Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`.
CVE-2022-29167 - High Severity Vulnerability
hawk-3.1.3.tgz
HTTP Hawk Authentication Scheme
Library home page: https://registry.npmjs.org/hawk/-/hawk-3.1.3.tgz
Path to dependency file: /Ceres/package.json
Path to vulnerable library: /node_modules/hawk/package.json
Dependency Hierarchy: - build-angular-0.6.3.tgz (Root Library) - node-sass-4.9.0.tgz - request-2.79.0.tgz - :x: **hawk-3.1.3.tgz** (Vulnerable Library)
hawk-6.0.2.tgz
HTTP Hawk Authentication Scheme
Library home page: https://registry.npmjs.org/hawk/-/hawk-6.0.2.tgz
Path to dependency file: /Ceres/package.json
Path to vulnerable library: /functions/node_modules/grpc/node_modules/hawk/package.json
Dependency Hierarchy: - firebase-4.13.1.tgz (Root Library) - firestore-0.4.1.tgz - grpc-1.10.1.tgz - node-pre-gyp-0.7.0.tgz - request-2.83.0.tgz - :x: **hawk-6.0.2.tgz** (Vulnerable Library)
Found in HEAD commit: b31d728670f7b1cea140b9a346bf71d1a9771fb2
Found in base branch: clean_branch
Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead. `Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`.
Publish Date: 2022-05-05
URL: CVE-2022-29167
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/mozilla/hawk/security/advisories/GHSA-44pw-h2cw-w3vq
Release Date: 2022-05-05
Fix Resolution (hawk): 9.0.1
Direct dependency fix Resolution (@angular-devkit/build-angular): 0.6.4
Fix Resolution (hawk): 9.0.1
Direct dependency fix Resolution (firebase): 5.0.2-canary.1c5258c
Step up your Open Source Security Game with Mend here