Update dependency firebase to v10 [SECURITY] - #137

Open

renovate[bot] wants to merge 1 commit into

renovate/npm-firebase-vulnerability

renovate Bot commented Nov 19, 2024 •

edited

Loading

This PR contains the following updates:

Package	Change	Age	Confidence
firebase (source, changelog)	`^7.18.0` → `^10.9.0`
firebase (source, changelog)	`^8.0.1` → `^10.9.0`

Firebase JavaScript SDK allows attackers to manipulate the "_authTokenSyncURL" to point to their own server

CVE-2024-11023 / GHSA-3wf4-68gx-mph8

More information

Details

Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "_authTokenSyncURL" to point to their own server and it would allow am actor to capture user session data transmitted by the SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0.

Severity

CVSS Score: 5.2 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

firebase/firebase-js-sdk (firebase)

`v10.9.0`

`v10.8.1`

`v10.8.0`

`v10.7.2`

`v10.7.1`

`v10.7.0`

`v10.6.0`

`v10.5.2`

`v10.5.1`

`v10.5.0`

`v10.4.0`

`v10.3.1`

`v10.3.0`

`v10.2.0`

`v10.1.0`

`v10.0.0`

`v9.23.0`

`v9.22.2`

`v9.22.1`

`v9.22.0`

`v9.21.0`

`v9.20.0`

`v9.19.1`

`v9.19.0`

`v9.18.0`

`v9.17.2`

`v9.17.1`

`v9.17.0`

`v9.16.0`

`v9.15.0`

`v9.14.0`

`v9.13.0`

`v9.12.1`

`v9.12.0`

`v9.11.0`

`v9.10.0`

`v9.9.4`

`v9.9.3`

`v9.9.0`

`v9.8.4`

`v9.8.3`

`v9.8.2`

`v9.8.1`

`v9.8.0`

`v9.7.0`

`v9.6.11`

`v9.6.10`

`v9.6.9`

`v9.6.8`

`v9.6.7`

`v9.6.6`

`v9.6.5`

`v9.6.4`

`v9.6.3`

`v9.6.2`

`v9.6.1`

`v9.6.0`

`v9.5.0`

`v9.4.1`

`v9.4.0`

`v9.3.0`

`v9.2.0`

`v9.1.3`

`v9.1.2`

`v9.1.1`

`v9.1.0`

`v9.0.2`

`v9.0.1`

`v9.0.0`

`v8.10.1`

`v8.10.0`

`v8.9.1`

`v8.9.0`

`v8.8.1`

`v8.8.0`

`v8.7.1`

`v8.7.0`

`v8.6.8`

`v8.6.7`

`v8.6.6`

`v8.6.5`

`v8.6.4`

`v8.6.3`

`v8.6.2`

`v8.6.1`

`v8.6.0`

`v8.5.0`

`v8.4.3`

`v8.4.2`

`v8.4.1`

`v8.4.0`

`v8.3.3`

`v8.3.2`

`v8.3.1`

`v8.3.0`

`v8.2.10`

`v8.2.9`

`v8.2.8`

`v8.2.7`

`v8.2.6`

`v8.2.5`

`v8.2.4`

`v8.1.2`

`v8.1.1`

`v8.1.0`

`v8.0.2`

`v8.0.1`

`v8.0.0`

`v7.24.0`

`v7.23.0`

`v7.22.1`

`v7.22.0`

`v7.21.1`

`v7.21.0`

`v7.20.0`

`v7.19.1`

`v7.19.0`

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from c06320e to ea13659 Compare

December 3, 2024 05:40

renovate Bot changed the title ~~Update dependency firebase to v10 [SECURITY]~~ Update dependency firebase to v11 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from ea13659 to 2df5d11 Compare

December 3, 2024 06:14

renovate Bot changed the title ~~Update dependency firebase to v11 [SECURITY]~~ Update dependency firebase to v10 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 2df5d11 to e609983 Compare

December 19, 2024 05:56

renovate Bot changed the title ~~Update dependency firebase to v10 [SECURITY]~~ Update dependency firebase to v11 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from e609983 to c2b500a Compare

December 21, 2024 20:33

renovate Bot changed the title ~~Update dependency firebase to v11 [SECURITY]~~ Update dependency firebase to v10 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from c2b500a to 5dde978 Compare

December 23, 2024 02:52

renovate Bot changed the title ~~Update dependency firebase to v10 [SECURITY]~~ Update dependency firebase to v11 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 5dde978 to 2f04c05 Compare

December 24, 2024 23:44

renovate Bot changed the title ~~Update dependency firebase to v11 [SECURITY]~~ Update dependency firebase to v10 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 2f04c05 to a06e37d Compare

January 15, 2025 23:09

renovate Bot changed the title ~~Update dependency firebase to v10 [SECURITY]~~ Update dependency firebase to v11 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from a06e37d to 380d697 Compare

January 17, 2025 03:39

renovate Bot changed the title ~~Update dependency firebase to v11 [SECURITY]~~ Update dependency firebase to v10 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 380d697 to 016de85 Compare

January 25, 2025 03:37

renovate Bot changed the title ~~Update dependency firebase to v10 [SECURITY]~~ Update dependency firebase to v11 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 016de85 to 0c2fd39 Compare

January 26, 2025 07:44

renovate Bot changed the title ~~Update dependency firebase to v11 [SECURITY]~~ Update dependency firebase to v10 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 0c2fd39 to 416897c Compare

January 31, 2025 20:14

renovate Bot changed the title ~~Update dependency firebase to v10 [SECURITY]~~ Update dependency firebase to v11 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 416897c to d7b50e4 Compare

February 2, 2025 10:49

renovate Bot changed the title ~~Update dependency firebase to v11 [SECURITY]~~ Update dependency firebase to v10 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from d7b50e4 to 5152cf0 Compare

February 9, 2025 11:07

renovate Bot changed the title ~~Update dependency firebase to v10 [SECURITY]~~ Update dependency firebase to v11 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 5152cf0 to 355e9af Compare

February 12, 2025 07:54

renovate Bot changed the title ~~Update dependency firebase to v11 [SECURITY]~~ Update dependency firebase to v10 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 355e9af to 4a1f6e0 Compare

March 5, 2025 03:34

renovate Bot changed the title ~~Update dependency firebase to v10 [SECURITY]~~ Update dependency firebase to v11 [SECURITY]

renovate Bot changed the title ~~Update dependency firebase to v10 [SECURITY]~~ Update dependency firebase to v11 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 3cb36b6 to 2771840 Compare

April 5, 2025 04:09

renovate Bot changed the title ~~Update dependency firebase to v11 [SECURITY]~~ Update dependency firebase to v10 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 2771840 to edb67fe Compare

April 12, 2025 07:54

renovate Bot changed the title ~~Update dependency firebase to v10 [SECURITY]~~ Update dependency firebase to v11 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from edb67fe to 3c62972 Compare

April 13, 2025 20:05

renovate Bot changed the title ~~Update dependency firebase to v11 [SECURITY]~~ Update dependency firebase to v10 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 3c62972 to dfddc14 Compare

April 26, 2025 23:45

renovate Bot changed the title ~~Update dependency firebase to v10 [SECURITY]~~ Update dependency firebase to v11 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from dfddc14 to e6dcb2c Compare

April 27, 2025 20:15

renovate Bot changed the title ~~Update dependency firebase to v11 [SECURITY]~~ Update dependency firebase to v10 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from e6dcb2c to 708d9b2 Compare

May 10, 2025 07:44

renovate Bot changed the title ~~Update dependency firebase to v10 [SECURITY]~~ Update dependency firebase to v11 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 708d9b2 to 0f07884 Compare

May 11, 2025 16:01

renovate Bot changed the title ~~Update dependency firebase to v11 [SECURITY]~~ Update dependency firebase to v10 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 0f07884 to d049556 Compare

May 17, 2025 07:45

renovate Bot changed the title ~~Update dependency firebase to v10 [SECURITY]~~ Update dependency firebase to v11 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from d049556 to 5d85524 Compare

May 18, 2025 23:37

renovate Bot changed the title ~~Update dependency firebase to v11 [SECURITY]~~ Update dependency firebase to v10 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 5d85524 to e62bbde Compare

May 24, 2025 16:09

renovate Bot changed the title ~~Update dependency firebase to v10 [SECURITY]~~ Update dependency firebase to v11 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from e62bbde to d72cca2 Compare

May 25, 2025 15:41

renovate Bot changed the title ~~Update dependency firebase to v11 [SECURITY]~~ Update dependency firebase to v10 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from d72cca2 to 2b28d2e Compare

May 31, 2025 19:33

renovate Bot changed the title ~~Update dependency firebase to v10 [SECURITY]~~ Update dependency firebase to v11 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 2b28d2e to 40dbe24 Compare

June 1, 2025 12:12

renovate Bot changed the title ~~Update dependency firebase to v11 [SECURITY]~~ Update dependency firebase to v10 [SECURITY]

renovate Bot force-pushed the renovate/npm-firebase-vulnerability branch from 40dbe24 to 2b15de9 Compare

June 6, 2025 18:10

renovate Bot changed the title ~~Update dependency firebase to v10 [SECURITY]~~ Update dependency firebase to v11 [SECURITY]


          Update dependency firebase to v10 [SECURITY]

232ffe7

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet