fix(cmd-api-server): mitigate CVE-2022-24434 and CVE-2022-24999 hyper…

…ledger-cacti#2039 fixes: hyperledger-cacti#2039 related to: hyperledger-cacti#2241 Verified that these changes will fix the vulnerabilities in cactus-cmd-api-server in addition to the following CVE IDs: - CVE-2022-24434 - CVE-2022-24999 (express) - CVE-2022-24999 (qs) Co-authored-by: Peter Somogyvari <[email protected]> Signed-off-by: ruzell22 <[email protected]> Signed-off-by: Peter Somogyvari <[email protected]>
charellesandig · Apr 4, 2023 · 27a657f · 27a657f
1 parent bdd8372
commit 27a657f
Show file tree

Hide file tree

Showing 7 changed files with 2,925 additions and 1,139 deletions.
diff --git a/examples/cactus-example-carbon-accounting-frontend/package.json b/examples/cactus-example-carbon-accounting-frontend/package.json
@@ -71,7 +71,7 @@
   },
   "devDependencies": {
     "@angular-builders/custom-webpack": "13.1.0",
-    "@angular-devkit/build-angular": "13.3.2",
+    "@angular-devkit/build-angular": "15.2.4",
     "@angular/cli": "13.3.2",
     "@angular/compiler": "13.3.2",
     "@angular/compiler-cli": "13.3.2",

diff --git a/packages/cactus-cmd-socketio-server/package.json b/packages/cactus-cmd-socketio-server/package.json
@@ -33,7 +33,7 @@
     "shelljs": "0.8.5",
     "socket.io": "4.4.1",
     "socket.io-client": "4.1.3",
-    "web3": "1.6.0",
+    "web3": "1.9.0",
     "xmlhttprequest": "1.8.0"
   },
   "devDependencies": {

diff --git a/packages/cactus-core/package.json b/packages/cactus-core/package.json
@@ -52,9 +52,9 @@
   "dependencies": {
     "@hyperledger/cactus-common": "1.2.0",
     "@hyperledger/cactus-core-api": "1.2.0",
-    "express": "4.17.1",
+    "express": "4.17.3",
     "express-jwt-authz": "2.4.1",
-    "express-openapi-validator": "4.12.12",
+    "express-openapi-validator": "4.13.8",
     "typescript-optional": "2.0.1"
   },
   "devDependencies": {

diff --git a/packages/cactus-plugin-ledger-connector-besu/package.json b/packages/cactus-plugin-ledger-connector-besu/package.json
@@ -57,7 +57,7 @@
     "@hyperledger/cactus-core": "1.2.0",
     "@hyperledger/cactus-core-api": "1.2.0",
     "axios": "0.21.4",
-    "express": "4.17.1",
+    "express": "4.17.3",
     "joi": "17.4.2",
     "openapi-types": "9.1.0",
     "prom-client": "13.2.0",

diff --git a/packages/cactus-test-tooling/package.json b/packages/cactus-test-tooling/package.json
@@ -73,7 +73,7 @@
     "is-port-reachable": "3.0.0",
     "joi": "17.4.2",
     "js-yaml": "4.1.0",
-    "keycloak-admin": "1.14.21",
+    "keycloak-admin": "1.14.22",
     "lodash": "4.17.21",
     "node-forge": "1.3.0",
     "node-ssh": "12.0.0",

diff --git a/packages/cactus-verifier-client/package.json b/packages/cactus-verifier-client/package.json
@@ -49,15 +49,15 @@
   },
   "homepage": "https://github.com/hyperledger/cactus#readme",
   "dependencies": {
-    "@hyperledger/cactus-api-client": "1.2.0",
+       "@hyperledger/cactus-api-client": "1.2.0",
     "@hyperledger/cactus-common": "1.2.0",
     "@hyperledger/cactus-core-api": "1.2.0",
     "@hyperledger/cactus-plugin-ledger-connector-besu": "1.2.0",
     "@hyperledger/cactus-plugin-ledger-connector-corda": "1.2.0",
     "@hyperledger/cactus-plugin-ledger-connector-fabric": "1.2.0",
     "@hyperledger/cactus-plugin-ledger-connector-iroha": "1.2.0",
     "@hyperledger/cactus-plugin-ledger-connector-quorum": "1.2.0",
-    "jest-extended": "0.11.5",
+    "jest-extended": "3.0.1",
     "rxjs": "7.3.0"
   }
 }