log4js-node is a port of log4js to node.js. In affected versions default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause problems if log files contain sensitive information. This would affect any users that have not supplied their own permissions for the files via the mode parameter in the config. Users are advised to update.
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
Port of Log4js to work with node.
Library home page: https://registry.npmjs.org/log4js/-/log4js-0.6.38.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/log4js/package.json
Found in HEAD commit: 6c7cc801274c55a47ba8227e24b2d4724302bea1
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2022-21704
### Vulnerable Library - log4js-0.6.38.tgzPort of Log4js to work with node.
Library home page: https://registry.npmjs.org/log4js/-/log4js-0.6.38.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/log4js/package.json
Dependency Hierarchy: - :x: **log4js-0.6.38.tgz** (Vulnerable Library)
Found in HEAD commit: 6c7cc801274c55a47ba8227e24b2d4724302bea1
Found in base branch: master
### Vulnerability Detailslog4js-node is a port of log4js to node.js. In affected versions default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause problems if log files contain sensitive information. This would affect any users that have not supplied their own permissions for the files via the mode parameter in the config. Users are advised to update.
Publish Date: 2022-01-19
URL: CVE-2022-21704
### CVSS 3 Score Details (5.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/log4js-node/log4js-node/security/advisories/GHSA-82v2-mx6x-wq7q
Release Date: 2022-01-19
Fix Resolution: 6.4.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2022-25883
### Vulnerable Library - semver-4.3.6.tgzThe semantic version parser used by npm.
Library home page: https://registry.npmjs.org/semver/-/semver-4.3.6.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/semver/package.json
Dependency Hierarchy: - log4js-0.6.38.tgz (Root Library) - :x: **semver-4.3.6.tgz** (Vulnerable Library)
Found in HEAD commit: 6c7cc801274c55a47ba8227e24b2d4724302bea1
Found in base branch: master
### Vulnerability DetailsVersions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
Publish Date: 2023-06-21
URL: CVE-2022-25883
### CVSS 3 Score Details (5.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
Release Date: 2023-06-21
Fix Resolution (semver): 5.7.2
Direct dependency fix Resolution (log4js): 3.0.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.