1388)
implement v3 deprecations (ed6d18e)
publish v3 as latest (5db4434)

3.0.2 (2022-01-18)

Bug Fixes

Backward compatibility - permit loading simple-git/promise with deprecation notice until mid-2022. (4413c47)

3.0.1 (2022-01-18)

Bug Fixes

Documentation update (4e000f6)

`v3.0.4`

`v3.0.3`

`v3.0.2`

`v3.0.1`

`v2.48.0`

Features

StatusResult returned by git.status() should include detached state of the working copy. (#695) (f464ebe)

Bug Fixes

Add example for empty commit message in git.commit() (61089cb)

2.47.1 (2021-11-29)

Bug Fixes

Add support for node@17 in unit tests (0d3bf47)
Add support for node@17 in unit tests (0d3bf47)

`v2.47.1`

`v2.47.0`

Features

git-grep (653065e)

`v2.46.0`

Features

completion plugin (#684) (ecb7bd6)
completion plugin to allow configuring when simple-git determines the git tasks to be complete. (ecb7bd6)

2.45.1 (2021-09-04)

Bug Fixes

support progress events in locales other than western european character sets. (8cc42f8)

`v2.45.1`

`v2.45.0`

Features

Use author email field that respects mailmap (589d624)

Bug Fixes

getConfig always returns null despite values being present in configuration (9fd483a)

`v2.44.0`

Features

add support for getting the current value of a git configuration setting based on its name. (1d09204)

`v2.43.0`

Features

task callback types defined as single function type (b0a832c)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box


          fix(deps): update dependency simple-git to v3 [security]

2dbf2d8

Signed-off-by: Gary Kim Bot <bot@garykim.dev>

garykim-dev-renovate bot added the dependencies label

garykim-dev-renovate bot requested a review from gary-kim

May 20, 2022 02:03

garykim-dev-renovate bot changed the title ~~fix(deps): update dependency simple-git to v3 [security]~~ fix(deps): update dependency simple-git to v3 [security] - autoclosed

garykim-dev-renovate bot closed this

garykim-dev-renovate bot deleted the renovate/npm-simple-git-vulnerability branch

September 26, 2023 04:04

garykim-dev-renovate bot changed the title ~~fix(deps): update dependency simple-git to v3 [security] - autoclosed~~ fix(deps): update dependency simple-git to v3 [security]

garykim-dev-renovate bot reopened this

garykim-dev-renovate bot restored the renovate/npm-simple-git-vulnerability branch

September 26, 2023 05:02

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment