CVE-2022-0536

Advisory

Deepl version 1.3.2 has updated its "follow-redirects" dependency to address the security vulnerability identified as CVE-2022-0536.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Added
* Add contribution guidelines -- currently we are unable to accept Pull Requests.
Changed
* npm start command now uses environment variables if defined for DEEPL_MOCK_SERVER_PORT and
DEEPL_MOCK_PROXY_SERVER_PORT.
* Update `package-lock.json`: upgrade `follow-redirects` to 1.14.7 to silence security warnings.
Note: security vulnerability [CVE-2022-0155](https://nvd.nist.gov/vuln/detail/CVE-2022-0155)
affects cross-domain proxying and has no impact here because the proxy server is restricted to
target only the mock server itself.
Fixed
* Remove "localhost" from listen() calls.

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0536