Is firebase-admin affected by CVE-2022-23529 ? #2023

Activity

1. amirbilu

   added

   type: feature request

   on Dec 22, 2022
2. google-oss-bot commented on Dec 22, 2022

   

   google-oss-bot

   on Dec 22, 2022

   More actions

   I found a few problems with this issue:

   • I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.
   • This issue does not seem to follow the issue template. Make sure you provide all the required information.
3. google-oss-bot

   added

   needs-triage

   on Dec 22, 2022
4. lahirumaramba

   closed this as completedin #2025on Dec 22, 2022
5. lahirumaramba commented on Dec 22, 2022

   

   lahirumaramba

   on Dec 22, 2022

   Member

   More actions

   Thanks @amirbilu! I think the impact is minor as the sdk does not directly expose the verify() function. However, there is a chance that some build tools and deploy workflows might get blocked by having a vulnerable dependency in the dependency chain. #2025 Bumps jsonwebtoken from 8.5.1 to 9.0.0.

   We will also do an emergency patch release today that includes the fixes.
6. lahirumaramba commented on Dec 22, 2022

   

   lahirumaramba

   on Dec 22, 2022

   Member

   More actions

   Fixed in v11.4.1 https://github.com/firebase/firebase-admin-node/releases/tag/v11.4.1
   Thanks everyone!

   👍React with 👍1Reacted by Jiří Zdvomka