Veracode flags the request transitive dependency of the dev dependency pacote

[LanceEa]

We have two vulnerabilities being flagged in veracode due to the deprecated request library being used by pacote.

https://sca.analysiscenter.veracode.com/vulnerability-database/security/sca/vulnerability/sid-21913/summary
https://sca.analysiscenter.veracode.com/vulnerability-database/security/sca/vulnerability/sid-3911/summary

Dependency Tree:

It appears that this is removed in node-gyp@8 but due to @npmcli/run-script support of node 10 it is unable to update.

https://github.com/nodejs/node-gyp/blob/master/package.json
npm/run-script#25

Angular Cli Versions

I wasn't able to find anything in pacote on addressing this so not sure if we can just force the yarn resolve of node-gyp or if pacote itself needs to be updated.

[alan-agius4]

Unfortunately this is not something that we can action as this has to be addressed upstream by @npmcli/run-scripts.

That being said, we don’t expect that the Angular CLI runs in production environments were this vulnerability can be exploited.

[LanceEa]

@alan-agius4 - thanks for the quick response on that one.

That is is what I was thinking but wanted to flag it here so others coming across it could see.

That being said, we don’t expect that the Angular CLI runs in production environments were this vulnerability can be exploited.

I have seen that mentioned on a few of the other issues as well and I just want to make sure I'm clear in my understanding so I can articulate it back to my team. This comment is referring to the fact that it is not expected for the cli to be deployed to the production web server (container) and/or used as the production web server, correct?

However, it is used in many peoples CI process which although not production, the vulnerability could be used by another dependency in the project or not? Or, alternatively the assumption is the CI is sandboxed thus a Denial-Of-Service should only effect that single build and any remote code execution should be blocked by network policies?

Thanks for any insight on this topic.

[angular-automatic-lock-bot]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}