search

thor-it / thor-sso

FOSS IdentityServer4 solution for single-sign-on of the rugby club SRC Thor.
MIT License
2 stars 1 forks source link

karma-5.1.1.tgz: 15 vulnerabilities (highest severity is: 9.4) - autoclosed #23

Closed mend-bolt-for-github[bot] closed 2 years ago

mend-bolt-for-github[bot] commented 2 years ago
Vulnerable Library - karma-5.1.1.tgz

Spectacular Test Runner for JavaScript.

Library home page: https://registry.npmjs.org/karma/-/karma-5.1.1.tgz

Path to dependency file: /angular/package.json

Path to vulnerable library: /angular/node_modules/karma/package.json

Found in HEAD commit: 2e5128b82914ee6f0021bd2c18fef7b5c70d6088

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in Remediation Available
CVE-2021-31597 High 9.4 xmlhttprequest-ssl-1.5.5.tgz Transitive 5.2.0 ❌
CVE-2020-28502 High 8.1 xmlhttprequest-ssl-1.5.5.tgz Transitive 5.2.0 ❌
WS-2020-0443 High 8.1 socket.io-2.3.0.tgz Transitive 5.2.0 ❌
CVE-2020-36048 High 7.5 engine.io-3.4.2.tgz Transitive 6.0.0 ❌
CVE-2021-27292 High 7.5 ua-parser-js-0.7.21.tgz Transitive 6.0.0 ❌
CVE-2020-36049 High 7.5 socket.io-parser-3.3.1.tgz Transitive 5.2.0 ❌
CVE-2020-7733 High 7.5 ua-parser-js-0.7.21.tgz Transitive 5.2.3 ❌
CVE-2020-7793 High 7.5 ua-parser-js-0.7.21.tgz Transitive 6.0.0 ❌
CVE-2022-0155 Medium 6.5 follow-redirects-1.13.0.tgz Transitive 5.2.0 ❌
CVE-2022-0437 Medium 6.1 karma-5.1.1.tgz Direct 6.3.14 ❌
CVE-2021-23495 Medium 6.1 karma-5.1.1.tgz Direct 6.3.16 ❌
CVE-2022-0536 Medium 5.9 follow-redirects-1.13.0.tgz Transitive 5.2.0 ❌
CVE-2022-21704 Medium 5.5 log4js-6.3.0.tgz Transitive 5.2.0 ❌
CVE-2021-32640 Medium 5.3 multiple Transitive 5.2.0 ❌
CVE-2020-28481 Medium 4.3 socket.io-2.3.0.tgz Transitive 5.2.0 ❌

Details

CVE-2021-31597 ### Vulnerable Library - xmlhttprequest-ssl-1.5.5.tgz

XMLHttpRequest for Node

Library home page: https://registry.npmjs.org/xmlhttprequest-ssl/-/xmlhttprequest-ssl-1.5.5.tgz

Path to dependency file: /angular/package.json

Path to vulnerable library: /angular/node_modules/xmlhttprequest-ssl/package.json

Dependency Hierarchy: - karma-5.1.1.tgz (Root Library) - socket.io-2.3.0.tgz - socket.io-client-2.3.0.tgz - engine.io-client-3.4.4.tgz - :x: **xmlhttprequest-ssl-1.5.5.tgz** (Vulnerable Library)

Found in HEAD commit: 2e5128b82914ee6f0021bd2c18fef7b5c70d6088

Found in base branch: develop

### Vulnerability Details

The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.

Publish Date: 2021-04-23

URL: CVE-2021-31597

### CVSS 3 Score Details (9.4)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31597

Release Date: 2021-04-23

Fix Resolution (xmlhttprequest-ssl): 1.6.1

Direct dependency fix Resolution (karma): 5.2.0

Step up your Open Source Security Game with WhiteSource [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2020-28502 ### Vulnerable Library - xmlhttprequest-ssl-1.5.5.tgz

XMLHttpRequest for Node

Library home page: https://registry.npmjs.org/xmlhttprequest-ssl/-/xmlhttprequest-ssl-1.5.5.tgz

Path to dependency file: /angular/package.json

Path to vulnerable library: /angular/node_modules/xmlhttprequest-ssl/package.json

Dependency Hierarchy: - karma-5.1.1.tgz (Root Library) - socket.io-2.3.0.tgz - socket.io-client-2.3.0.tgz - engine.io-client-3.4.4.tgz - :x: **xmlhttprequest-ssl-1.5.5.tgz** (Vulnerable Library)

Found in HEAD commit: 2e5128b82914ee6f0021bd2c18fef7b5c70d6088

Found in base branch: develop

### Vulnerability Details

This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and run.

Publish Date: 2021-03-05

URL: CVE-2020-28502

### CVSS 3 Score Details (8.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-h4j5-c7cj-74xg

Release Date: 2021-03-05

Fix Resolution (xmlhttprequest-ssl): 1.6.1

Direct dependency fix Resolution (karma): 5.2.0

Step up your Open Source Security Game with WhiteSource [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
WS-2020-0443 ### Vulnerable Library - socket.io-2.3.0.tgz

node.js realtime framework server

Library home page: https://registry.npmjs.org/socket.io/-/socket.io-2.3.0.tgz

Path to dependency file: /angular/package.json

Path to vulnerable library: /angular/node_modules/socket.io/package.json

Dependency Hierarchy: - karma-5.1.1.tgz (Root Library) - :x: **socket.io-2.3.0.tgz** (Vulnerable Library)

Found in HEAD commit: 2e5128b82914ee6f0021bd2c18fef7b5c70d6088

Found in base branch: develop

### Vulnerability Details

In socket.io in versions 1.0.0 to 2.3.0 is vulnerable to Cross-Site Websocket Hijacking, it allows an attacker to bypass origin protection using special symbols include "`" and "$".

Publish Date: 2020-02-20

URL: WS-2020-0443

### CVSS 3 Score Details (8.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/931197

Release Date: 2020-02-20

Fix Resolution (socket.io): 2.4.0

Direct dependency fix Resolution (karma): 5.2.0

Step up your Open Source Security Game with WhiteSource [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2020-36048 ### Vulnerable Library - engine.io-3.4.2.tgz

The realtime engine behind Socket.IO. Provides the foundation of a bidirectional connection between client and server

Library home page: https://registry.npmjs.org/engine.io/-/engine.io-3.4.2.tgz

Path to dependency file: /angular/package.json

Path to vulnerable library: /angular/node_modules/engine.io/package.json

Dependency Hierarchy: - karma-5.1.1.tgz (Root Library) - socket.io-2.3.0.tgz - :x: **engine.io-3.4.2.tgz** (Vulnerable Library)

Found in HEAD commit: 2e5128b82914ee6f0021bd2c18fef7b5c70d6088

Found in base branch: develop

### Vulnerability Details

Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.

Publish Date: 2021-01-08

URL: CVE-2020-36048

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36048

Release Date: 2021-01-08

Fix Resolution (engine.io): 4.0.0-alpha.0

Direct dependency fix Resolution (karma): 6.0.0

Step up your Open Source Security Game with WhiteSource [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2021-27292 ### Vulnerable Library - ua-parser-js-0.7.21.tgz

Lightweight JavaScript-based user-agent string parser

Library home page: https://registry.npmjs.org/ua-parser-js/-/ua-parser-js-0.7.21.tgz

Path to dependency file: /angular/package.json

Path to vulnerable library: /angular/node_modules/ua-parser-js/package.json

Dependency Hierarchy: - karma-5.1.1.tgz (Root Library) - :x: **ua-parser-js-0.7.21.tgz** (Vulnerable Library)

Found in HEAD commit: 2e5128b82914ee6f0021bd2c18fef7b5c70d6088

Found in base branch: develop

### Vulnerability Details

ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.

Publish Date: 2021-03-17

URL: CVE-2021-27292

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/faisalman/ua-parser-js/releases/tag/0.7.24

Release Date: 2021-03-17

Fix Resolution (ua-parser-js): 0.7.24

Direct dependency fix Resolution (karma): 6.0.0

Step up your Open Source Security Game with WhiteSource [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2020-36049 ### Vulnerable Library - socket.io-parser-3.3.1.tgz

socket.io protocol parser

Library home page: https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-3.3.1.tgz

Path to dependency file: /angular/package.json

Path to vulnerable library: /angular/node_modules/socket.io-parser/package.json

Dependency Hierarchy: - karma-5.1.1.tgz (Root Library) - socket.io-2.3.0.tgz - socket.io-client-2.3.0.tgz - :x: **socket.io-parser-3.3.1.tgz** (Vulnerable Library)

Found in HEAD commit: 2e5128b82914ee6f0021bd2c18fef7b5c70d6088

Found in base branch: develop

### Vulnerability Details

socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.

Publish Date: 2021-01-08

URL: CVE-2020-36049

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-xfhh-g9f5-x4m4

Release Date: 2021-01-08

Fix Resolution (socket.io-parser): 3.3.2

Direct dependency fix Resolution (karma): 5.2.0

Step up your Open Source Security Game with WhiteSource [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2020-7733 ### Vulnerable Library - ua-parser-js-0.7.21.tgz

Lightweight JavaScript-based user-agent string parser

Library home page: https://registry.npmjs.org/ua-parser-js/-/ua-parser-js-0.7.21.tgz

Path to dependency file: /angular/package.json

Path to vulnerable library: /angular/node_modules/ua-parser-js/package.json

Dependency Hierarchy: - karma-5.1.1.tgz (Root Library) - :x: **ua-parser-js-0.7.21.tgz** (Vulnerable Library)

Found in HEAD commit: 2e5128b82914ee6f0021bd2c18fef7b5c70d6088

Found in base branch: develop

### Vulnerability Details

The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.

Publish Date: 2020-09-16

URL: CVE-2020-7733

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7733

Release Date: 2020-09-16

Fix Resolution (ua-parser-js): 0.7.22

Direct dependency fix Resolution (karma): 5.2.3

Step up your Open Source Security Game with WhiteSource [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2020-7793 ### Vulnerable Library - ua-parser-js-0.7.21.tgz

Lightweight JavaScript-based user-agent string parser

Library home page: https://registry.npmjs.org/ua-parser-js/-/ua-parser-js-0.7.21.tgz

Path to dependency file: /angular/package.json

Path to vulnerable library: /angular/node_modules/ua-parser-js/package.json

Dependency Hierarchy: - karma-5.1.1.tgz (Root Library) - :x: **ua-parser-js-0.7.21.tgz** (Vulnerable Library)

Found in HEAD commit: 2e5128b82914ee6f0021bd2c18fef7b5c70d6088

Found in base branch: develop

### Vulnerability Details

The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info).

Publish Date: 2020-12-11

URL: CVE-2020-7793

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/faisalman/ua-parser-js/commit/6d1f26df051ba681463ef109d36c9cf0f7e32b18

Release Date: 2020-12-11

Fix Resolution (ua-parser-js): 0.7.23

Direct dependency fix Resolution (karma): 6.0.0

Step up your Open Source Security Game with WhiteSource [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-0155 ### Vulnerable Library - follow-redirects-1.13.0.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.13.0.tgz

Path to dependency file: /angular/package.json

Path to vulnerable library: /angular/node_modules/follow-redirects/package.json

Dependency Hierarchy: - karma-5.1.1.tgz (Root Library) - http-proxy-1.18.1.tgz - :x: **follow-redirects-1.13.0.tgz** (Vulnerable Library)

Found in HEAD commit: 2e5128b82914ee6f0021bd2c18fef7b5c70d6088

Found in base branch: develop

### Vulnerability Details

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

Publish Date: 2022-01-10

URL: CVE-2022-0155

### CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406/

Release Date: 2022-01-10

Fix Resolution (follow-redirects): 1.14.7

Direct dependency fix Resolution (karma): 5.2.0

Step up your Open Source Security Game with WhiteSource [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-0437 ### Vulnerable Library - karma-5.1.1.tgz

Spectacular Test Runner for JavaScript.

Library home page: https://registry.npmjs.org/karma/-/karma-5.1.1.tgz

Path to dependency file: /angular/package.json

Path to vulnerable library: /angular/node_modules/karma/package.json

Dependency Hierarchy: - :x: **karma-5.1.1.tgz** (Vulnerable Library)

Found in HEAD commit: 2e5128b82914ee6f0021bd2c18fef7b5c70d6088

Found in base branch: develop

### Vulnerability Details

Cross-site Scripting (XSS) - DOM in NPM karma prior to 6.3.14.

Publish Date: 2022-02-05

URL: CVE-2022-0437

### CVSS 3 Score Details (6.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0437

Release Date: 2022-02-05

Fix Resolution: 6.3.14

Step up your Open Source Security Game with WhiteSource [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2021-23495 ### Vulnerable Library - karma-5.1.1.tgz

Spectacular Test Runner for JavaScript.

Library home page: https://registry.npmjs.org/karma/-/karma-5.1.1.tgz

Path to dependency file: /angular/package.json

Path to vulnerable library: /angular/node_modules/karma/package.json

Dependency Hierarchy: - :x: **karma-5.1.1.tgz** (Vulnerable Library)

Found in HEAD commit: 2e5128b82914ee6f0021bd2c18fef7b5c70d6088

Found in base branch: develop

### Vulnerability Details

The package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the return_url query parameter.

Publish Date: 2022-02-25

URL: CVE-2021-23495

### CVSS 3 Score Details (6.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23495

Release Date: 2022-02-25

Fix Resolution: 6.3.16

Step up your Open Source Security Game with WhiteSource [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-0536 ### Vulnerable Library - follow-redirects-1.13.0.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.13.0.tgz

Path to dependency file: /angular/package.json

Path to vulnerable library: /angular/node_modules/follow-redirects/package.json

Dependency Hierarchy: - karma-5.1.1.tgz (Root Library) - http-proxy-1.18.1.tgz - :x: **follow-redirects-1.13.0.tgz** (Vulnerable Library)

Found in HEAD commit: 2e5128b82914ee6f0021bd2c18fef7b5c70d6088

Found in base branch: develop

### Vulnerability Details

Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.

Publish Date: 2022-02-09

URL: CVE-2022-0536

### CVSS 3 Score Details (5.9)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0536

Release Date: 2022-02-09

Fix Resolution (follow-redirects): 1.14.8

Direct dependency fix Resolution (karma): 5.2.0

Step up your Open Source Security Game with WhiteSource [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-21704 ### Vulnerable Library - log4js-6.3.0.tgz

Port of Log4js to work with node.

Library home page: https://registry.npmjs.org/log4js/-/log4js-6.3.0.tgz

Path to dependency file: /angular/package.json

Path to vulnerable library: /angular/node_modules/log4js/package.json

Dependency Hierarchy: - karma-5.1.1.tgz (Root Library) - :x: **log4js-6.3.0.tgz** (Vulnerable Library)

Found in HEAD commit: 2e5128b82914ee6f0021bd2c18fef7b5c70d6088

Found in base branch: develop

### Vulnerability Details

log4js-node is a port of log4js to node.js. In affected versions default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause problems if log files contain sensitive information. This would affect any users that have not supplied their own permissions for the files via the mode parameter in the config. Users are advised to update.

Publish Date: 2022-01-19

URL: CVE-2022-21704

### CVSS 3 Score Details (5.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/log4js-node/log4js-node/security/advisories/GHSA-82v2-mx6x-wq7q

Release Date: 2022-01-19

Fix Resolution (log4js): 6.4.1

Direct dependency fix Resolution (karma): 5.2.0

Step up your Open Source Security Game with WhiteSource [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2021-32640 ### Vulnerable Libraries - ws-7.4.1.tgz, ws-6.1.4.tgz

### ws-7.4.1.tgz

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

Library home page: https://registry.npmjs.org/ws/-/ws-7.4.1.tgz

Path to dependency file: /angular/package.json

Path to vulnerable library: /angular/node_modules/ws/package.json

Dependency Hierarchy: - karma-5.1.1.tgz (Root Library) - socket.io-2.3.0.tgz - engine.io-3.4.2.tgz - :x: **ws-7.4.1.tgz** (Vulnerable Library) ### ws-6.1.4.tgz

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

Library home page: https://registry.npmjs.org/ws/-/ws-6.1.4.tgz

Path to dependency file: /angular/package.json

Path to vulnerable library: /angular/node_modules/ws/package.json

Dependency Hierarchy: - karma-5.1.1.tgz (Root Library) - socket.io-2.3.0.tgz - socket.io-client-2.3.0.tgz - engine.io-client-3.4.4.tgz - :x: **ws-6.1.4.tgz** (Vulnerable Library)

Found in HEAD commit: 2e5128b82914ee6f0021bd2c18fef7b5c70d6088

Found in base branch: develop

### Vulnerability Details

ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.

Publish Date: 2021-05-25

URL: CVE-2021-32640

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/websockets/ws/security/advisories/GHSA-6fc8-4gx4-v693

Release Date: 2021-05-25

Fix Resolution (ws): 7.4.6

Direct dependency fix Resolution (karma): 5.2.0

Fix Resolution (ws): 6.2.2

Direct dependency fix Resolution (karma): 5.2.0

Step up your Open Source Security Game with WhiteSource [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2020-28481 ### Vulnerable Library - socket.io-2.3.0.tgz

node.js realtime framework server

Library home page: https://registry.npmjs.org/socket.io/-/socket.io-2.3.0.tgz

Path to dependency file: /angular/package.json

Path to vulnerable library: /angular/node_modules/socket.io/package.json

Dependency Hierarchy: - karma-5.1.1.tgz (Root Library) - :x: **socket.io-2.3.0.tgz** (Vulnerable Library)

Found in HEAD commit: 2e5128b82914ee6f0021bd2c18fef7b5c70d6088

Found in base branch: develop

### Vulnerability Details

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.

Publish Date: 2021-01-19

URL: CVE-2020-28481

### CVSS 3 Score Details (4.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28481

Release Date: 2021-01-19

Fix Resolution (socket.io): 2.4.0

Direct dependency fix Resolution (karma): 5.2.0

Step up your Open Source Security Game with WhiteSource [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
mend-bolt-for-github[bot] commented 2 years ago

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.