search

tz924 / cs116-lab10

0 stars 0 forks source link

concurrently-4.1.2.tgz: 5 vulnerabilities (highest severity is: 9.8) #19

Open mend-bolt-for-github[bot] opened 2 years ago

mend-bolt-for-github[bot] commented 2 years ago
Vulnerable Library - concurrently-4.1.2.tgz

Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentytwenty/package.json

Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/postcss-cli/node_modules/yargs-parser/package.json,/ctf-spring2022/www/wp-content/themes/twentynineteen/node_modules/yargs-parser/package.json,/ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/concurrently/node_modules/yargs-parser/package.json

Found in HEAD commit: 7f949f4f48089e4e1ea7eb0b2482120d3327d7c4

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (concurrently version) Remediation Possible**
CVE-2019-15599 Critical 9.8 tree-kill-1.2.1.tgz Transitive 5.0.0 ❌
CVE-2024-21538 High 7.5 cross-spawn-6.0.5.tgz Transitive N/A* ❌
CVE-2021-3807 High 7.5 ansi-regex-3.0.0.tgz Transitive 5.0.0 ❌
CVE-2021-23362 Medium 5.3 hosted-git-info-2.8.4.tgz Transitive 5.0.0 ❌
CVE-2020-7608 Medium 5.3 yargs-parser-11.1.1.tgz Transitive 5.0.1 ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2019-15599 ### Vulnerable Library - tree-kill-1.2.1.tgz

kill trees of processes

Library home page: https://registry.npmjs.org/tree-kill/-/tree-kill-1.2.1.tgz

Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentytwenty/package.json

Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/tree-kill/package.json

Dependency Hierarchy: - concurrently-4.1.2.tgz (Root Library) - :x: **tree-kill-1.2.1.tgz** (Vulnerable Library)

Found in HEAD commit: 7f949f4f48089e4e1ea7eb0b2482120d3327d7c4

Found in base branch: master

### Vulnerability Details

A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command. Mend Note: Converted from WS-2020-0005, on 2022-11-08.

Publish Date: 2019-12-18

URL: CVE-2019-15599

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/701183

Release Date: 2019-12-18

Fix Resolution (tree-kill): 1.2.2

Direct dependency fix Resolution (concurrently): 5.0.0

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2024-21538 ### Vulnerable Library - cross-spawn-6.0.5.tgz

Cross platform child_process#spawn and child_process#spawnSync

Library home page: https://registry.npmjs.org/cross-spawn/-/cross-spawn-6.0.5.tgz

Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentynineteen/package.json

Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentynineteen/node_modules/cross-spawn/package.json,/ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/webpack-cli/node_modules/cross-spawn/package.json,/ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/eslint/node_modules/cross-spawn/package.json,/ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/execa/node_modules/cross-spawn/package.json

Dependency Hierarchy: - concurrently-4.1.2.tgz (Root Library) - yargs-12.0.5.tgz - os-locale-3.1.0.tgz - execa-1.0.0.tgz - :x: **cross-spawn-6.0.5.tgz** (Vulnerable Library)

Found in HEAD commit: 7f949f4f48089e4e1ea7eb0b2482120d3327d7c4

Found in base branch: master

### Vulnerability Details

Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

Publish Date: 2024-11-08

URL: CVE-2024-21538

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-21538

Release Date: 2024-11-08

Fix Resolution: cross-spawn - 7.0.5

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2021-3807 ### Vulnerable Library - ansi-regex-3.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.0.tgz

Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentytwenty/package.json

Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/string-length/node_modules/ansi-regex/package.json,/ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/string-width/node_modules/ansi-regex/package.json,/ctf-spring2022/www/wp-content/themes/twentynineteen/node_modules/ansi-regex/package.json,/ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/concurrently/node_modules/ansi-regex/package.json,/ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/postcss-cli/node_modules/ansi-regex/package.json

Dependency Hierarchy: - concurrently-4.1.2.tgz (Root Library) - yargs-12.0.5.tgz - string-width-2.1.1.tgz - strip-ansi-4.0.0.tgz - :x: **ansi-regex-3.0.0.tgz** (Vulnerable Library)

Found in HEAD commit: 7f949f4f48089e4e1ea7eb0b2482120d3327d7c4

Found in base branch: master

### Vulnerability Details

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3807

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/

Release Date: 2021-09-17

Fix Resolution (ansi-regex): 3.0.1

Direct dependency fix Resolution (concurrently): 5.0.0

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2021-23362 ### Vulnerable Library - hosted-git-info-2.8.4.tgz

Provides metadata and conversions from repository urls for Github, Bitbucket and Gitlab

Library home page: https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.8.4.tgz

Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentytwenty/package.json

Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/hosted-git-info/package.json

Dependency Hierarchy: - concurrently-4.1.2.tgz (Root Library) - read-pkg-4.0.1.tgz - normalize-package-data-2.5.0.tgz - :x: **hosted-git-info-2.8.4.tgz** (Vulnerable Library)

Found in HEAD commit: 7f949f4f48089e4e1ea7eb0b2482120d3327d7c4

Found in base branch: master

### Vulnerability Details

The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

Publish Date: 2021-03-23

URL: CVE-2021-23362

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-43f8-2h32-f4cj

Release Date: 2021-03-23

Fix Resolution (hosted-git-info): 2.8.9

Direct dependency fix Resolution (concurrently): 5.0.0

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2020-7608 ### Vulnerable Library - yargs-parser-11.1.1.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-11.1.1.tgz

Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentytwenty/package.json

Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/postcss-cli/node_modules/yargs-parser/package.json,/ctf-spring2022/www/wp-content/themes/twentynineteen/node_modules/yargs-parser/package.json,/ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/concurrently/node_modules/yargs-parser/package.json

Dependency Hierarchy: - concurrently-4.1.2.tgz (Root Library) - yargs-12.0.5.tgz - :x: **yargs-parser-11.1.1.tgz** (Vulnerable Library)

Found in HEAD commit: 7f949f4f48089e4e1ea7eb0b2482120d3327d7c4

Found in base branch: master

### Vulnerability Details

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.

Publish Date: 2020-03-16

URL: CVE-2020-7608

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2020-03-16

Fix Resolution (yargs-parser): 13.1.2

Direct dependency fix Resolution (concurrently): 5.0.1

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)