search

jgeraigery / gatsby-starter-netlify-cms

MIT License
0 stars 1 forks source link

gatsby-2.24.37.tgz: 61 vulnerabilities (highest severity is: 9.8) - autoclosed #4

Closed mend-for-github-com[bot] closed 2 years ago

mend-for-github-com[bot] commented 2 years ago
Vulnerable Library - gatsby-2.24.37.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/engine.io/package.json

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in Remediation Available
CVE-2022-2216 High 9.8 parse-url-5.0.2.tgz Transitive 2.24.38 ✅
CVE-2020-7707 High 9.8 property-expr-1.5.1.tgz Transitive 2.24.38 ✅
CVE-2021-44906 High 9.8 minimist-0.2.1.tgz Transitive 4.17.2 ✅
CVE-2022-0691 High 9.8 url-parse-1.4.7.tgz Transitive 2.24.38 ✅
CVE-2021-42740 High 9.8 shell-quote-1.6.1.tgz Transitive 4.14.0 ✅
CVE-2021-31597 High 9.4 xmlhttprequest-ssl-1.5.5.tgz Transitive 2.32.8 ✅
CVE-2022-1650 High 9.3 detected in multiple dependencies Transitive 2.24.38 ✅
CVE-2022-2900 High 9.1 parse-url-5.0.2.tgz Transitive 4.0.0 ✅
CVE-2022-0686 High 9.1 url-parse-1.4.7.tgz Transitive 2.24.38 ✅
CVE-2021-23434 High 8.6 object-path-0.11.5.tgz Transitive 2.24.38 ✅
CVE-2020-28502 High 8.1 xmlhttprequest-ssl-1.5.5.tgz Transitive 2.32.8 ✅
WS-2020-0443 High 8.1 socket.io-2.3.0.tgz Transitive 2.24.38 ✅
CVE-2021-43138 High 7.8 detected in multiple dependencies Transitive 4.17.2 ✅
CVE-2021-3749 High 7.5 axios-0.19.2.tgz Transitive 2.24.66 ✅
CVE-2021-23382 High 7.5 postcss-6.0.23.tgz Transitive 3.0.0-reach-router.14 ✅
CVE-2022-24785 High 7.5 moment-2.27.0.tgz Transitive 4.10.1 ✅
CVE-2021-23343 High 7.5 path-parse-1.0.6.tgz Transitive 2.24.38 ✅
CVE-2021-23424 High 7.5 ansi-html-0.0.7.tgz Transitive 4.17.2 ✅
CVE-2022-25858 High 7.5 terser-4.8.0.tgz Transitive N/A ❌
CVE-2020-28469 High 7.5 glob-parent-5.1.1.tgz Transitive 2.24.38 ✅
CVE-2021-33502 High 7.5 normalize-url-3.3.0.tgz Transitive 3.5.0-telemetry-test.252 ✅
CVE-2021-29059 High 7.5 is-svg-3.0.0.tgz Transitive 2.24.38 ✅
CVE-2022-24772 High 7.5 node-forge-0.9.0.tgz Transitive 3.13.0 ✅
CVE-2022-24771 High 7.5 node-forge-0.9.0.tgz Transitive 3.13.0 ✅
CVE-2021-3805 High 7.5 object-path-0.11.5.tgz Transitive 2.24.38 ✅
CVE-2021-3807 High 7.5 detected in multiple dependencies Transitive 2.24.38 ✅
CVE-2021-28092 High 7.5 is-svg-3.0.0.tgz Transitive 2.24.38 ✅
CVE-2022-0722 High 7.5 parse-url-5.0.2.tgz Transitive 2.24.38 ✅
CVE-2020-36048 High 7.5 engine.io-3.4.2.tgz Transitive 2.32.8 ✅
CVE-2022-1929 High 7.5 devcert-1.1.2.tgz Transitive 2.24.38 ✅
CVE-2022-31129 High 7.5 moment-2.27.0.tgz Transitive N/A ❌
CVE-2020-36049 High 7.5 socket.io-parser-3.3.0.tgz Transitive 2.24.38 ✅
WS-2022-0237 High 7.5 parse-url-5.0.2.tgz Transitive 4.0.0 ✅
WS-2022-0238 High 7.5 parse-url-5.0.2.tgz Transitive 4.0.0 ✅
CVE-2022-0624 High 7.3 parse-path-4.0.2.tgz Transitive 4.0.0 ✅
CVE-2020-7720 High 7.3 node-forge-0.9.0.tgz Transitive 2.24.38 ✅
WS-2022-0008 Medium 6.6 node-forge-0.9.0.tgz Transitive 3.13.0 ✅
CVE-2022-0155 Medium 6.5 detected in multiple dependencies Transitive 2.24.66 ✅
CVE-2021-23386 Medium 6.5 dns-packet-1.3.1.tgz Transitive 2.24.38 ✅
CVE-2020-8244 Medium 6.5 bl-4.0.2.tgz Transitive 2.24.38 ✅
CVE-2022-3224 Medium 6.1 parse-url-5.0.2.tgz Transitive N/A ❌
CVE-2022-1365 Medium 6.1 cross-fetch-2.2.2.tgz Transitive 2.24.64-static-image.135 ✅
CVE-2022-2217 Medium 6.1 parse-url-5.0.2.tgz Transitive 2.24.38 ✅
CVE-2022-2218 Medium 6.1 parse-url-5.0.2.tgz Transitive 2.24.38 ✅
CVE-2022-0235 Medium 6.1 detected in multiple dependencies Transitive 4.17.2 ✅
CVE-2022-0122 Medium 6.1 node-forge-0.9.0.tgz Transitive 3.13.0 ✅
WS-2022-0239 Medium 6.1 parse-url-5.0.2.tgz Transitive 4.0.0 ✅
CVE-2020-28168 Medium 5.9 axios-0.19.2.tgz Transitive 2.31.0 ✅
CVE-2022-0536 Medium 5.9 detected in multiple dependencies Transitive 2.24.66 ✅
CVE-2021-24033 Medium 5.6 react-dev-utils-4.2.3.tgz Transitive 3.0.0-reach-router.14 ✅
CVE-2022-0512 Medium 5.3 url-parse-1.4.7.tgz Transitive 2.24.38 ✅
CVE-2021-32640 Medium 5.3 detected in multiple dependencies Transitive 2.24.38 ✅
CVE-2021-3664 Medium 5.3 url-parse-1.4.7.tgz Transitive 2.24.38 ✅
CVE-2022-24773 Medium 5.3 node-forge-0.9.0.tgz Transitive 3.13.0 ✅
CVE-2021-27515 Medium 5.3 url-parse-1.4.7.tgz Transitive 2.24.38 ✅
CVE-2022-33987 Medium 5.3 got-8.3.2.tgz Transitive 4.17.2 ✅
CVE-2020-15168 Medium 5.3 detected in multiple dependencies Transitive 2.24.64-static-image.135 ✅
CVE-2022-0639 Medium 5.3 url-parse-1.4.7.tgz Transitive 2.24.38 ✅
CVE-2021-23362 Medium 5.3 hosted-git-info-3.0.5.tgz Transitive 2.24.38 ✅
CVE-2021-23364 Medium 5.3 browserslist-4.14.0.tgz Transitive 2.24.38 ✅
CVE-2020-28481 Medium 4.3 socket.io-2.3.0.tgz Transitive 2.24.38 ✅

Details

Partial details (21 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2022-2216 ### Vulnerable Library - parse-url-5.0.2.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-5.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/parse-url/package.json

Dependency Hierarchy: - gatsby-2.24.37.tgz (Root Library) - gatsby-telemetry-1.3.26.tgz - git-up-4.0.1.tgz - :x: **parse-url-5.0.2.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 7.0.0.

Publish Date: 2022-06-27

URL: CVE-2022-2216

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/505a3d39-2723-4a06-b1f7-9b2d133c92e1/

Release Date: 2022-06-27

Fix Resolution (parse-url): 6.0.3

Direct dependency fix Resolution (gatsby): 2.24.38

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2020-7707 ### Vulnerable Library - property-expr-1.5.1.tgz

tiny util for getting and setting deep object props safely

Library home page: https://registry.npmjs.org/property-expr/-/property-expr-1.5.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/property-expr/package.json

Dependency Hierarchy: - gatsby-2.24.37.tgz (Root Library) - gatsby-cli-2.12.80.tgz - gatsby-recipes-0.2.10.tgz - yup-0.27.0.tgz - :x: **property-expr-1.5.1.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

The package property-expr before 2.0.3 are vulnerable to Prototype Pollution via the setter function.

Publish Date: 2020-08-18

URL: CVE-2020-7707

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7707

Release Date: 2020-08-18

Fix Resolution (property-expr): 2.0.3

Direct dependency fix Resolution (gatsby): 2.24.38

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2021-44906 ### Vulnerable Library - minimist-0.2.1.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.2.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/hicat/node_modules/minimist/package.json

Dependency Hierarchy: - gatsby-2.24.37.tgz (Root Library) - gatsby-cli-2.12.80.tgz - gatsby-recipes-0.2.10.tgz - hicat-0.7.0.tgz - :x: **minimist-0.2.1.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: 2022-03-17

URL: CVE-2021-44906

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2022-03-17

Fix Resolution (minimist): 1.2.6

Direct dependency fix Resolution (gatsby): 4.17.2

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2022-0691 ### Vulnerable Library - url-parse-1.4.7.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/url-parse/package.json

Dependency Hierarchy: - gatsby-2.24.37.tgz (Root Library) - webpack-dev-server-3.11.0.tgz - sockjs-client-1.4.0.tgz - :x: **url-parse-1.4.7.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.

Publish Date: 2022-02-21

URL: CVE-2022-0691

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0691

Release Date: 2022-02-21

Fix Resolution (url-parse): 1.5.9

Direct dependency fix Resolution (gatsby): 2.24.38

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2021-42740 ### Vulnerable Library - shell-quote-1.6.1.tgz

quote and parse shell commands

Library home page: https://registry.npmjs.org/shell-quote/-/shell-quote-1.6.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/shell-quote/package.json

Dependency Hierarchy: - gatsby-2.24.37.tgz (Root Library) - react-dev-utils-4.2.3.tgz - :x: **shell-quote-1.6.1.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.

Publish Date: 2021-10-21

URL: CVE-2021-42740

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42740

Release Date: 2021-10-21

Fix Resolution (shell-quote): 1.7.3

Direct dependency fix Resolution (gatsby): 4.14.0

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2021-31597 ### Vulnerable Library - xmlhttprequest-ssl-1.5.5.tgz

XMLHttpRequest for Node

Library home page: https://registry.npmjs.org/xmlhttprequest-ssl/-/xmlhttprequest-ssl-1.5.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/xmlhttprequest-ssl/package.json

Dependency Hierarchy: - gatsby-2.24.37.tgz (Root Library) - socket.io-client-2.3.0.tgz - engine.io-client-3.4.3.tgz - :x: **xmlhttprequest-ssl-1.5.5.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.

Publish Date: 2021-04-23

URL: CVE-2021-31597

### CVSS 3 Score Details (9.4)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31597

Release Date: 2021-04-23

Fix Resolution (xmlhttprequest-ssl): 1.6.1

Direct dependency fix Resolution (gatsby): 2.32.8

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2022-1650 ### Vulnerable Libraries - eventsource-1.0.7.tgz, eventsource-0.1.6.tgz

### eventsource-1.0.7.tgz

W3C compliant EventSource client for Node.js and browser (polyfill)

Library home page: https://registry.npmjs.org/eventsource/-/eventsource-1.0.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/eventsource/package.json

Dependency Hierarchy: - gatsby-2.24.37.tgz (Root Library) - webpack-dev-server-3.11.0.tgz - sockjs-client-1.4.0.tgz - :x: **eventsource-1.0.7.tgz** (Vulnerable Library) ### eventsource-0.1.6.tgz

W3C compliant EventSource client for Node.js

Library home page: https://registry.npmjs.org/eventsource/-/eventsource-0.1.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/eventsource/package.json

Dependency Hierarchy: - gatsby-2.24.37.tgz (Root Library) - react-dev-utils-4.2.3.tgz - sockjs-client-1.1.4.tgz - :x: **eventsource-0.1.6.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository eventsource/eventsource prior to v2.0.2.

Publish Date: 2022-05-12

URL: CVE-2022-1650

### CVSS 3 Score Details (9.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2022-05-12

Fix Resolution (eventsource): 1.1.1

Direct dependency fix Resolution (gatsby): 2.24.38

Fix Resolution (eventsource): 1.1.1

Direct dependency fix Resolution (gatsby): 2.24.38

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2022-2900 ### Vulnerable Library - parse-url-5.0.2.tgz

An advanced url parser supporting git urls too.

Library home page: https://registry.npmjs.org/parse-url/-/parse-url-5.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/parse-url/package.json

Dependency Hierarchy: - gatsby-2.24.37.tgz (Root Library) - gatsby-telemetry-1.3.26.tgz - git-up-4.0.1.tgz - :x: **parse-url-5.0.2.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.

Publish Date: 2022-09-14

URL: CVE-2022-2900

### CVSS 3 Score Details (9.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2022-09-14

Fix Resolution (parse-url): 8.0.0

Direct dependency fix Resolution (gatsby): 4.0.0

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2022-0686 ### Vulnerable Library - url-parse-1.4.7.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/url-parse/package.json

Dependency Hierarchy: - gatsby-2.24.37.tgz (Root Library) - webpack-dev-server-3.11.0.tgz - sockjs-client-1.4.0.tgz - :x: **url-parse-1.4.7.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.

Publish Date: 2022-02-20

URL: CVE-2022-0686

### CVSS 3 Score Details (9.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0686

Release Date: 2022-02-20

Fix Resolution (url-parse): 1.5.8

Direct dependency fix Resolution (gatsby): 2.24.38

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2021-23434 ### Vulnerable Library - object-path-0.11.5.tgz

Access deep object properties using a path

Library home page: https://registry.npmjs.org/object-path/-/object-path-0.11.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/object-path/package.json

Dependency Hierarchy: - gatsby-2.24.37.tgz (Root Library) - gatsby-cli-2.12.80.tgz - yurnalist-1.1.2.tgz - :x: **object-path-0.11.5.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.

Publish Date: 2021-08-27

URL: CVE-2021-23434

### CVSS 3 Score Details (8.6)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23434

Release Date: 2021-08-27

Fix Resolution (object-path): 0.11.6

Direct dependency fix Resolution (gatsby): 2.24.38

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2020-28502 ### Vulnerable Library - xmlhttprequest-ssl-1.5.5.tgz

XMLHttpRequest for Node

Library home page: https://registry.npmjs.org/xmlhttprequest-ssl/-/xmlhttprequest-ssl-1.5.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/xmlhttprequest-ssl/package.json

Dependency Hierarchy: - gatsby-2.24.37.tgz (Root Library) - socket.io-client-2.3.0.tgz - engine.io-client-3.4.3.tgz - :x: **xmlhttprequest-ssl-1.5.5.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and run.

Publish Date: 2021-03-05

URL: CVE-2020-28502

### CVSS 3 Score Details (8.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-h4j5-c7cj-74xg

Release Date: 2021-03-05

Fix Resolution (xmlhttprequest-ssl): 1.6.1

Direct dependency fix Resolution (gatsby): 2.32.8

:rescue_worker_helmet: Automatic Remediation is available for this issue
WS-2020-0443 ### Vulnerable Library - socket.io-2.3.0.tgz

node.js realtime framework server

Library home page: https://registry.npmjs.org/socket.io/-/socket.io-2.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/socket.io/package.json

Dependency Hierarchy: - gatsby-2.24.37.tgz (Root Library) - :x: **socket.io-2.3.0.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

In socket.io in versions 1.0.0 to 2.3.0 is vulnerable to Cross-Site Websocket Hijacking, it allows an attacker to bypass origin protection using special symbols include "`" and "$".

Publish Date: 2020-02-20

URL: WS-2020-0443

### CVSS 3 Score Details (8.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/931197

Release Date: 2020-02-20

Fix Resolution (socket.io): 2.4.0

Direct dependency fix Resolution (gatsby): 2.24.38

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2021-43138 ### Vulnerable Libraries - async-1.5.2.tgz, async-2.6.3.tgz

### async-1.5.2.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-1.5.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/async/package.json

Dependency Hierarchy: - gatsby-2.24.37.tgz (Root Library) - cache-manager-2.11.1.tgz - :x: **async-1.5.2.tgz** (Vulnerable Library) ### async-2.6.3.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-2.6.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/async/package.json

Dependency Hierarchy: - gatsby-2.24.37.tgz (Root Library) - webpack-dev-server-3.11.0.tgz - portfinder-1.0.28.tgz - :x: **async-2.6.3.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

Publish Date: 2022-04-06

URL: CVE-2021-43138

### CVSS 3 Score Details (7.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138

Release Date: 2022-04-06

Fix Resolution (async): 2.6.4

Direct dependency fix Resolution (gatsby): 4.17.2

Fix Resolution (async): 2.6.4

Direct dependency fix Resolution (gatsby): 4.17.2

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2021-3749 ### Vulnerable Library - axios-0.19.2.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.19.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/axios/package.json

Dependency Hierarchy: - gatsby-2.24.37.tgz (Root Library) - :x: **axios-0.19.2.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

axios is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-08-31

URL: CVE-2021-3749

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31/

Release Date: 2021-08-31

Fix Resolution (axios): 0.20.0

Direct dependency fix Resolution (gatsby): 2.24.66

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2021-23382 ### Vulnerable Library - postcss-6.0.23.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-6.0.23.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/postcss/package.json,/node_modules/postcss-modules-extract-imports/node_modules/postcss/package.json

Dependency Hierarchy: - gatsby-2.24.37.tgz (Root Library) - css-loader-1.0.1.tgz - :x: **postcss-6.0.23.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).

Publish Date: 2021-04-26

URL: CVE-2021-23382

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23382

Release Date: 2021-04-26

Fix Resolution (postcss): 7.0.36

Direct dependency fix Resolution (gatsby): 3.0.0-reach-router.14

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2022-24785 ### Vulnerable Library - moment-2.27.0.tgz

Parse, validate, manipulate, and display dates

Library home page: https://registry.npmjs.org/moment/-/moment-2.27.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/moment/package.json

Dependency Hierarchy: - gatsby-2.24.37.tgz (Root Library) - :x: **moment-2.27.0.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

Publish Date: 2022-04-04

URL: CVE-2022-24785

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4

Release Date: 2022-04-04

Fix Resolution (moment): 2.29.2

Direct dependency fix Resolution (gatsby): 4.10.1

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2021-23343 ### Vulnerable Library - path-parse-1.0.6.tgz

Node.js path.parse() ponyfill

Library home page: https://registry.npmjs.org/path-parse/-/path-parse-1.0.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/path-parse/package.json

Dependency Hierarchy: - gatsby-2.24.37.tgz (Root Library) - core-7.11.1.tgz - resolve-1.17.0.tgz - :x: **path-parse-1.0.6.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

Publish Date: 2021-05-04

URL: CVE-2021-23343

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2021-05-04

Fix Resolution (path-parse): 1.0.7

Direct dependency fix Resolution (gatsby): 2.24.38

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2021-23424 ### Vulnerable Library - ansi-html-0.0.7.tgz

An elegant lib that converts the chalked (ANSI) text to HTML.

Library home page: https://registry.npmjs.org/ansi-html/-/ansi-html-0.0.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ansi-html/package.json

Dependency Hierarchy: - gatsby-2.24.37.tgz (Root Library) - webpack-hot-middleware-2.25.0.tgz - :x: **ansi-html-0.0.7.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time.

Publish Date: 2021-08-18

URL: CVE-2021-23424

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-23424

Release Date: 2021-08-18

Fix Resolution (ansi-html): 0.0.8

Direct dependency fix Resolution (gatsby): 4.17.2

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2022-25858 ### Vulnerable Library - terser-4.8.0.tgz

JavaScript parser, mangler/compressor and beautifier toolkit for ES6+

Library home page: https://registry.npmjs.org/terser/-/terser-4.8.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/terser/package.json

Dependency Hierarchy: - gatsby-2.24.37.tgz (Root Library) - terser-webpack-plugin-1.4.4.tgz - :x: **terser-4.8.0.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.

Publish Date: 2022-07-15

URL: CVE-2022-25858

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25858

Release Date: 2022-07-15

Fix Resolution: terser - 4.8.1,5.14.2

CVE-2020-28469 ### Vulnerable Library - glob-parent-5.1.1.tgz

Extract the non-magic parent path from a glob string.

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/glob-parent/package.json

Dependency Hierarchy: - gatsby-2.24.37.tgz (Root Library) - chokidar-3.4.0.tgz - :x: **glob-parent-5.1.1.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Publish Date: 2021-06-03

URL: CVE-2020-28469

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469

Release Date: 2021-06-03

Fix Resolution (glob-parent): 5.1.2

Direct dependency fix Resolution (gatsby): 2.24.38

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2021-33502 ### Vulnerable Library - normalize-url-3.3.0.tgz

Normalize a URL

Library home page: https://registry.npmjs.org/normalize-url/-/normalize-url-3.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/normalize-url/package.json

Dependency Hierarchy: - gatsby-2.24.37.tgz (Root Library) - gatsby-telemetry-1.3.26.tgz - git-up-4.0.1.tgz - parse-url-5.0.2.tgz - :x: **normalize-url-3.3.0.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

Publish Date: 2021-05-24

URL: CVE-2021-33502

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33502

Release Date: 2021-05-24

Fix Resolution (normalize-url): 4.5.1

Direct dependency fix Resolution (gatsby): 3.5.0-telemetry-test.252

:rescue_worker_helmet: Automatic Remediation is available for this issue

:rescue_worker_helmet: Automatic Remediation is available for this issue.

mend-for-github-com[bot] commented 2 years ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.