search

autoai-org / AID

One-Stop System for Machine Learning.
https://aid.autoai.org/
Apache License 2.0
320 stars 33 forks source link

hbs-4.1.1.tgz: 4 vulnerabilities (highest severity is: 9.8) #1883

Open mend-bolt-for-github[bot] opened 2 years ago

mend-bolt-for-github[bot] commented 2 years ago
Vulnerable Library - hbs-4.1.1.tgz

Express.js template engine plugin for Handlebars

Library home page: https://registry.npmjs.org/hbs/-/hbs-4.1.1.tgz

Path to dependency file: /components/discovery/yarn.lock

Path to vulnerable library: /components/discovery/yarn.lock

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (hbs version) Remediation Available
CVE-2021-23369 High 9.8 handlebars-4.7.6.tgz Transitive 4.1.2 ❌
CVE-2021-23383 High 9.8 handlebars-4.7.6.tgz Transitive 4.1.2 ❌
CVE-2022-37598 High 9.8 uglify-js-3.11.2.tgz Transitive 4.1.2 ❌
CVE-2021-32822 Medium 5.3 hbs-4.1.1.tgz Direct 4.1.2 ❌

Details

CVE-2021-23369 ### Vulnerable Library - handlebars-4.7.6.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.7.6.tgz

Path to dependency file: /components/discovery/yarn.lock

Path to vulnerable library: /components/discovery/yarn.lock

Dependency Hierarchy: - hbs-4.1.1.tgz (Root Library) - :x: **handlebars-4.7.6.tgz** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

Publish Date: 2021-04-12

URL: CVE-2021-23369

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2021-04-12

Fix Resolution (handlebars): 4.7.7

Direct dependency fix Resolution (hbs): 4.1.2

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2021-23383 ### Vulnerable Library - handlebars-4.7.6.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.7.6.tgz

Path to dependency file: /components/discovery/yarn.lock

Path to vulnerable library: /components/discovery/yarn.lock

Dependency Hierarchy: - hbs-4.1.1.tgz (Root Library) - :x: **handlebars-4.7.6.tgz** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

Publish Date: 2021-05-04

URL: CVE-2021-23383

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23383

Release Date: 2021-05-04

Fix Resolution (handlebars): 4.7.7

Direct dependency fix Resolution (hbs): 4.1.2

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-37598 ### Vulnerable Library - uglify-js-3.11.2.tgz

JavaScript parser, mangler/compressor and beautifier toolkit

Library home page: https://registry.npmjs.org/uglify-js/-/uglify-js-3.11.2.tgz

Path to dependency file: /components/discovery/yarn.lock

Path to vulnerable library: /components/discovery/yarn.lock

Dependency Hierarchy: - hbs-4.1.1.tgz (Root Library) - handlebars-4.7.6.tgz - :x: **uglify-js-3.11.2.tgz** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

** DISPUTED ** Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report.

Publish Date: 2022-10-20

URL: CVE-2022-37598

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2022-10-20

Fix Resolution (uglify-js): 3.13.10

Direct dependency fix Resolution (hbs): 4.1.2

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2021-32822 ### Vulnerable Library - hbs-4.1.1.tgz

Express.js template engine plugin for Handlebars

Library home page: https://registry.npmjs.org/hbs/-/hbs-4.1.1.tgz

Path to dependency file: /components/discovery/yarn.lock

Path to vulnerable library: /components/discovery/yarn.lock

Dependency Hierarchy: - :x: **hbs-4.1.1.tgz** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options a file disclosure vulnerability may be triggered in downstream applications. For an example PoC see the referenced GHSL-2021-020.

Publish Date: 2021-08-16

URL: CVE-2021-32822

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-32822

Release Date: 2021-08-16

Fix Resolution: 4.1.2

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
stale[bot] commented 2 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.