Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@octokit/app

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.2npmAmendedPublished

    Unauthenticated Denial of Service in the octokit/webhooks library

    CVE-2023-50728 · GHSA-pwfr-8pq7-x9qv

    Affected
    • npm @octokit/app >= 14.0.1, <= 14.0.1
    Fixed in
    14.0.2· Vendor fix available
    Issue
    Impact Versions v9.26.0, v10.9.x), v11.1.x, v12.0.x all contained the code that would throw the error. Specifically, during a pentest we encountered a bug in the octokit/webhooks library (a dependency of Probot, a framework for building Github Apps). The resulting request was found to cause an uncaught exception that ends the nodejs process. The problem is caused by an issue with error handling in the @octokit/webhooks library because the error can be undefined in some cases. Credit goes to @pb82 (for the early analysis) and @rh-tguittet (for discovery). Patches Maintenance releases for the Error being thrown by the verify method in octokit/webhooks.js v12 - v12.0.4 v11 - v11.1.2 v10 -v10.9.2 v9 - v9.26.3 Maintenance release for the reference for octokit/webhooks.js in app.js v14.0.2 Maintenance release for the reference for octokit/webhooks.js in octokit.js v3.1.2 Maintenance release for the reference for octokit/webhooks.js in Protobot v12.3.3 Workarounds It is recommend that all…

    Recommended action: Upgrade to 14.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →