search

jgeraigery / gatsby-starter-netlify-cms

MIT License
0 stars 1 forks source link

gatsby-4.25.7.tgz: 9 vulnerabilities (highest severity is: 8.8) - autoclosed #55

Closed mend-for-github-com[bot] closed 10 months ago

mend-for-github-com[bot] commented 1 year ago
Vulnerable Library - gatsby-4.25.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Mend has checked all newer package trees, and you are on the least vulnerable package!

Please note: There might be a version that explicitly solves one or more of the vulnerabilities listed below, but we do not recommend it. For more info about the optional fixes, check the "Details" section below.

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (gatsby version) Fix PR available
CVE-2023-45133 High 8.8 traverse-7.21.5.tgz Transitive N/A* ❌
CVE-2023-26115 High 7.5 word-wrap-1.2.3.tgz Transitive N/A* ❌
CVE-2023-32695 High 7.5 socket.io-parser-4.2.2.tgz Transitive N/A* ❌
CVE-2022-25883 High 7.5 detected in multiple dependencies Transitive N/A* ❌
CVE-2023-52079 Medium 6.8 msgpackr-1.9.2.tgz Transitive N/A* ❌
CVE-2023-31125 Medium 6.5 engine.io-6.2.1.tgz Transitive N/A* ❌
CVE-2023-45857 Medium 6.5 axios-0.21.4.tgz Transitive N/A* ❌
CVE-2022-33987 Medium 5.3 got-9.6.0.tgz Transitive N/A* ❌
CVE-2023-44270 Medium 5.3 postcss-8.4.23.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-45133 ### Vulnerable Library - traverse-7.21.5.tgz

Library home page: https://registry.npmjs.org/@babel/traverse/-/traverse-7.21.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy: - gatsby-4.25.7.tgz (Root Library) - :x: **traverse-7.21.5.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@babel/preset-env` when using its `useBuiltIns` option; and any "polyfill provider" plugin that depends on `@babel/helper-define-polyfill-provider`, such as `babel-plugin-polyfill-corejs3`, `babel-plugin-polyfill-corejs2`, `babel-plugin-polyfill-es-shims`, `babel-plugin-polyfill-regenerator`. No other plugins under the `@babel/` namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in `@babel/traverse@7.23.2` and `@babel/traverse@8.0.0-alpha.4`. Those who cannot upgrade `@babel/traverse` and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected `@babel/traverse` versions: `@babel/plugin-transform-runtime` v7.23.2, `@babel/preset-env` v7.23.2, `@babel/helper-define-polyfill-provider` v0.4.3, `babel-plugin-polyfill-corejs2` v0.4.6, `babel-plugin-polyfill-corejs3` v0.8.5, `babel-plugin-polyfill-es-shims` v0.10.0, `babel-plugin-polyfill-regenerator` v0.5.3.

Publish Date: 2023-10-12

URL: CVE-2023-45133

### CVSS 3 Score Details (8.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/babel/babel/security/advisories/GHSA-67hx-6x53-jw92

Release Date: 2023-10-12

Fix Resolution: @babel/traverse - 7.23.2

CVE-2023-26115 ### Vulnerable Library - word-wrap-1.2.3.tgz

Wrap words to a specified length.

Library home page: https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy: - gatsby-4.25.7.tgz (Root Library) - eslint-7.32.0.tgz - optionator-0.9.1.tgz - :x: **word-wrap-1.2.3.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.

Publish Date: 2023-06-22

URL: CVE-2023-26115

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-j8xg-fqg3-53r7

Release Date: 2023-06-22

Fix Resolution: word-wrap - 1.2.4

CVE-2023-32695 ### Vulnerable Library - socket.io-parser-4.2.2.tgz

Library home page: https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-4.2.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy: - gatsby-4.25.7.tgz (Root Library) - socket.io-4.5.4.tgz - :x: **socket.io-parser-4.2.2.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.

Publish Date: 2023-05-27

URL: CVE-2023-32695

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9

Release Date: 2023-05-27

Fix Resolution: socket.io-parser - 3.4.3,4.2.3

CVE-2022-25883 ### Vulnerable Libraries - semver-7.5.1.tgz, semver-5.7.1.tgz, semver-7.0.0.tgz, semver-6.3.0.tgz

### semver-7.5.1.tgz

Library home page: https://registry.npmjs.org/semver/-/semver-7.5.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy: - gatsby-4.25.7.tgz (Root Library) - :x: **semver-7.5.1.tgz** (Vulnerable Library) ### semver-5.7.1.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-5.7.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy: - gatsby-4.25.7.tgz (Root Library) - core-2.6.2.tgz - :x: **semver-5.7.1.tgz** (Vulnerable Library) ### semver-7.0.0.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-7.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy: - gatsby-4.25.7.tgz (Root Library) - gatsby-legacy-polyfills-2.25.0.tgz - core-js-compat-3.9.0.tgz - :x: **semver-7.0.0.tgz** (Vulnerable Library) ### semver-6.3.0.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-6.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy: - gatsby-4.25.7.tgz (Root Library) - latest-version-5.1.0.tgz - package-json-6.5.0.tgz - :x: **semver-6.3.0.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-c2qf-rxjj-qqgw

Release Date: 2023-06-21

Fix Resolution: semver - 5.7.2,6.3.1,7.5.2;org.webjars.npm:semver:7.5.2

CVE-2023-52079 ### Vulnerable Library - msgpackr-1.9.2.tgz

Library home page: https://registry.npmjs.org/msgpackr/-/msgpackr-1.9.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy: - gatsby-4.25.7.tgz (Root Library) - core-2.6.2.tgz - :x: **msgpackr-1.9.2.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. The fix is available in v1.10.1. Exploits seem to require structured cloning, replacing the 0x70 extension with your own (that throws an error or does something other than recursive referencing) should mitigate the issue.

Publish Date: 2023-12-28

URL: CVE-2023-52079

### CVSS 3 Score Details (6.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-52079

Release Date: 2023-12-28

Fix Resolution: msgpackr - 1.10.1

CVE-2023-31125 ### Vulnerable Library - engine.io-6.2.1.tgz

The realtime engine behind Socket.IO. Provides the foundation of a bidirectional connection between client and server

Library home page: https://registry.npmjs.org/engine.io/-/engine.io-6.2.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy: - gatsby-4.25.7.tgz (Root Library) - socket.io-4.5.4.tgz - :x: **engine.io-6.2.1.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. An uncaught exception vulnerability was introduced in version 5.1.0 and included in version 4.1.0 of the `socket.io` parent package. Older versions are not impacted. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the `engine.io` package, including those who use depending packages like `socket.io`. This issue was fixed in version 6.4.2 of Engine.IO. There is no known workaround except upgrading to a safe version.

Publish Date: 2023-05-08

URL: CVE-2023-31125

### CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-31125

Release Date: 2023-05-08

Fix Resolution: engine.io - 6.4.2

CVE-2023-45857 ### Vulnerable Library - axios-0.21.4.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.21.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy: - gatsby-4.25.7.tgz (Root Library) - :x: **axios-0.21.4.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

Publish Date: 2023-11-08

URL: CVE-2023-45857

### CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2023-11-08

Fix Resolution: axios - 1.6.0

CVE-2022-33987 ### Vulnerable Library - got-9.6.0.tgz

Simplified HTTP requests

Library home page: https://registry.npmjs.org/got/-/got-9.6.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy: - gatsby-4.25.7.tgz (Root Library) - latest-version-5.1.0.tgz - package-json-6.5.0.tgz - :x: **got-9.6.0.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.

Publish Date: 2022-06-18

URL: CVE-2022-33987

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33987

Release Date: 2022-06-18

Fix Resolution: got - 11.8.5,12.1.0

CVE-2023-44270 ### Vulnerable Library - postcss-8.4.23.tgz

Library home page: https://registry.npmjs.org/postcss/-/postcss-8.4.23.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy: - gatsby-4.25.7.tgz (Root Library) - :x: **postcss-8.4.23.tgz** (Vulnerable Library)

Found in HEAD commit: 5df11d63d2ec14dabae2ea2de08e3f2e8f6a261c

Found in base branch: master

### Vulnerability Details

An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.

Publish Date: 2023-09-29

URL: CVE-2023-44270

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-44270

Release Date: 2023-09-29

Fix Resolution: postcss - 8.4.31

mend-for-github-com[bot] commented 10 months ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.