Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

cli-1.21.5.tgz: 8 vulnerabilities (highest severity is: 8.8) #8

Open
mend-bolt-for-github bot opened this issue Mar 15, 2022 · 0 comments
Open

cli-1.21.5.tgz: 8 vulnerabilities (highest severity is: 8.8) #8

mend-bolt-for-github bot opened this issue Mar 15, 2022 · 0 comments
Labels
Mend: dependency security vulnerability Security vulnerability detected by WhiteSource

Comments

@mend-bolt-for-github
Copy link
Contributor

mend-bolt-for-github bot commented Mar 15, 2022 •
edited

Vulnerable Library - cli-1.21.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Found in HEAD commit: ee921e28068816f78400670e9e3b1987bdbf9514

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (cli version) Remediation Possible**
CVE-2023-45133 High 8.8 traverse-7.12.13.tgz Transitive 2.0.0 ❌
CVE-2022-23539 High 8.1 jsonwebtoken-8.5.1.tgz Transitive 2.0.0 ❌
CVE-2022-23540 High 7.6 jsonwebtoken-8.5.1.tgz Transitive 2.0.0 ❌
CVE-2022-25881 High 7.5 http-cache-semantics-4.1.0.tgz Transitive 1.21.6 ❌
CVE-2021-3807 High 7.5 ansi-regex-3.0.0.tgz Transitive 1.21.6 ❌
CVE-2022-23541 Medium 6.3 jsonwebtoken-8.5.1.tgz Transitive 2.0.0 ❌
CVE-2022-33987 Medium 5.3 got-9.6.0.tgz Transitive 2.6.3 ❌
CVE-2021-32640 Medium 5.3 ws-7.4.5.tgz Transitive 2.0.0 ❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-45133

Vulnerable Library - traverse-7.12.13.tgz

The Babel Traverse module maintains the overall tree state, and is responsible for replacing, removing, and adding nodes

Library home page: https://registry.npmjs.org/@babel/traverse/-/traverse-7.12.13.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

  • cli-1.21.5.tgz (Root Library)
    • git-loader-6.2.6.tgz
      • graphql-tag-pluck-6.5.1.tgz
        • ❌ traverse-7.12.13.tgz (Vulnerable Library)

Found in HEAD commit: ee921e28068816f78400670e9e3b1987bdbf9514

Found in base branch: main

Vulnerability Details

Babel is a compiler for writingJavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the path.evaluate()or path.evaluateTruthy() internal Babel methods. Known affected plugins are @babel/plugin-transform-runtime; @babel/preset-env when using its useBuiltIns option; and any "polyfill provider" plugin that depends on @babel/helper-define-polyfill-provider, such as babel-plugin-polyfill-corejs3, babel-plugin-polyfill-corejs2, babel-plugin-polyfill-es-shims, babel-plugin-polyfill-regenerator. No other plugins under the @babel/ namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in @babel/traverse@7.23.2 and @babel/traverse@8.0.0-alpha.4. Those who cannot upgrade @babel/traverse and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected @babel/traverse versions: @babel/plugin-transform-runtime v7.23.2, @babel/preset-env v7.23.2, @babel/helper-define-polyfill-provider v0.4.3, babel-plugin-polyfill-corejs2 v0.4.6, babel-plugin-polyfill-corejs3 v0.8.5, babel-plugin-polyfill-es-shims v0.10.0, babel-plugin-polyfill-regenerator v0.5.3.

Publish Date: 2023-10-12

URL: CVE-2023-45133

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-67hx-6x53-jw92

Release Date: 2023-10-12

Fix Resolution (@babel/traverse): 7.23.2

Direct dependency fix Resolution (@graphql-codegen/cli): 2.0.0

Step up your Open Source Security Game with Mend here

CVE-2022-23539

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

  • cli-1.21.5.tgz (Root Library)
    • prisma-loader-6.3.0.tgz
      • ❌ jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in HEAD commit: ee921e28068816f78400670e9e3b1987bdbf9514

Found in base branch: main

Vulnerability Details

Versions <=8.5.1 of jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the allowInvalidAsymmetricKeyTypes option to true in the sign() and/or verify() functions.

Publish Date: 2022-12-23

URL: CVE-2022-23539

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8cf7-32gw-wr33

Release Date: 2022-12-23

Fix Resolution (jsonwebtoken): 9.0.0

Direct dependency fix Resolution (@graphql-codegen/cli): 2.0.0

Step up your Open Source Security Game with Mend here

CVE-2022-23540

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

  • cli-1.21.5.tgz (Root Library)
    • prisma-loader-6.3.0.tgz
      • ❌ jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in HEAD commit: ee921e28068816f78400670e9e3b1987bdbf9514

Found in base branch: main

Vulnerability Details

In versions <=8.5.1 of jsonwebtoken library, lack of algorithm definition in the jwt.verify() function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification. Users are affected if you do not specify algorithms in the jwt.verify() function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the jwt.verify() method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the none algorithm. If you need 'none' algorithm, you have to explicitly specify that in jwt.verify() options.

Publish Date: 2022-12-22

URL: CVE-2022-23540

CVSS 3 Score Details (7.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-23540

Release Date: 2022-12-22

Fix Resolution (jsonwebtoken): 9.0.0

Direct dependency fix Resolution (@graphql-codegen/cli): 2.0.0

Step up your Open Source Security Game with Mend here

CVE-2022-25881

Vulnerable Library - http-cache-semantics-4.1.0.tgz

Parses Cache-Control and other headers. Helps building correct HTTP caches and proxies

Library home page: https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

  • cli-1.21.5.tgz (Root Library)
    • latest-version-5.1.0.tgz
      • package-json-6.5.0.tgz
        • got-9.6.0.tgz
          • cacheable-request-6.1.0.tgz
            • ❌ http-cache-semantics-4.1.0.tgz (Vulnerable Library)

Found in HEAD commit: ee921e28068816f78400670e9e3b1987bdbf9514

Found in base branch: main

Vulnerability Details

This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

Publish Date: 2023-01-31

URL: CVE-2022-25881

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rc47-6667-2j5j

Release Date: 2023-01-31

Fix Resolution (http-cache-semantics): 4.1.1

Direct dependency fix Resolution (@graphql-codegen/cli): 1.21.6

Step up your Open Source Security Game with Mend here

CVE-2021-3807

Vulnerable Library - ansi-regex-3.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

  • cli-1.21.5.tgz (Root Library)
    • listr-update-renderer-0.5.0.tgz
      • log-update-2.3.0.tgz
        • wrap-ansi-3.0.1.tgz
          • strip-ansi-4.0.0.tgz
            • ❌ ansi-regex-3.0.0.tgz (Vulnerable Library)

Found in HEAD commit: ee921e28068816f78400670e9e3b1987bdbf9514

Found in base branch: main

Vulnerability Details

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3807

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/

Release Date: 2021-09-17

Fix Resolution (ansi-regex): 3.0.1

Direct dependency fix Resolution (@graphql-codegen/cli): 1.21.6

Step up your Open Source Security Game with Mend here

CVE-2022-23541

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

  • cli-1.21.5.tgz (Root Library)
    • prisma-loader-6.3.0.tgz
      • ❌ jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in HEAD commit: ee921e28068816f78400670e9e3b1987bdbf9514

Found in base branch: main

Vulnerability Details

jsonwebtoken is an implementation of JSON Web Tokens. Versions <= 8.5.1 of jsonwebtoken library can be misconfigured so that passing a poorly implemented key retrieval function referring to the secretOrPublicKey argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.

Publish Date: 2022-12-22

URL: CVE-2022-23541

CVSS 3 Score Details (6.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hjrf-2m68-5959

Release Date: 2022-12-22

Fix Resolution (jsonwebtoken): 9.0.0

Direct dependency fix Resolution (@graphql-codegen/cli): 2.0.0

Step up your Open Source Security Game with Mend here

CVE-2022-33987

Vulnerable Library - got-9.6.0.tgz

Simplified HTTP requests

Library home page: https://registry.npmjs.org/got/-/got-9.6.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

  • cli-1.21.5.tgz (Root Library)
    • latest-version-5.1.0.tgz
      • package-json-6.5.0.tgz
        • ❌ got-9.6.0.tgz (Vulnerable Library)

Found in HEAD commit: ee921e28068816f78400670e9e3b1987bdbf9514

Found in base branch: main

Vulnerability Details

The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.

Publish Date: 2022-06-18

URL: CVE-2022-33987

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33987

Release Date: 2022-06-18

Fix Resolution (got): 11.8.6

Direct dependency fix Resolution (@graphql-codegen/cli): 2.6.3

Step up your Open Source Security Game with Mend here

CVE-2021-32640

Vulnerable Library - ws-7.4.5.tgz

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

Library home page: https://registry.npmjs.org/ws/-/ws-7.4.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

  • cli-1.21.5.tgz (Root Library)
    • url-loader-6.10.1.tgz
      • ❌ ws-7.4.5.tgz (Vulnerable Library)

Found in HEAD commit: ee921e28068816f78400670e9e3b1987bdbf9514

Found in base branch: main

Vulnerability Details

ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (websockets/ws@00c425e). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.

Publish Date: 2021-05-25

URL: CVE-2021-32640

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-6fc8-4gx4-v693

Release Date: 2021-05-25

Fix Resolution (ws): 7.4.6

Direct dependency fix Resolution (@graphql-codegen/cli): 2.0.0

Step up your Open Source Security Game with Mend here
@mend-bolt-for-github mend-bolt-for-github bot added the Mend: dependency security vulnerability Security vulnerability detected by WhiteSource label Mar 15, 2022
@mend-bolt-for-github mend-bolt-for-github bot changed the title cli-1.21.5.tgz: 2 vulnerabilities (highest severity is: 7.5) cli-1.21.5.tgz: 3 vulnerabilities (highest severity is: 7.5) Jun 21, 2022
@mend-bolt-for-github mend-bolt-for-github bot changed the title cli-1.21.5.tgz: 3 vulnerabilities (highest severity is: 7.5) cli-1.21.5.tgz: 4 vulnerabilities (highest severity is: 7.6) Dec 23, 2022
@mend-bolt-for-github mend-bolt-for-github bot changed the title cli-1.21.5.tgz: 4 vulnerabilities (highest severity is: 7.6) cli-1.21.5.tgz: 5 vulnerabilities (highest severity is: 7.6) Dec 24, 2022
@mend-bolt-for-github mend-bolt-for-github bot changed the title cli-1.21.5.tgz: 5 vulnerabilities (highest severity is: 7.6) cli-1.21.5.tgz: 7 vulnerabilities (highest severity is: 7.6) Dec 25, 2022
@mend-bolt-for-github mend-bolt-for-github bot changed the title cli-1.21.5.tgz: 7 vulnerabilities (highest severity is: 7.6) cli-1.21.5.tgz: 7 vulnerabilities (highest severity is: 9.8) Jan 5, 2023
@mend-bolt-for-github mend-bolt-for-github bot changed the title cli-1.21.5.tgz: 7 vulnerabilities (highest severity is: 9.8) cli-1.21.5.tgz: 7 vulnerabilities (highest severity is: 8.1) Apr 26, 2023
@mend-bolt-for-github mend-bolt-for-github bot changed the title cli-1.21.5.tgz: 7 vulnerabilities (highest severity is: 8.1) cli-1.21.5.tgz: 8 vulnerabilities (highest severity is: 8.8) Dec 28, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Mend: dependency security vulnerability Security vulnerability detected by WhiteSource
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
0 participants