express-4.13.4.tgz: 6 vulnerabilities (highest severity is: 7.5) #6
Labels
security vulnerability
Security vulnerability detected by WhiteSource
Comments
dev-mend-for-github-com
bot
added
the
security vulnerability
1 task
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Path to dependency file: /assets/reveal.js/plugin/multiplex/package.json
Path to vulnerable library: /assets/reveal.js/plugin/multiplex/node_modules/negotiator/package.json
Found in HEAD commit: e5594a228e351da3651ce49551431e005c6c817c
Vulnerabilities
Details
Vulnerable Library - negotiator-0.5.3.tgz
HTTP content negotiation
Library home page: https://registry.npmjs.org/negotiator/-/negotiator-0.5.3.tgz
Path to dependency file: /assets/reveal.js/plugin/multiplex/package.json
Path to vulnerable library: /assets/reveal.js/plugin/multiplex/node_modules/negotiator/package.json
Dependency Hierarchy:
Found in HEAD commit: e5594a228e351da3651ce49551431e005c6c817c
Found in base branch: main
Vulnerability Details
negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.
Publish Date: 2018-05-31
URL: CVE-2016-10539
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/106
Release Date: 2018-05-31
Fix Resolution (negotiator): 0.6.1
Direct dependency fix Resolution (express): 4.14.0
⛑️ Automatic Remediation is available for this issue
Vulnerable Library - qs-4.0.0.tgz
A querystring parser that supports nesting and arrays, with a depth limit
Library home page: https://registry.npmjs.org/qs/-/qs-4.0.0.tgz
Path to dependency file: /assets/reveal.js/plugin/multiplex/package.json
Path to vulnerable library: /assets/reveal.js/plugin/multiplex/node_modules/qs/package.json
Dependency Hierarchy:
Found in HEAD commit: e5594a228e351da3651ce49551431e005c6c817c
Found in base branch: main
Vulnerability Details
the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.
Publish Date: 2017-07-17
URL: CVE-2017-1000048
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000048
Release Date: 2017-07-17
Fix Resolution (qs): 6.0.4
Direct dependency fix Resolution (express): 4.14.0
⛑️ Automatic Remediation is available for this issue
Vulnerable Library - mime-1.3.4.tgz
A comprehensive library for mime-type mapping
Library home page: https://registry.npmjs.org/mime/-/mime-1.3.4.tgz
Path to dependency file: /assets/reveal.js/plugin/multiplex/package.json
Path to vulnerable library: /assets/reveal.js/plugin/multiplex/node_modules/mime/package.json
Dependency Hierarchy:
Found in HEAD commit: e5594a228e351da3651ce49551431e005c6c817c
Found in base branch: main
Vulnerability Details
The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.
Publish Date: 2018-06-07
URL: CVE-2017-16138
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16138
Release Date: 2018-06-07
Fix Resolution (mime): 1.4.1
Direct dependency fix Resolution (express): 4.16.0
⛑️ Automatic Remediation is available for this issue
Vulnerable Library - fresh-0.3.0.tgz
HTTP response freshness testing
Library home page: https://registry.npmjs.org/fresh/-/fresh-0.3.0.tgz
Path to dependency file: /assets/reveal.js/plugin/multiplex/package.json
Path to vulnerable library: /assets/reveal.js/plugin/multiplex/node_modules/fresh/package.json
Dependency Hierarchy:
Found in HEAD commit: e5594a228e351da3651ce49551431e005c6c817c
Found in base branch: main
Vulnerability Details
Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
Publish Date: 2018-06-07
URL: CVE-2017-16119
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/526
Release Date: 2018-06-07
Fix Resolution (fresh): 0.5.2
Direct dependency fix Resolution (express): 4.15.5
⛑️ Automatic Remediation is available for this issue
Vulnerable Library - debug-2.2.0.tgz
small debugging utility
Library home page: https://registry.npmjs.org/debug/-/debug-2.2.0.tgz
Path to dependency file: /assets/reveal.js/plugin/multiplex/package.json
Path to vulnerable library: /assets/reveal.js/plugin/multiplex/node_modules/debug/package.json
Dependency Hierarchy:
Found in HEAD commit: e5594a228e351da3651ce49551431e005c6c817c
Found in base branch: main
Vulnerability Details
The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.
Publish Date: 2018-06-07
URL: CVE-2017-16137
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-16137
Release Date: 2018-06-07
Fix Resolution (debug): 2.6.9
Direct dependency fix Resolution (express): 4.15.5
⛑️ Automatic Remediation is available for this issue
Vulnerable Library - ms-0.7.1.tgz
Tiny ms conversion utility
Library home page: https://registry.npmjs.org/ms/-/ms-0.7.1.tgz
Path to dependency file: /assets/reveal.js/plugin/multiplex/package.json
Path to vulnerable library: /assets/reveal.js/plugin/multiplex/node_modules/ms/package.json
Dependency Hierarchy:
Found in HEAD commit: e5594a228e351da3651ce49551431e005c6c817c
Found in base branch: main
Vulnerability Details
Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS).
Publish Date: 2017-04-12
URL: WS-2017-0247
CVSS 2 Score Details (3.4)
Base Score Metrics not available
Suggested Fix
Type: Upgrade version
Origin: vercel/ms#89
Release Date: 2017-04-12
Fix Resolution (ms): 2.0.0
Direct dependency fix Resolution (express): 4.15.3
⛑️ Automatic Remediation is available for this issue
⛑️ Automatic Remediation is available for this issue.
The text was updated successfully, but these errors were encountered: