Evergreen

Potential XSS issues in npm-bootstrap < 3.4.0

Bug #1812273 reported by Galen Charlton
256
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Evergreen
New
Low
Unassigned

Bug Description

An automated GitHub repository alert looking at package.json for the AngularJS staff client came in recommending upgrading to bootstrap ~> 3.4.0.

Based on a look at https://snyk.io/vuln/npm:bootstrap, none of the specific XSS vulnerabilities appear to be reachable in Evergreen, so I'm marking this as a public security bug rather than initially as a private one. Worth updating, of course.

Tags: bootstrap
Galen Charlton (gmc)
no longer affects: opensrf
Changed in evergreen:
importance: Undecided → Low
Terran McCanna (tmccanna)
tags: added: bootstrap
Revision history for this message
Jane Sandberg (sandbergja) wrote :

This is fixed in the patch linked in bug 1992529, so I am marking it as a duplicate.

To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.