CVE issue with transitive dependency tough-cookie

[dShringi]

Hi, the dependency used in the project i.e. kubernetes-client has a transitive depedency over tough-cookie which has a major vulnerability CVE-2023-26136 below version 4.1.3. Could you please help with the mitigation for the same.

[mhdawson]

@lholmquist can you take a look at this

[lholmquist]

👀

[lholmquist]

So it looks like the request module makes use of the affected tough-cookie module(https://github.com/salesforce/tough-cookie), but when the request module creates an instance of the CookieJar, it does not allow other options to be passed in, so the mode that the CVE says is affected can't be updated to the malicious setting.

Even better is that the openshift-rest-client doesn't pass any options that far down the code chain, so that code is never touched.