Hi ,@nlf , @isaacs, Iβd like to report a vulnerability issue in cacache:
Issue Description
A vulnerability CVE-2021-27290 (high severity) detected in package ssri (>=5.2.2 <6.0.2,>=7.0.0 <8.0.1) is directly referenced by cacache 10.0.4. We noticed that such a vulnerability has been removed since cacache 11.0.1.
However, cacache's popular previous version [email protected] (1,015,201 downloads per week) is still transitively referenced by a large amount of latest versions of active and popular downstream projects (about 5,086 downstream projects, e.g., @toptal/davinci-engine 3.3.0, @toptal/davinci-syntax 6.4.0, @toptal/davinci 4.2.2, @toptal/davinci-cli-shared 1.3.4, @toptal/davinci-bootstrap 2.1.74, @3liv/[email protected], @9188/[email protected], @akala-modules/[email protected], @aquestsrl/[email protected], etc.).
As such, issue CVE-2021-27290 can be propagated into these downstream projects and expose security threats to them.
These projects cannot easily upgrade cacache from version 10.0.4 to 11.*.* . For instance, [email protected] is introduced into the above projects via the following package dependency paths:
(1) @3liv/[email protected] β @3liv/[email protected] β @3liv/[email protected] β [email protected] β [email protected] β [email protected]
(2) @9188/[email protected] β [email protected] β [email protected] β [email protected] β [email protected]
(3) @akala-modules/[email protected] β @akala/[email protected] β [email protected] β [email protected] β [email protected] β [email protected]
(4) @aquestsrl/[email protected] β @aquestsrl/[email protected] β [email protected] β [email protected] β [email protected] β [email protected]
......
The projects such as @3liv/fero-resource-subscriber, w-webpack, @aquestsrl/create-app-cli-utils and server-static etc. which introduced [email protected], are not maintained anymore. These unmaintained packages can neither upgrade cacache nor be easily migrated by the large amount of affected downstream projects.
On behalf the downstream users, could you help us remove the vulnerability from package [email protected]?
Sorry for the inconvenience caused.
Suggested Solution
Since these unactive projects set a version constaint ~10.0.* for cacache on the above vulnerable dependency paths, if cacache removes the vulnerability from 10.0.4 and releases a new patched version [email protected],
such a vulnerability patch can be automatically propagated into the 5,086 affected downstream projects.
In [email protected], you can kindly try to perform the following upgrade:
ssri ^5.2.4 β 5.2.1
;
Note:
[email protected] (<5.2.2, >=6.0.2 <7.0.0, >=8.0.1) doesn't have the vulnerability CVE-2021-27290
Thanks again for your contributions.
Best regards,
Paimon