Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(security): vulnerabilities found in quorum-multi-party-all-in-one #2239

Merged

Conversation

aldousalvarez
Copy link
Contributor

Fixes #2060

Signed-off-by: aldousalvarez aldousss.alvarez@gmail.com

@aldousalvarez
Copy link
Contributor Author

aldousalvarez commented Dec 23, 2022

Hello @petermetz , Most of the vulnerabilities are now fixed in quorum-multi-party-all-in-one but there are still some that are not because most of the remaining vulnerabilities are still new and is still waiting for the new changes to be pulled in and released on their respective package versions. And we tried to ask on the quorum discussions on github as you can see here. (Consensys/quorum#1513).

Here are the remaining vulnerabilities for quorum-multi-party-all-in-one:
CVE-2022-24713
CVE-2021-41092
CVE-2022-27664
CVE-2022-32149
CVE-2021-41092
CVE-2022-32149

.github/containerscan/allowedlist.yaml Outdated Show resolved Hide resolved
Copy link
Contributor

@petermetz petermetz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@aldousalvarez LGTM, thank you!

Copy link
Contributor

@jagpreetsinghsasan jagpreetsinghsasan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thankyou!

@petermetz
Copy link
Contributor

Removing my approval so that we don't accidentally merge before someone else also approves.

@petermetz petermetz self-requested a review January 30, 2023 00:45
@petermetz petermetz added this pull request to the merge queue Mar 15, 2023
@petermetz petermetz removed this pull request from the merge queue due to a manual request Mar 16, 2023
Copy link
Contributor

@petermetz petermetz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@petermetz petermetz force-pushed the aldousalvarez/issue2060 branch 2 times, most recently from 7801199 to aac8628 Compare March 31, 2023 07:00
Fixes hyperledger-cacti#2060

Signed-off-by: aldousalvarez <aldousss.alvarez@gmail.com>
Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
@petermetz petermetz merged commit 59cc831 into hyperledger-cacti:main Apr 1, 2023
@petermetz petermetz deleted the aldousalvarez/issue2060 branch April 2, 2023 18:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

fix(security): vulnerabilities found in quorum-multi-party-all-in-one
5 participants