Skip to content

Problem caused by static_eval  #46

Closed
Closed
Problem caused by static_eval #46
Assignees
ByCnck

Description

@ByCnck
ByCnck
opened on Oct 23, 2017

Can you tell to the devs to check this repository please

https://github.com/AschPlatform/asch/blob/ff97f3c1cf2bdfd95cbb337dad694cd3b7c69a34/src/utils/protobuf.js

Problem: Arbitrary Code Execution

They are using protocol-Buffers 3.1.6
This version have a issue becuse it use some outdated of static-eval
The Vulnerability is introduced through this way:
Protocol-buffers> brfs@1.4.3 › static-module@1.5.0 › static-eval@0.2.4

Here is the commit to fix part of the problem in the github of static-eval
browserify/static-eval@c06f1b8

Further information of the problem:
https://maustin.net/articles/2017-10/static_eval
https://nodesecurity.io/advisories/548

Activity

  1. ByCnck commented on Oct 23, 2017

    @ByCnck
    ByCnck
    on Oct 23, 2017
    ContributorAuthor
    zhenxi@asch:~/github/AschPlatfrom/asch$ npm ls static-eval
asch@1.3.4 /home/zhenxi/github/AschPlatfrom/asch
└─┬ protocol-buffers@3.1.6
  └─┬ brfs@1.4.3
    └─┬ static-module@1.5.0   // "static-eval": "~0.2.0",
      └── static-eval@0.2.4 // latest version:2.0

  2. ByCnck commented on Oct 23, 2017

    @ByCnck
    ByCnck
    on Oct 23, 2017
    ContributorAuthor

    waiting for this fix browserify/static-module#35.
    now ipfs-js also have the problem or similar.

  3. ByCnck
    self-assigned this
    on Dec 22, 2017
  4. ByCnck
    closed this as completedin e7af4e2on Dec 26, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions