Bulk vulnerability fix - Lockfile fix

[debricked]

Bulk vulnerability fix - Lockfile fix

This pull request will update your transitive dependencies within the allowed version intervals provided by your direct dependencies.

Fixed vulnerabilities:

CVE–2021–44906

• Description

  NVD

  Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

  GitHub

  Prototype Pollution in minimist

  Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

• CVSS details - 9.8

   

  CVSS3 metrics
  Attack Vector	Network
  Attack Complexity	Low
  Privileges Required	None
  User interaction	None
  Scope	Unchanged
  Confidentiality	High
  Integrity	High
  Availability	High

• References

      Prototype Pollution in minimist · CVE-2021-44906 · GitHub Advisory Database · GitHub
      THIRD PARTY
      insufficient fix for prototype pollution in setKey() CVE-2021-44906 · Issue #164 · substack/minimist · GitHub
      minimist/index.js at master · substack/minimist · GitHub
      javascript - Adding custom properties to a function - Stack Overflow
      JavaScript-vulnerability-detection/minimist PoC.zip at main · Marynk/JavaScript-vulnerability-detection · GitHub
      don't assign onto proto · substack/minimist@63e7ed0 · GitHub
      even more aggressive checks for protocol pollution · substack/minimist@38a4d1c · GitHub

CVE–2021–3807

• Description

  NVD

  ansi-regex is vulnerable to Inefficient Regular Expression Complexity

  GitHub

  Inefficient Regular Expression Complexity in chalk/ansi-regex

  ansi-regex is vulnerable to Inefficient Regular Expression Complexity

• CVSS details - 7.5

   

  CVSS3 metrics
  Attack Vector	Network
  Attack Complexity	Low
  Privileges Required	None
  User interaction	None
  Scope	Unchanged
  Confidentiality	None
  Integrity	None
  Availability	High

• References

      Inefficient Regular Expression Complexity in chalk/ansi-regex · CVE-2021-3807 · GitHub Advisory Database · GitHub
      NVD - CVE-2021-3807
      Fix potential ReDoS (#37) · chalk/ansi-regex@8d1d7cd · GitHub
      Inefficient Regular Expression Complexity vulnerability found in ansi-regex
      Regular Expression Denial of Service (ReDoS) in ansi-regex | CVE-2021-3807 | Snyk
      Backport of security patch, for benefit of yargs · Issue #38 · chalk/ansi-regex · GitHub
      Backport of security patch, for benefit of yargs · Issue #38 · chalk/ansi-regex · GitHub
      ansi-regex/index.js at c1b5e45f7c65a332ffb03ac8e5804ad37c579cdc · chalk/ansi-regex · GitHub
      GitHub - chalk/ansi-regex: Regular expression for matching ANSI escape codes
      Comparing chalk:HEAD...yetingli:main · chalk/ansi-regex · GitHub
      Release v6.0.1 · chalk/ansi-regex · GitHub
      Oracle Critical Patch Update Advisory - April 2022

CVE–2021–3918

• Description

  Improperly Controlled Modification of Dynamically-Determined Object Attributes

  The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

  NVD

  json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

  GitHub

  json-schema is vulnerable to Prototype Pollution

  json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

• CVSS details - 9.8

   

  CVSS3 metrics
  Attack Vector	Network
  Attack Complexity	Low
  Privileges Required	None
  User interaction	None
  Scope	Unchanged
  Confidentiality	High
  Integrity	High
  Availability	High

• References

      NVD - CVE-2021-3918
      json-schema is vulnerable to Prototype Pollution · CVE-2021-3918 · GitHub Advisory Database · GitHub
      Don't allow proto property to be used for schema default/coerce, … · kriszyp/json-schema@22f1461 · GitHub
      Prototype Pollution vulnerability found in json-schema
      Create SECURITY.md · Issue #84 · kriszyp/json-schema · GitHub
      GitHub - kriszyp/json-schema: JSON Schema specifications, reference schemas, and a CommonJS implementation
      json-schema/validate.js at master · kriszyp/json-schema · GitHub
      Protect against constructor modification, #84 · kriszyp/json-schema@b62f1da · GitHub
      Use a little more robust method of checking instances · kriszyp/json-schema@f6f6a3b · GitHub

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more at Debricked