search

ZSBRybnik / frontend

MIT License
1 stars 0 forks source link

node-jq-2.3.3.tgz: 3 vulnerabilities (highest severity is: 7.5) - autoclosed #124

Closed mend-bolt-for-github[bot] closed 1 year ago

mend-bolt-for-github[bot] commented 2 years ago
Vulnerable Library - node-jq-2.3.3.tgz

Found in HEAD commit: 273a134394edfb54991ff74097965c8f3cac3de7

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (node-jq version) Remediation Available
CVE-2022-25881 High 7.5 http-cache-semantics-3.8.1.tgz Transitive N/A* ❌
CVE-2023-25166 Medium 6.5 formula-3.0.0.tgz Transitive N/A* ❌
CVE-2022-33987 Medium 5.3 detected in multiple dependencies Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2022-25881 ### Vulnerable Library - http-cache-semantics-3.8.1.tgz

Parses Cache-Control and other headers. Helps building correct HTTP caches and proxies

Library home page: https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-3.8.1.tgz

Dependency Hierarchy: - node-jq-2.3.3.tgz (Root Library) - download-8.0.0.tgz - got-8.3.2.tgz - cacheable-request-2.1.4.tgz - :x: **http-cache-semantics-3.8.1.tgz** (Vulnerable Library)

Found in HEAD commit: 273a134394edfb54991ff74097965c8f3cac3de7

Found in base branch: master

### Vulnerability Details

This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

Publish Date: 2023-01-31

URL: CVE-2022-25881

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-25881

Release Date: 2023-01-31

Fix Resolution: http-cache-semantics - 4.1.1

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2023-25166 ### Vulnerable Library - formula-3.0.0.tgz

Math and string formula parser.

Library home page: https://registry.npmjs.org/@sideway/formula/-/formula-3.0.0.tgz

Dependency Hierarchy: - node-jq-2.3.3.tgz (Root Library) - joi-17.6.0.tgz - :x: **formula-3.0.0.tgz** (Vulnerable Library)

Found in HEAD commit: 273a134394edfb54991ff74097965c8f3cac3de7

Found in base branch: master

### Vulnerability Details

formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability.

Publish Date: 2023-02-08

URL: CVE-2023-25166

### CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-25166

Release Date: 2023-02-08

Fix Resolution: @sideway/formula - 3.0.1

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-33987 ### Vulnerable Libraries - got-8.3.2.tgz, got-7.1.0.tgz

### got-8.3.2.tgz

Simplified HTTP requests

Library home page: https://registry.npmjs.org/got/-/got-8.3.2.tgz

Dependency Hierarchy: - node-jq-2.3.3.tgz (Root Library) - download-8.0.0.tgz - :x: **got-8.3.2.tgz** (Vulnerable Library) ### got-7.1.0.tgz

Simplified HTTP requests

Library home page: https://registry.npmjs.org/got/-/got-7.1.0.tgz

Dependency Hierarchy: - node-jq-2.3.3.tgz (Root Library) - bin-build-3.0.0.tgz - download-6.2.5.tgz - :x: **got-7.1.0.tgz** (Vulnerable Library)

Found in HEAD commit: 273a134394edfb54991ff74097965c8f3cac3de7

Found in base branch: master

### Vulnerability Details

The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.

Publish Date: 2022-06-18

URL: CVE-2022-33987

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33987

Release Date: 2022-06-18

Fix Resolution: got - 11.8.5,12.1.0

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
mend-bolt-for-github[bot] commented 1 year ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.