*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds.
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()` which can be used to escape the sandbox and run arbitrary code in host context. This vulnerability was patched in the release of version `3.9.17` of `vm2`. There are no known workarounds for this vulnerability. Users are advised to upgrade.
There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass `handleException()` and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context. A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version `3.9.16` of `vm2`.
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.15 of vm2. There are no known workarounds.
The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.
Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the `allowInvalidAsymmetricKeyTypes` option to `true` in the `sign()` and/or `verify()` functions.
In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify algorithms in the `jwt.verify()` function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options.
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).
The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.
This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function referring to the `secretOrPublicKey` argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.
** UNSUPPORTED WHEN ASSIGNED ** The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
Vulnerable Library - firebase-tools-10.9.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/firebase-tools/node_modules/vm2/package.json
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
Details
CVE-2022-36067
### Vulnerable Library - vm2-3.9.9.tgzvm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Securely!
Library home page: https://registry.npmjs.org/vm2/-/vm2-3.9.9.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/firebase-tools/node_modules/vm2/package.json
Dependency Hierarchy: - firebase-tools-10.9.2.tgz (Root Library) - proxy-agent-5.0.0.tgz - pac-proxy-agent-5.0.0.tgz - pac-resolver-5.0.0.tgz - degenerator-3.0.1.tgz - :x: **vm2-3.9.9.tgz** (Vulnerable Library)
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
### Vulnerability Detailsvm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds.
Publish Date: 2022-09-06
URL: CVE-2022-36067
### CVSS 3 Score Details (10.0)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/patriksimek/vm2/security/advisories/GHSA-mrgp-mrhc-5jrq
Release Date: 2022-09-06
Fix Resolution (vm2): 3.9.11
Direct dependency fix Resolution (firebase-tools): 11.0.0
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2023-30547
### Vulnerable Library - vm2-3.9.9.tgzvm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Securely!
Library home page: https://registry.npmjs.org/vm2/-/vm2-3.9.9.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/firebase-tools/node_modules/vm2/package.json
Dependency Hierarchy: - firebase-tools-10.9.2.tgz (Root Library) - proxy-agent-5.0.0.tgz - pac-proxy-agent-5.0.0.tgz - pac-resolver-5.0.0.tgz - degenerator-3.0.1.tgz - :x: **vm2-3.9.9.tgz** (Vulnerable Library)
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
### Vulnerability Detailsvm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()` which can be used to escape the sandbox and run arbitrary code in host context. This vulnerability was patched in the release of version `3.9.17` of `vm2`. There are no known workarounds for this vulnerability. Users are advised to upgrade.
Publish Date: 2023-04-17
URL: CVE-2023-30547
### CVSS 3 Score Details (10.0)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-30547
Release Date: 2023-04-17
Fix Resolution: vm2 - 3.9.17
CVE-2023-29199
### Vulnerable Library - vm2-3.9.9.tgzvm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Securely!
Library home page: https://registry.npmjs.org/vm2/-/vm2-3.9.9.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/firebase-tools/node_modules/vm2/package.json
Dependency Hierarchy: - firebase-tools-10.9.2.tgz (Root Library) - proxy-agent-5.0.0.tgz - pac-proxy-agent-5.0.0.tgz - pac-resolver-5.0.0.tgz - degenerator-3.0.1.tgz - :x: **vm2-3.9.9.tgz** (Vulnerable Library)
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
### Vulnerability DetailsThere exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass `handleException()` and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context. A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version `3.9.16` of `vm2`.
Publish Date: 2023-04-14
URL: CVE-2023-29199
### CVSS 3 Score Details (10.0)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/patriksimek/vm2/security/advisories/GHSA-xj72-wvfv-8985
Release Date: 2023-04-14
Fix Resolution: vm2 - 3.9.16
CVE-2023-29017
### Vulnerable Library - vm2-3.9.9.tgzvm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Securely!
Library home page: https://registry.npmjs.org/vm2/-/vm2-3.9.9.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/firebase-tools/node_modules/vm2/package.json
Dependency Hierarchy: - firebase-tools-10.9.2.tgz (Root Library) - proxy-agent-5.0.0.tgz - pac-proxy-agent-5.0.0.tgz - pac-resolver-5.0.0.tgz - degenerator-3.0.1.tgz - :x: **vm2-3.9.9.tgz** (Vulnerable Library)
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
### Vulnerability Detailsvm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.15 of vm2. There are no known workarounds.
Publish Date: 2023-04-06
URL: CVE-2023-29017
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-29017
Release Date: 2023-04-06
Fix Resolution (vm2): 3.9.15
Direct dependency fix Resolution (firebase-tools): 11.0.0
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2022-25893
### Vulnerable Library - vm2-3.9.9.tgzvm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Securely!
Library home page: https://registry.npmjs.org/vm2/-/vm2-3.9.9.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/firebase-tools/node_modules/vm2/package.json
Dependency Hierarchy: - firebase-tools-10.9.2.tgz (Root Library) - proxy-agent-5.0.0.tgz - pac-proxy-agent-5.0.0.tgz - pac-resolver-5.0.0.tgz - degenerator-3.0.1.tgz - :x: **vm2-3.9.9.tgz** (Vulnerable Library)
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
### Vulnerability DetailsThe package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.
Publish Date: 2022-12-21
URL: CVE-2022-25893
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-4w2j-2rg4-5mjw
Release Date: 2022-12-21
Fix Resolution (vm2): 3.9.10
Direct dependency fix Resolution (firebase-tools): 11.0.0
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2022-23539
### Vulnerable Library - jsonwebtoken-8.5.1.tgzJSON Web Token implementation (symmetric and asymmetric)
Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/jsonwebtoken/package.json,/node_modules/firebase-tools/node_modules/jsonwebtoken/package.json
Dependency Hierarchy: - firebase-tools-10.9.2.tgz (Root Library) - :x: **jsonwebtoken-8.5.1.tgz** (Vulnerable Library)
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
### Vulnerability DetailsVersions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the `allowInvalidAsymmetricKeyTypes` option to `true` in the `sign()` and/or `verify()` functions.
Publish Date: 2022-12-23
URL: CVE-2022-23539
### CVSS 3 Score Details (8.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33
Release Date: 2022-12-23
Fix Resolution (jsonwebtoken): 9.0.0
Direct dependency fix Resolution (firebase-tools): 11.21.0
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2022-23540
### Vulnerable Library - jsonwebtoken-8.5.1.tgzJSON Web Token implementation (symmetric and asymmetric)
Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/jsonwebtoken/package.json,/node_modules/firebase-tools/node_modules/jsonwebtoken/package.json
Dependency Hierarchy: - firebase-tools-10.9.2.tgz (Root Library) - :x: **jsonwebtoken-8.5.1.tgz** (Vulnerable Library)
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
### Vulnerability DetailsIn versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify algorithms in the `jwt.verify()` function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options.
Publish Date: 2022-12-22
URL: CVE-2022-23540
### CVSS 3 Score Details (7.6)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: High - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-23540
Release Date: 2022-12-22
Fix Resolution (jsonwebtoken): 9.0.0
Direct dependency fix Resolution (firebase-tools): 11.21.0
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2022-24999
### Vulnerable Libraries - qs-6.7.0.tgz, qs-6.5.2.tgz### qs-6.7.0.tgz
A querystring parser that supports nesting and arrays, with a depth limit
Library home page: https://registry.npmjs.org/qs/-/qs-6.7.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/firebase-tools/node_modules/qs/package.json
Dependency Hierarchy: - firebase-tools-10.9.2.tgz (Root Library) - express-4.17.1.tgz - :x: **qs-6.7.0.tgz** (Vulnerable Library) ### qs-6.5.2.tgz
A querystring parser that supports nesting and arrays, with a depth limit
Library home page: https://registry.npmjs.org/qs/-/qs-6.5.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/firebase-tools/node_modules/request/node_modules/qs/package.json
Dependency Hierarchy: - firebase-tools-10.9.2.tgz (Root Library) - request-2.88.2.tgz - :x: **qs-6.5.2.tgz** (Vulnerable Library)
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
### Vulnerability Detailsqs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).
Publish Date: 2022-11-26
URL: CVE-2022-24999
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999
Release Date: 2022-11-26
Fix Resolution (qs): 6.7.3
Direct dependency fix Resolution (firebase-tools): 11.0.0
Fix Resolution (qs): 6.5.3
Direct dependency fix Resolution (firebase-tools): 11.0.0
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2022-25878
### Vulnerable Library - protobufjs-6.11.2.tgzProtocol Buffers for JavaScript (& TypeScript).
Library home page: https://registry.npmjs.org/protobufjs/-/protobufjs-6.11.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/firebase-tools/node_modules/protobufjs/package.json
Dependency Hierarchy: - firebase-tools-10.9.2.tgz (Root Library) - pubsub-2.18.4.tgz - google-gax-2.28.1.tgz - :x: **protobufjs-6.11.2.tgz** (Vulnerable Library)
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
### Vulnerability DetailsThe package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files
Publish Date: 2022-05-27
URL: CVE-2022-25878
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25878
Release Date: 2022-05-27
Fix Resolution (protobufjs): 6.11.3
Direct dependency fix Resolution (firebase-tools): 11.1.0
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2022-3517
### Vulnerable Library - minimatch-3.0.4.tgza glob matcher in javascript
Library home page: https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/firebase-tools/node_modules/minimatch/package.json
Dependency Hierarchy: - firebase-tools-10.9.2.tgz (Root Library) - :x: **minimatch-3.0.4.tgz** (Vulnerable Library)
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
### Vulnerability DetailsA vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.
Publish Date: 2022-10-17
URL: CVE-2022-3517
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2022-10-17
Fix Resolution: minimatch - 3.0.5
CVE-2022-25881
### Vulnerable Library - http-cache-semantics-4.1.0.tgzParses Cache-Control and other headers. Helps building correct HTTP caches and proxies
Library home page: https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.1.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/firebase-tools/node_modules/http-cache-semantics/package.json
Dependency Hierarchy: - firebase-tools-10.9.2.tgz (Root Library) - superstatic-8.0.0.tgz - re2-1.17.3.tgz - node-gyp-8.4.1.tgz - make-fetch-happen-9.1.0.tgz - :x: **http-cache-semantics-4.1.0.tgz** (Vulnerable Library)
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
### Vulnerability DetailsThis affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
Publish Date: 2023-01-31
URL: CVE-2022-25881
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-25881
Release Date: 2023-01-31
Fix Resolution (http-cache-semantics): 4.1.1
Direct dependency fix Resolution (firebase-tools): 11.0.0
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2022-23541
### Vulnerable Library - jsonwebtoken-8.5.1.tgzJSON Web Token implementation (symmetric and asymmetric)
Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/jsonwebtoken/package.json,/node_modules/firebase-tools/node_modules/jsonwebtoken/package.json
Dependency Hierarchy: - firebase-tools-10.9.2.tgz (Root Library) - :x: **jsonwebtoken-8.5.1.tgz** (Vulnerable Library)
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
### Vulnerability Detailsjsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function referring to the `secretOrPublicKey` argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.
Publish Date: 2022-12-22
URL: CVE-2022-23541
### CVSS 3 Score Details (6.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959
Release Date: 2022-12-22
Fix Resolution (jsonwebtoken): 9.0.0
Direct dependency fix Resolution (firebase-tools): 11.21.0
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2023-28155
### Vulnerable Library - request-2.88.2.tgzSimplified HTTP request client.
Library home page: https://registry.npmjs.org/request/-/request-2.88.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/firebase-tools/node_modules/request/package.json,/node_modules/request/package.json
Dependency Hierarchy: - firebase-tools-10.9.2.tgz (Root Library) - :x: **request-2.88.2.tgz** (Vulnerable Library)
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
### Vulnerability Details** UNSUPPORTED WHEN ASSIGNED ** The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Publish Date: 2023-03-16
URL: CVE-2023-28155
### CVSS 3 Score Details (6.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here.CVE-2022-33987
### Vulnerable Library - got-9.6.0.tgzSimplified HTTP requests
Library home page: https://registry.npmjs.org/got/-/got-9.6.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/firebase-tools/node_modules/got/package.json
Dependency Hierarchy: - firebase-tools-10.9.2.tgz (Root Library) - update-notifier-5.1.0.tgz - latest-version-5.1.0.tgz - package-json-6.5.0.tgz - :x: **got-9.6.0.tgz** (Vulnerable Library)
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
### Vulnerability DetailsThe got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
Publish Date: 2022-06-18
URL: CVE-2022-33987
### CVSS 3 Score Details (5.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33987
Release Date: 2022-06-18
Fix Resolution (got): 11.8.6
Direct dependency fix Resolution (firebase-tools): 11.21.0
:rescue_worker_helmet: Automatic Remediation is available for this issue:rescue_worker_helmet: Automatic Remediation is available for this issue.