Commits on Sep 9, 2024

1. build(github): fix @actions/download-artifact CVE-2024-42471 …

   GHSA-cxww-7g56-2vh6
   
   Address the following problem by upgrading to the latest version:
   @actions/download-artifact has an Arbitrary File Write via artifact extraction
   
   Affected versions
   >= 4.0.0, < 4.1.7
   
   Patched versions
   4.1.7
   
   Severity
   High
   7.3 / 10
   
   GHSA ID
   GHSA-cxww-7g56-2vh6
   
   References
   - GHSA-cxww-7g56-2vh6
   - https://github.com/actions/download-artifact/releases/tag/v4.1.7
   - GHSA-6q32-hq47-5qq3
   - https://snyk.io/research/zip-slip-vulnerability
   
   Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>

   

   petermetz committed Sep 9, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for 55266b7
   • Browse repository at this point

   Copy the full SHA

   55266b7 View commit details

   Browse the repository at this point in the history