jose dependency is vulnerable moderate

[filoucrackeur]

Hello,

yarn audit show this output jose dependency is vulnerable is it possible to upgrade or replace it ?

┌───────────────┬──────────────────────────────────────────────────────────────┐ │ moderate │ jose vulnerable to resource exhaustion via specifically │ │ │ crafted JWE with compressed plaintext │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Package │ jose │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Patched in │ >=4.15.5 │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Dependency of │ newman │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Path │ newman > postman-runtime > jose │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ More info │ https://www.npmjs.com/advisories/1096835

[thetumper]

https://github.com/advisories/GHSA-hhhv-q57g-882q

[lucas-implanta]

Do we have news here? It's annoying to manually set overrides while using newman cli in our project.

[maicodio]

We can workaround it by using the version 6.2.0 of newman. It uses the [email protected] which uses [email protected] that doesn't have the vulnerability.

[kburns-r7]

Confirmed 6.2.0 fixes this.

Weird thing is that 6.2.1 does not. Is this a regression in dependencies?

[juanitosvq]

There has been a dependabot PR opened for some time that tries to upgrade postman-runtime to a version that will have a safe jose: https://github.com/postmanlabs/newman/pull/3291