jose dependency is vulnerable moderate

[filoucrackeur]

Hello,

yarn audit show this output jose dependency is vulnerable is it possible to upgrade or replace it ?

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ moderate │ jose vulnerable to resource exhaustion via specifically │
│ │ crafted JWE with compressed plaintext │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ jose │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=4.15.5 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ newman │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ newman > postman-runtime > jose │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://www.npmjs.com/advisories/1096835

[thetumper]

GHSA-hhhv-q57g-882q

[lucas-implanta]

Do we have news here? It's annoying to manually set overrides while using newman cli in our project.

[maicodio]

We can workaround it by using the version 6.2.0 of newman. It uses the postman-runtime@7.41.2 which uses jose@5.6.3 that doesn't have the vulnerability.

[kburns-r7]

Confirmed 6.2.0 fixes this.

Weird thing is that 6.2.1 does not. Is this a regression in dependencies?

[juanitosvq]

There has been a dependabot PR opened for some time that tries to upgrade postman-runtime to a version that will have a safe jose:
#3291