search

TritonDataCenter / node-http-signature

Reference implementation of Joyent's HTTP Signature Scheme
https://tritondatacenter.com
MIT License
404 stars 118 forks source link

Node-http-signature-v1.1.0 (File: index.js) Vulnerability #97

Closed karthiRajendran closed 2 years ago

karthiRajendran commented 4 years ago

Vulnerability: CVE-2019-20149 Library: Node-http-signature-v1.1.0 (File: index.js) Vulnerability Description: ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

Kindly Suggest me the fix.

node-http-signature

ipsitabhattacharya22 commented 4 years ago

Is there any update on this ?

bahamat commented 2 years ago

I'm not really sure where that report came from, but we don't use kind-of as a direct dependency, nor is it listed in package-lock.json, so it's also not a transitive dependency. I don't even see this in the 1.1.0 version.

I'm closing this as nothing to do. If anyone can point out exactly why this gets triggered I'll look at fixing it.