Repository navigation
false vulnerability on redis-commander NSWG-ECO-362 #1540
Description
Activity
Hi,
The npm database is not updated for quite a while, I guess we could simply remove it.
cc: @nodejs/security-wg
Reacted by Marco Ippolito, zsolt and Ulises GascónHi @RafaelGSS !
I see that in PR #1546 you are trying to retire the vuln/npm thing that might break some other stuff based on @marco-ippolito comments.
In the meantime you figure out this retirement, could we just update this line so Trivy would not pick this up as a false positive?
from
Line 14 in a76d920
to
"vulnerable_versions": "<=0.5.0",Thanks!
This issue has been inactive for 90 days. It will be closed in 14 days unless there is further activity or the stale label is taken off.
Hi Team!
There is this alleged vulnerability: https://github.com/nodejs/security-wg/blob/main/vuln/npm/362.json
The json contains the following for redis-commander
security-wg/vuln/npm/362.json
Lines 14 to 15 in f2b2be5
There is no
0.13.12version for redis-commander, the newest version is0.9.1:https://github.com/joeferner/redis-commander/tags
https://github.com/joeferner/redis-commander/pkgs/container/redis-commander
and 0.9.0 on npm
https://www.npmjs.com/package/redis-commander?activeTab=versions
The issue was discussed and closed with resolution in this hackerone thread: https://hackerone.com/reports/296377
And gh issue is opened in the projet repo: joeferner/redis-commander#227
The gh issue is closed, this comment shows it is fixed: joeferner/redis-commander#227 (comment)
The clipboard.swf file is indeed removed since v0.5.0 version (git tag) with this commit: joeferner/redis-commander@1a483eb
Please update the file https://github.com/nodejs/security-wg/blob/main/vuln/npm/362.json based on this information because Trivy is picking up this vulnerability as unknown severity thus reporting it as a false positive: aquasecurity/trivy#10024 (comment)
Thank you!