Developmint
chore(deps): update devdependency codecov to v3.7.1 [security]
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| codecov | 3.2.0 -> 3.7.1 |
GitHub Vulnerability Alerts
CVE-2020-7597
codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596.
CVE-2020-15123
Impact
The upload method has a command injection vulnerability. Clients of the codecov-node library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.
A similar CVE was issued: CVE-2020-7597, but the fix was incomplete. It only blocked &, and command injection is still possible using backticks instead to bypass the sanitizer.
We have written a CodeQL query, which automatically detects this vulnerability. You can see the results of the query on the codecov-node project here.
Patches
This has been patched in version 3.7.1
Workarounds
None, however, the attack surface is low in this case. Particularly in the standard use of codecov, where the module is used directly in a build pipeline, not built against as a library in another application that may supply malicious input and perform command injection.
References
For more information
If you have any questions or comments about this advisory:
- Contact us via our Security Email
CVE-2020-7596
Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument.
Release Notes
codecov/codecov-node (codecov)
v3.7.1
- Move to execFileSync and security fixes
v3.7.0
- Remove the X-Amz-Acl: public-read header
v3.6.5
v3.6.4
- Fix Cirrus CI
v3.6.3
- Fix for AWS Codebuild & package updates
v3.6.2
- Command line args sanitized fix
v3.6.1
- Fix for Semaphore
v3.6.0
- Added AWS CodeBuild and Semaphore2
v3.5.0
- Added TeamCity support
v3.4.0
- Added Heroku CI support
v3.3.0
- Added pipe with
--pipe,-l
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
â™» Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
- [ ] If you want to rebase/retry this PR, check this box
This PR was generated by Mend Renovate. View the repository job log.
![renovate[bot] avatar](https://avatars.githubusercontent.com/in/2740?v=4 "Published by a pub.dev verified publisher"){kind=small}
Codecov Report
Merging #45 into master will not change coverage. The diff coverage is
n/a.
@@ Coverage Diff @@
## master #45 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 1 1
Lines 27 27
Branches 11 11
=========================================
Hits 27 27
Continue to review full report at Codecov.
Legend - Click here to learn more
Δ = absolute <relative> (impact),ø = not affected,? = missing dataPowered by Codecov. Last update bffdda5...7904258. Read the comment docs.
Codecov Report
Merging #45 into master will not change coverage. The diff coverage is
n/a.
@@ Coverage Diff @@
## master #45 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 1 1
Lines 27 27
Branches 11 11
=========================================
Hits 27 27
Continue to review full report at Codecov.
Legend - Click here to learn more
Δ = absolute <relative> (impact),ø = not affected,? = missing dataPowered by Codecov. Last update bffdda5...227b30c. Read the comment docs.
Codecov Report
Merging #45 (5a0d19d) into master (0b335a8) will increase coverage by
100.00%. The diff coverage isn/a.
@@ Coverage Diff @@
## master #45 +/- ##
=============================================
+ Coverage 0 100.00% +100.00%
=============================================
Files 0 1 +1
Lines 0 28 +28
Branches 0 11 +11
=============================================
+ Hits 0 28 +28
| Impacted Files | Coverage Δ | |
|---|---|---|
| lib/index.js | 100.00% <0.00%> (ø) |
Continue to review full report at Codecov.
Legend - Click here to learn more
Δ = absolute <relative> (impact),ø = not affected,? = missing dataPowered by Codecov. Last update 0b335a8...5a0d19d. Read the comment docs.
Codecov Report
Merging #45 (ea17f4e) into master (0b335a8) will increase coverage by
100.00%. The diff coverage isn/a.
@@ Coverage Diff @@
## master #45 +/- ##
=============================================
+ Coverage 0 100.00% +100.00%
=============================================
Files 0 1 +1
Lines 0 36 +36
Branches 0 18 +18
=============================================
+ Hits 0 36 +36
| Impacted Files | Coverage Δ | |
|---|---|---|
| lib/index.js | 100.00% <0.00%> (ø) |
Continue to review full report at Codecov.
Legend - Click here to learn more
Δ = absolute <relative> (impact),ø = not affected,? = missing dataPowered by Codecov. Last update 0b335a8...ea17f4e. Read the comment docs.
âš Artifact update problem
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
â™» Renovate will retry this branch, including artifacts, only when one of the following happens:
- any of the package files in this branch needs updating, or
- the branch becomes conflicted, or
- you click the rebase/retry checkbox if found above, or
- you rename this PR's title to start with "rebase!" to trigger it manually
The artifact failure details are included below:
File name: yarn.lock
Error response from daemon: toomanyrequests: You have reached your pull rate limit. You may increase the limit by authenticating and upgrading: https://www.docker.com/increase-rate-limit