search

KOSASIH / skynetic

This repository was created by Gatsby Cloud
BSD Zero Clause License
1 stars 0 forks source link

gatsby-4.15.1.tgz: 48 vulnerabilities (highest severity is: 10.0) #8

Open mend-bolt-for-github[bot] opened 2 years ago

mend-bolt-for-github[bot] commented 2 years ago
Vulnerable Library - gatsby-4.15.1.tgz

Blazing fast modern site generator for React

Library home page: https://registry.npmjs.org/gatsby/-/gatsby-4.15.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/gatsby/package.json

Found in HEAD commit: fb766f816ad2f4315881e9e4b6d630e84cad0f1e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (gatsby version) Remediation Possible**
CVE-2022-2421 Critical 10.0 socket.io-parser-4.0.4.tgz Transitive 4.15.2 ❌
CVE-2023-28154 Critical 9.8 webpack-5.72.1.tgz Transitive 4.15.2 ❌
CVE-2022-37601 Critical 9.8 loader-utils-1.4.0.tgz Transitive 4.15.2 ❌
CVE-2022-2216 Critical 9.8 parse-url-6.0.0.tgz Transitive 4.15.2 ❌
CVE-2022-2900 Critical 9.1 parse-url-6.0.0.tgz Transitive 4.15.2 ❌
WS-2023-0439 High 7.5 axios-0.21.4.tgz Transitive 5.14.0-canary.7 ❌
WS-2022-0238 High 7.5 parse-url-6.0.0.tgz Transitive 4.15.2 ❌
WS-2022-0237 High 7.5 parse-url-6.0.0.tgz Transitive 4.15.2 ❌
CVE-2024-45590 High 7.5 body-parser-1.20.0.tgz Transitive N/A* ❌
CVE-2024-45296 High 7.5 path-to-regexp-0.1.7.tgz Transitive N/A* ❌
CVE-2024-4068 High 7.5 braces-3.0.2.tgz Transitive N/A* ❌
CVE-2024-37890 High 7.5 detected in multiple dependencies Transitive 4.25.4 ❌
CVE-2022-38900 High 7.5 decode-uri-component-0.2.0.tgz Transitive 4.15.2 ❌
CVE-2022-37603 High 7.5 detected in multiple dependencies Transitive 4.15.2 ❌
CVE-2022-3517 High 7.5 minimatch-3.0.4.tgz Transitive N/A* ❌
CVE-2022-24434 High 7.5 dicer-0.2.5.tgz Transitive N/A* ❌
CVE-2022-0722 High 7.5 parse-url-6.0.0.tgz Transitive 4.15.2 ❌
CVE-2021-23424 High 7.5 ansi-html-0.0.7.tgz Transitive 4.22.0 ❌
CVE-2024-29180 High 7.4 webpack-dev-middleware-4.3.0.tgz Transitive N/A* ❌
CVE-2024-38355 High 7.3 socket.io-3.1.2.tgz Transitive 5.12.0 ❌
CVE-2023-32695 High 7.3 socket.io-parser-4.0.4.tgz Transitive 4.25.4 ❌
CVE-2023-26159 High 7.3 follow-redirects-1.15.0.tgz Transitive 4.15.2 ❌
CVE-2022-0624 High 7.3 parse-path-4.0.3.tgz Transitive 4.15.2 ❌
CVE-2022-46175 High 7.1 json5-1.0.1.tgz Transitive 4.15.2 ❌
CVE-2022-41940 High 7.1 engine.io-4.1.2.tgz Transitive 4.25.4 ❌
CVE-2023-52079 Medium 6.8 msgpackr-1.6.1.tgz Transitive 4.15.2 ❌
CVE-2024-28849 Medium 6.5 follow-redirects-1.15.0.tgz Transitive N/A* ❌
CVE-2023-45857 Medium 6.5 axios-0.21.4.tgz Transitive 5.14.0-canary.7 ❌
CVE-2024-43788 Medium 6.4 webpack-5.72.1.tgz Transitive N/A* ❌
WS-2022-0239 Medium 6.1 parse-url-6.0.0.tgz Transitive 4.15.2 ❌
CVE-2024-29041 Medium 6.1 express-4.18.1.tgz Transitive N/A* ❌
CVE-2022-3224 Medium 6.1 parse-url-6.0.0.tgz Transitive 4.15.2 ❌
CVE-2022-2218 Medium 6.1 parse-url-6.0.0.tgz Transitive 4.15.2 ❌
CVE-2022-2217 Medium 6.1 parse-url-6.0.0.tgz Transitive 4.15.2 ❌
CVE-2022-0235 Medium 6.1 node-fetch-2.6.1.tgz Transitive 4.22.0 ❌
CVE-2024-47764 Medium 5.3 detected in multiple dependencies Transitive N/A* ❌
CVE-2024-4067 Medium 5.3 micromatch-4.0.5.tgz Transitive N/A* ❌
CVE-2023-44270 Medium 5.3 postcss-8.4.14.tgz Transitive N/A* ❌
CVE-2023-26115 Medium 5.3 word-wrap-1.2.3.tgz Transitive 4.15.2 ❌
CVE-2022-33987 Medium 5.3 got-9.6.0.tgz Transitive 5.0.0 ❌
CVE-2022-25927 Medium 5.3 ua-parser-js-0.7.31.tgz Transitive 4.15.2 ❌
CVE-2022-25883 Medium 5.3 detected in multiple dependencies Transitive N/A* ❌
CVE-2021-32640 Medium 5.3 ws-7.4.5.tgz Transitive 4.22.0 ❌
CVE-2024-43800 Medium 5.0 serve-static-1.15.0.tgz Transitive N/A* ❌
CVE-2024-43799 Medium 5.0 send-0.18.0.tgz Transitive N/A* ❌
CVE-2024-43796 Medium 5.0 express-4.18.1.tgz Transitive N/A* ❌
CVE-2023-34238 Medium 4.3 gatsby-4.15.1.tgz Direct 4.25.7 ❌
CVE-2024-27088 Low 0.0 es5-ext-0.10.61.tgz Transitive 4.15.2 ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

Partial details (21 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2022-2421 ### Vulnerable Library - socket.io-parser-4.0.4.tgz

socket.io protocol parser

Library home page: https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-4.0.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/socket.io-parser/package.json

Dependency Hierarchy: - gatsby-4.15.1.tgz (Root Library) - socket.io-client-3.1.3.tgz - :x: **socket.io-parser-4.0.4.tgz** (Vulnerable Library)

Found in HEAD commit: fb766f816ad2f4315881e9e4b6d630e84cad0f1e

Found in base branch: main

### Vulnerability Details

Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.

Publish Date: 2022-10-25

URL: CVE-2022-2421

### CVSS 3 Score Details (10.0)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-qm95-pgcg-qqfq

Release Date: 2022-10-26

Fix Resolution (socket.io-parser): 4.0.5

Direct dependency fix Resolution (gatsby): 4.15.2

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2023-28154 ### Vulnerable Library - webpack-5.72.1.tgz

Packs CommonJs/AMD modules for the browser. Allows to split your codebase into multiple bundles, which can be loaded on demand. Support loaders to preprocess files, i.e. json, jsx, es7, css, less, ... and your custom stuff.

Library home page: https://registry.npmjs.org/webpack/-/webpack-5.72.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/webpack/package.json

Dependency Hierarchy: - gatsby-4.15.1.tgz (Root Library) - :x: **webpack-5.72.1.tgz** (Vulnerable Library)

Found in HEAD commit: fb766f816ad2f4315881e9e4b6d630e84cad0f1e

Found in base branch: main

### Vulnerability Details

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

Publish Date: 2023-03-13

URL: CVE-2023-28154

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2023-03-13

Fix Resolution (webpack): 5.76.0

Direct dependency fix Resolution (gatsby): 4.15.2

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-37601 ### Vulnerable Library - loader-utils-1.4.0.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.4.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Dependency Hierarchy: - gatsby-4.15.1.tgz (Root Library) - yaml-loader-0.6.0.tgz - :x: **loader-utils-1.4.0.tgz** (Vulnerable Library)

Found in HEAD commit: fb766f816ad2f4315881e9e4b6d630e84cad0f1e

Found in base branch: main

### Vulnerability Details

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

Publish Date: 2022-10-12

URL: CVE-2022-37601

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-76p3-8jx3-jpfq

Release Date: 2022-10-12

Fix Resolution (loader-utils): 1.4.1

Direct dependency fix Resolution (gatsby): 4.15.2

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-2216 ### Vulnerable Library - parse-url-6.0.0.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/parse-url/package.json

Dependency Hierarchy: - gatsby-4.15.1.tgz (Root Library) - gatsby-telemetry-3.15.0.tgz - git-up-4.0.5.tgz - :x: **parse-url-6.0.0.tgz** (Vulnerable Library)

Found in HEAD commit: fb766f816ad2f4315881e9e4b6d630e84cad0f1e

Found in base branch: main

### Vulnerability Details

Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 7.0.0.

Publish Date: 2022-06-27

URL: CVE-2022-2216

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/505a3d39-2723-4a06-b1f7-9b2d133c92e1/

Release Date: 2022-06-27

Fix Resolution (parse-url): 6.0.1

Direct dependency fix Resolution (gatsby): 4.15.2

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-2900 ### Vulnerable Library - parse-url-6.0.0.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/parse-url/package.json

Dependency Hierarchy: - gatsby-4.15.1.tgz (Root Library) - gatsby-telemetry-3.15.0.tgz - git-up-4.0.5.tgz - :x: **parse-url-6.0.0.tgz** (Vulnerable Library)

Found in HEAD commit: fb766f816ad2f4315881e9e4b6d630e84cad0f1e

Found in base branch: main

### Vulnerability Details

Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.

Publish Date: 2022-09-14

URL: CVE-2022-2900

### CVSS 3 Score Details (9.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2022-09-14

Fix Resolution (parse-url): 8.0.0

Direct dependency fix Resolution (gatsby): 4.15.2

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
WS-2023-0439 ### Vulnerable Library - axios-0.21.4.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.21.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/axios/package.json

Dependency Hierarchy: - gatsby-4.15.1.tgz (Root Library) - :x: **axios-0.21.4.tgz** (Vulnerable Library)

Found in HEAD commit: fb766f816ad2f4315881e9e4b6d630e84cad0f1e

Found in base branch: main

### Vulnerability Details

Axios is vulnerable to Regular Expression Denial of Service (ReDoS). When a manipulated string is provided as input to the format method, the regular expression exhibits a time complexity of O(n^2). Server becomes unable to provide normal service due to the excessive cost and time wasted in processing vulnerable regular expressions.

Publish Date: 2023-10-25

URL: WS-2023-0439

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/WS-2023-0439

Release Date: 2023-10-25

Fix Resolution (axios): 1.6.3

Direct dependency fix Resolution (gatsby): 5.14.0-canary.7

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
WS-2022-0238 ### Vulnerable Library - parse-url-6.0.0.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/parse-url/package.json

Dependency Hierarchy: - gatsby-4.15.1.tgz (Root Library) - gatsby-telemetry-3.15.0.tgz - git-up-4.0.5.tgz - :x: **parse-url-6.0.0.tgz** (Vulnerable Library)

Found in HEAD commit: fb766f816ad2f4315881e9e4b6d630e84cad0f1e

Found in base branch: main

### Vulnerability Details

File Protocol Spoofing in parse-url before 8.0.0 can lead to attacks, such as XSS, Arbitrary Read/Write File, and Remote Code Execution.

Publish Date: 2022-06-30

URL: WS-2022-0238

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/52060edb-e426-431b-a0d0-e70407e44f18/

Release Date: 2022-06-30

Fix Resolution (parse-url): 8.0.0

Direct dependency fix Resolution (gatsby): 4.15.2

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
WS-2022-0237 ### Vulnerable Library - parse-url-6.0.0.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/parse-url/package.json

Dependency Hierarchy: - gatsby-4.15.1.tgz (Root Library) - gatsby-telemetry-3.15.0.tgz - git-up-4.0.5.tgz - :x: **parse-url-6.0.0.tgz** (Vulnerable Library)

Found in HEAD commit: fb766f816ad2f4315881e9e4b6d630e84cad0f1e

Found in base branch: main

### Vulnerability Details

Regular Expression Denial of Service (ReDoS) in ionicabizau/parse-url before 8.0.0. It allows cause a denial of service when calling function parse-url

Publish Date: 2022-07-04

URL: WS-2022-0237

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2022-07-04

Fix Resolution (parse-url): 8.0.0

Direct dependency fix Resolution (gatsby): 4.15.2

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2024-45590 ### Vulnerable Library - body-parser-1.20.0.tgz

Node.js body parsing middleware

Library home page: https://registry.npmjs.org/body-parser/-/body-parser-1.20.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/body-parser/package.json

Dependency Hierarchy: - gatsby-4.15.1.tgz (Root Library) - :x: **body-parser-1.20.0.tgz** (Vulnerable Library)

Found in HEAD commit: fb766f816ad2f4315881e9e4b6d630e84cad0f1e

Found in base branch: main

### Vulnerability Details

body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.

Publish Date: 2024-09-10

URL: CVE-2024-45590

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/expressjs/body-parser/security/advisories/GHSA-qwcr-r2fm-qrc7

Release Date: 2024-09-10

Fix Resolution: body-parser - 1.20.3

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2024-45296 ### Vulnerable Library - path-to-regexp-0.1.7.tgz

Express style path to RegExp utility

Library home page: https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/path-to-regexp/package.json

Dependency Hierarchy: - gatsby-4.15.1.tgz (Root Library) - express-4.18.1.tgz - :x: **path-to-regexp-0.1.7.tgz** (Vulnerable Library)

Found in HEAD commit: fb766f816ad2f4315881e9e4b6d630e84cad0f1e

Found in base branch: main

### Vulnerability Details

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.

Publish Date: 2024-09-09

URL: CVE-2024-45296

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j

Release Date: 2024-09-09

Fix Resolution: path-to-regexp - 0.1.10,8.0.0

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2024-4068 ### Vulnerable Library - braces-3.0.2.tgz

Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.

Library home page: https://registry.npmjs.org/braces/-/braces-3.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/braces/package.json

Dependency Hierarchy: - gatsby-4.15.1.tgz (Root Library) - micromatch-4.0.5.tgz - :x: **braces-3.0.2.tgz** (Vulnerable Library)

Found in HEAD commit: fb766f816ad2f4315881e9e4b6d630e84cad0f1e

Found in base branch: main

### Vulnerability Details

The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash. Mend Note: After conducting a further research, it was concluded that CVE-2024-4068 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of braces should follow the fix recommendation as noted.

Publish Date: 2024-05-13

URL: CVE-2024-4068

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2024-05-13

Fix Resolution: braces - 3.0.3

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2024-37890 ### Vulnerable Libraries - ws-7.5.8.tgz, ws-7.4.6.tgz, ws-7.4.5.tgz

### ws-7.5.8.tgz

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

Library home page: https://registry.npmjs.org/ws/-/ws-7.5.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ws/package.json

Dependency Hierarchy: - gatsby-4.15.1.tgz (Root Library) - eslint-plugin-graphql-4.0.0.tgz - graphql-config-3.4.1.tgz - url-loader-6.10.1.tgz - subscriptions-transport-ws-0.9.19.tgz - :x: **ws-7.5.8.tgz** (Vulnerable Library) ### ws-7.4.6.tgz

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

Library home page: https://registry.npmjs.org/ws/-/ws-7.4.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ws/package.json

Dependency Hierarchy: - gatsby-4.15.1.tgz (Root Library) - socket.io-client-3.1.3.tgz - engine.io-client-4.1.4.tgz - :x: **ws-7.4.6.tgz** (Vulnerable Library) ### ws-7.4.5.tgz

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

Library home page: https://registry.npmjs.org/ws/-/ws-7.4.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ws/package.json

Dependency Hierarchy: - gatsby-4.15.1.tgz (Root Library) - eslint-plugin-graphql-4.0.0.tgz - graphql-config-3.4.1.tgz - url-loader-6.10.1.tgz - :x: **ws-7.4.5.tgz** (Vulnerable Library)

Found in HEAD commit: fb766f816ad2f4315881e9e4b6d630e84cad0f1e

Found in base branch: main

### Vulnerability Details

ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.

Publish Date: 2024-06-17

URL: CVE-2024-37890

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q

Release Date: 2024-06-17

Fix Resolution (ws): 7.5.10

Direct dependency fix Resolution (gatsby): 4.25.4

Fix Resolution (ws): 7.5.10

Direct dependency fix Resolution (gatsby): 4.25.4

Fix Resolution (ws): 7.5.10

Direct dependency fix Resolution (gatsby): 4.25.4

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-38900 ### Vulnerable Library - decode-uri-component-0.2.0.tgz

A better decodeURIComponent

Library home page: https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/decode-uri-component/package.json

Dependency Hierarchy: - gatsby-4.15.1.tgz (Root Library) - query-string-6.14.1.tgz - :x: **decode-uri-component-0.2.0.tgz** (Vulnerable Library)

Found in HEAD commit: fb766f816ad2f4315881e9e4b6d630e84cad0f1e

Found in base branch: main

### Vulnerability Details

decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

Publish Date: 2022-11-28

URL: CVE-2022-38900

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-w573-4hg7-7wgq

Release Date: 2022-11-28

Fix Resolution (decode-uri-component): 0.2.1

Direct dependency fix Resolution (gatsby): 4.15.2

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-37603 ### Vulnerable Libraries - loader-utils-3.2.0.tgz, loader-utils-1.4.0.tgz

### loader-utils-3.2.0.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-3.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Dependency Hierarchy: - gatsby-4.15.1.tgz (Root Library) - react-dev-utils-12.0.1.tgz - :x: **loader-utils-3.2.0.tgz** (Vulnerable Library) ### loader-utils-1.4.0.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.4.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Dependency Hierarchy: - gatsby-4.15.1.tgz (Root Library) - yaml-loader-0.6.0.tgz - :x: **loader-utils-1.4.0.tgz** (Vulnerable Library)

Found in HEAD commit: fb766f816ad2f4315881e9e4b6d630e84cad0f1e

Found in base branch: main

### Vulnerability Details

A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.

Publish Date: 2022-10-14

URL: CVE-2022-37603

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-3rfm-jhwj-7488

Release Date: 2022-10-14

Fix Resolution (loader-utils): 3.2.1

Direct dependency fix Resolution (gatsby): 4.15.2

Fix Resolution (loader-utils): 3.2.1

Direct dependency fix Resolution (gatsby): 4.15.2

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-3517 ### Vulnerable Library - minimatch-3.0.4.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/minimatch/package.json

Dependency Hierarchy: - gatsby-4.15.1.tgz (Root Library) - eslint-plugin-graphql-4.0.0.tgz - graphql-config-3.4.1.tgz - :x: **minimatch-3.0.4.tgz** (Vulnerable Library)

Found in HEAD commit: fb766f816ad2f4315881e9e4b6d630e84cad0f1e

Found in base branch: main

### Vulnerability Details

A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

Publish Date: 2022-10-17

URL: CVE-2022-3517

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2022-10-17

Fix Resolution: minimatch - 3.0.5

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-24434 ### Vulnerable Library - dicer-0.2.5.tgz

A very fast streaming multipart parser for node.js

Library home page: https://registry.npmjs.org/dicer/-/dicer-0.2.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/dicer/package.json

Dependency Hierarchy: - gatsby-4.15.1.tgz (Root Library) - multer-1.4.4.tgz - busboy-0.2.14.tgz - :x: **dicer-0.2.5.tgz** (Vulnerable Library)

Found in HEAD commit: fb766f816ad2f4315881e9e4b6d630e84cad0f1e

Found in base branch: main

### Vulnerability Details

This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes.

Publish Date: 2022-05-20

URL: CVE-2022-24434

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-0722 ### Vulnerable Library - parse-url-6.0.0.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-6.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/parse-url/package.json

Dependency Hierarchy: - gatsby-4.15.1.tgz (Root Library) - gatsby-telemetry-3.15.0.tgz - git-up-4.0.5.tgz - :x: **parse-url-6.0.0.tgz** (Vulnerable Library)

Found in HEAD commit: fb766f816ad2f4315881e9e4b6d630e84cad0f1e

Found in base branch: main

### Vulnerability Details

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository ionicabizau/parse-url prior to 7.0.0.

Publish Date: 2022-06-27

URL: CVE-2022-0722

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/2490ef6d-5577-4714-a4dd-9608251b4226

Release Date: 2022-06-27

Fix Resolution (parse-url): 6.0.1

Direct dependency fix Resolution (gatsby): 4.15.2

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2021-23424 ### Vulnerable Library - ansi-html-0.0.7.tgz

An elegant lib that converts the chalked (ANSI) text to HTML.

Library home page: https://registry.npmjs.org/ansi-html/-/ansi-html-0.0.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ansi-html/package.json

Dependency Hierarchy: - gatsby-4.15.1.tgz (Root Library) - react-refresh-webpack-plugin-0.4.3.tgz - :x: **ansi-html-0.0.7.tgz** (Vulnerable Library)

Found in HEAD commit: fb766f816ad2f4315881e9e4b6d630e84cad0f1e

Found in base branch: main

### Vulnerability Details

This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time.

Publish Date: 2021-08-18

URL: CVE-2021-23424

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-23424

Release Date: 2021-08-18

Fix Resolution (ansi-html): 0.0.8

Direct dependency fix Resolution (gatsby): 4.22.0

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2024-29180 ### Vulnerable Library - webpack-dev-middleware-4.3.0.tgz

A development middleware for webpack

Library home page: https://registry.npmjs.org/webpack-dev-middleware/-/webpack-dev-middleware-4.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/webpack-dev-middleware/package.json

Dependency Hierarchy: - gatsby-4.15.1.tgz (Root Library) - :x: **webpack-dev-middleware-4.3.0.tgz** (Vulnerable Library)

Found in HEAD commit: fb766f816ad2f4315881e9e4b6d630e84cad0f1e

Found in base branch: main

### Vulnerability Details

Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. The middleware can either work with the physical filesystem when reading the files or it can use a virtualized in-memory `memfs` filesystem. If `writeToDisk` configuration option is set to `true`, the physical filesystem is used. The `getFilenameFromUrl` method is used to parse URL and build the local file path. The public path prefix is stripped from the URL, and the `unsecaped` path suffix is appended to the `outputPath`. As the URL is not unescaped and normalized automatically before calling the midlleware, it is possible to use `%2e` and `%2f` sequences to perform path traversal attack. Developers using `webpack-dev-server` or `webpack-dev-middleware` are affected by the issue. When the project is started, an attacker might access any file on the developer's machine and exfiltrate the content. If the development server is listening on a public IP address (or `0.0.0.0`), an attacker on the local network can access the local files without any interaction from the victim (direct connection to the port). If the server allows access from third-party domains, an attacker can send a malicious link to the victim. When visited, the client side script can connect to the local server and exfiltrate the local files. Starting with fixed versions 7.1.0, 6.1.2, and 5.3.4, the URL is unescaped and normalized before any further processing.

Publish Date: 2024-03-21

URL: CVE-2024-29180

### CVSS 3 Score Details (7.4)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-wr3j-pwj9-hqq6

Release Date: 2024-03-21

Fix Resolution: webpack-dev-middleware - 5.3.4,6.1.2,7.1.0

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2024-38355 ### Vulnerable Library - socket.io-3.1.2.tgz

node.js realtime framework server

Library home page: https://registry.npmjs.org/socket.io/-/socket.io-3.1.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/socket.io/package.json

Dependency Hierarchy: - gatsby-4.15.1.tgz (Root Library) - :x: **socket.io-3.1.2.tgz** (Vulnerable Library)

Found in HEAD commit: fb766f816ad2f4315881e9e4b6d630e84cad0f1e

Found in base branch: main

### Vulnerability Details

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.

Publish Date: 2024-06-19

URL: CVE-2024-38355

### CVSS 3 Score Details (7.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/socketio/socket.io/security/advisories/GHSA-25hc-qcg6-38wj

Release Date: 2024-06-19

Fix Resolution (socket.io): 4.6.2

Direct dependency fix Resolution (gatsby): 5.12.0

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2023-32695 ### Vulnerable Library - socket.io-parser-4.0.4.tgz

socket.io protocol parser

Library home page: https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-4.0.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/socket.io-parser/package.json

Dependency Hierarchy: - gatsby-4.15.1.tgz (Root Library) - socket.io-client-3.1.3.tgz - :x: **socket.io-parser-4.0.4.tgz** (Vulnerable Library)

Found in HEAD commit: fb766f816ad2f4315881e9e4b6d630e84cad0f1e

Found in base branch: main

### Vulnerability Details

socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.

Publish Date: 2023-05-27

URL: CVE-2023-32695

### CVSS 3 Score Details (7.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9

Release Date: 2023-05-27

Fix Resolution (socket.io-parser): 4.2.3

Direct dependency fix Resolution (gatsby): 4.25.4

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
mend-bolt-for-github[bot] commented 2 months ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

mend-bolt-for-github[bot] commented 2 months ago

:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.