search

itbigtech / react

The library for web and native user interfaces.
https://react.dev
MIT License
0 stars 0 forks source link

undici-5.22.1.tgz: 4 vulnerabilities (highest severity is: 3.9) - autoclosed #75

Closed mend-for-github-com[bot] closed 4 hours ago

mend-for-github-com[bot] commented 4 hours ago
Vulnerable Library - undici-5.22.1.tgz

Library home page: https://registry.npmjs.org/undici/-/undici-5.22.1.tgz

Found in HEAD commit: caf38324f5719d5c85806c516ecfb8f0177e29c0

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (undici version) Remediation Possible** Reachability
CVE-2024-30260 Low 3.9 undici-5.22.1.tgz Direct undici - 5.28.4,6.11.1 ❌
CVE-2024-24758 Low 3.9 undici-5.22.1.tgz Direct 5.28.3 ❌
CVE-2023-45143 Low 3.9 undici-5.22.1.tgz Direct 5.26.2 ❌
CVE-2024-30261 Low 2.6 undici-5.22.1.tgz Direct undici - 5.28.4,6.11.1 ❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-30260 ### Vulnerable Library - undici-5.22.1.tgz

Library home page: https://registry.npmjs.org/undici/-/undici-5.22.1.tgz

Dependency Hierarchy: - :x: **undici-5.22.1.tgz** (Vulnerable Library)

Found in HEAD commit: caf38324f5719d5c85806c516ecfb8f0177e29c0

Found in base branch: main

### Vulnerability Details

Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici cleared Authorization and Proxy-Authorization headers for `fetch()`, but did not clear them for `undici.request()`. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

Publish Date: 2024-04-04

URL: CVE-2024-30260

### CVSS 3 Score Details (3.9)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: High - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/nodejs/undici/security/advisories/GHSA-m4v8-wqvr-p9f7

Release Date: 2024-04-04

Fix Resolution: undici - 5.28.4,6.11.1

CVE-2024-24758 ### Vulnerable Library - undici-5.22.1.tgz

Library home page: https://registry.npmjs.org/undici/-/undici-5.22.1.tgz

Dependency Hierarchy: - :x: **undici-5.22.1.tgz** (Vulnerable Library)

Found in HEAD commit: caf38324f5719d5c85806c516ecfb8f0177e29c0

Found in base branch: main

### Vulnerability Details

Undici is an HTTP/1.1 client, written from scratch for Node.js. Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Proxy-Authentication` headers. This issue has been patched in versions 5.28.3 and 6.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Publish Date: 2024-02-16

URL: CVE-2024-24758

### CVSS 3 Score Details (3.9)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: High - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-24758

Release Date: 2024-02-16

Fix Resolution: 5.28.3

CVE-2023-45143 ### Vulnerable Library - undici-5.22.1.tgz

Library home page: https://registry.npmjs.org/undici/-/undici-5.22.1.tgz

Dependency Hierarchy: - :x: **undici-5.22.1.tgz** (Vulnerable Library)

Found in HEAD commit: caf38324f5719d5c85806c516ecfb8f0177e29c0

Found in base branch: main

### Vulnerability Details

Undici is an HTTP/1.1 client written from scratch for Node.js. Prior to version 5.26.2, Undici already cleared Authorization headers on cross-origin redirects, but did not clear `Cookie` headers. By design, `cookie` headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since undici handles headers more liberally than the spec, there was a disconnect from the assumptions the spec made, and undici's implementation of fetch. As such this may lead to accidental leakage of cookie to a third-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the third party site. This was patched in version 5.26.2. There are no known workarounds.

Publish Date: 2023-10-12

URL: CVE-2023-45143

### CVSS 3 Score Details (3.9)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: High - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/nodejs/undici/security/advisories/GHSA-wqq4-5wpv-mx2g

Release Date: 2023-10-12

Fix Resolution: 5.26.2

CVE-2024-30261 ### Vulnerable Library - undici-5.22.1.tgz

Library home page: https://registry.npmjs.org/undici/-/undici-5.22.1.tgz

Dependency Hierarchy: - :x: **undici-5.22.1.tgz** (Vulnerable Library)

Found in HEAD commit: caf38324f5719d5c85806c516ecfb8f0177e29c0

Found in base branch: main

### Vulnerability Details

Undici is an HTTP/1.1 client, written from scratch for Node.js. An attacker can alter the `integrity` option passed to `fetch()`, allowing `fetch()` to accept requests as valid even if they have been tampered. This vulnerability was patched in version(s) 5.28.4 and 6.11.1.

Publish Date: 2024-04-04

URL: CVE-2024-30261

### CVSS 3 Score Details (2.6)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: Low - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/nodejs/undici/security/advisories/GHSA-9qxr-qj54-h672

Release Date: 2024-04-04

Fix Resolution: undici - 5.28.4,6.11.1

mend-for-github-com[bot] commented 4 hours ago

:information_source: This issue was automatically closed by Mend because it is a duplicate of an existing issue: #76

mend-for-github-com[bot] commented 4 hours ago

:information_source: This issue was automatically closed by Mend because it is a duplicate of an existing issue: #76