-
Notifications
You must be signed in to change notification settings - Fork 184
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
b8972d0
commit 38e1b18
Showing
2 changed files
with
6 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
38e1b18
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
In the end, was a fix for this applied to v1 ? I'm not seeing this _cookie / _env filter in https://github.com/facade/ignition/blob/1.18.0/src/Solutions/SuggestCorrectVariableNameSolution.php
Running into GHSA-m5v7-pr32-mjx2 / CVE-2020-13909 here: Roave/SecurityAdvisories#86
That CVE basically says, if you are using v1, you are on your own (applies to everything before 2.0.5).
Which prohibits installing Laravel v6.x (ignition v2 requires Laravel >=v7.x).
38e1b18
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🤔 Maybe src/Solutions/SuggestCorrectVariableNameSolution.php was gutted shortly after, working around the entire problem.
Was that the fix in the end?
38e1b18
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It looks like that you @freekmurze as the owner can claim the GitHub advisory and edit the version range to be correct (adding below 1.16.15 is vulnerable): https://docs.github.com/en/code-security/security-advisories/editing-a-security-advisory
I have already submitted a change request to MITRE, but I'm not sure how long it will take to trickle down. Or even if that ends up anywhere 😅
38e1b18
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I've managed to convince MITRE and GitHub on my own already.