Cli: WS vulnerability

[aevaldas]

Description

I've received a security alert from Github about ws in this package.

WS-2017-0421 More information

high severity
Vulnerable versions: >= 0.2.6, < 3.3.1
Patched version: 3.3.1

Affected version of ws (0.2.6--3.3.0) are vulnerable to A specially crafted value of the Sec-WebSocket-Extensions header that used Object.prototype property names as extension or parameter names could be used to make a ws server crash.

Mori info:
https://github.com/websockets/ws/commit/c4fe46608acd61fbf7397eadc47378903f95b78a

Solution

Upgrade ws to version 3.3.1 or later.

[grabbou]

Sounds good. We should do it.

CC: @Esemesek since you've been working on the debugger, you have the context already :)

[thymikee]

Reference: https://github.com/react-native-community/cli/pull/738.

[tomtargosz]

Hey all! Any updates on this? 🙂

[thymikee]

No update. IIRC we're pretty much blocked by Metro, so it would be good to nudge them somehow :)

[brodybits]

Is there an issue open on Metro?

[thymikee]

Dunno :D

[tomtargosz]

Yep! I attempted to give a nudge 😄 https://github.com/facebook/metro/issues/413

[brodybits]

Thanks @tomtargosz!

[Flavyoo]

There is another security vulnerability with this package that requires it to be bumped to 5.2.3 to fix it.

Please see here: https://github.com/advisories/GHSA-6fc8-4gx4-v693

Would we be able to fix this as part of this issue as well?