Gruntwork Installer Installing Vulnerable Fetch Package

[trsreagan3]

Gruntwork installer needs to install an updated version of fetch. It is also possible that fetch will need to be patched after gruntwork install is installing the updated version. I am not sure if the most recent fetch release is patched.

Fetch details:

• CVE-2022-27664

Installed version: 1.16.2
Patched version: 1.18.6
Paths: /usr/local/bin/fetch

[gitsstewart]

Thanks for bringing this to our attention @trsreagan3 . We will have a look and take steps to prioritize work accordingly.