search

vital-ws / npm-1

0 stars 0 forks source link

express-4.0.0.tgz: 13 vulnerabilities (highest severity is: 7.5) - autoclosed #6

Closed mend-for-github-com[bot] closed 1 year ago

mend-for-github-com[bot] commented 2 years ago
Vulnerable Library - express-4.0.0.tgz

Sinatra inspired web development framework

Library home page: https://registry.npmjs.org/express/-/express-4.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/express/package.json

Found in HEAD commit: 2c6a2a3bfebd356a0f80c5e4c83d4252e0efec2c

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (express version) Remediation Available
WS-2014-0005 High 7.5 qs-0.6.6.tgz Transitive 4.8.0 ✅
CVE-2017-16138 High 7.5 mime-1.2.11.tgz Transitive 4.16.0 ✅
CVE-2014-10064 High 7.5 qs-0.6.6.tgz Transitive 4.8.0 ✅
CVE-2017-16119 High 7.5 detected in multiple dependencies Transitive 4.15.5 ✅
CVE-2014-6394 High 7.3 detected in multiple dependencies Transitive 4.8.8 ✅
CVE-2016-10539 Medium 5.3 negotiator-0.3.0.tgz Transitive 4.14.0 ✅
CVE-2015-8859 Medium 5.3 detected in multiple dependencies Transitive 4.11.1 ✅
CVE-2017-1000048 Medium 5.3 qs-0.6.6.tgz Transitive 4.14.0 ✅
CVE-2017-16137 Medium 5.3 debug-0.8.1.tgz Transitive 4.15.5 ✅
CVE-2014-7191 Medium 5.3 qs-0.6.6.tgz Transitive 4.8.0 ✅
CVE-2016-1000236 Medium 4.4 cookie-signature-1.0.3.tgz Transitive 4.4.5 ✅
CVE-2015-1164 Low 3.7 serve-static-1.0.1.tgz Transitive 4.10.0 ✅
CVE-2014-6393 Low 3.7 express-4.0.0.tgz Direct 4.5.0 ✅

Details

WS-2014-0005 ### Vulnerable Library - qs-0.6.6.tgz

querystring parser

Library home page: https://registry.npmjs.org/qs/-/qs-0.6.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/qs/package.json

Dependency Hierarchy: - express-4.0.0.tgz (Root Library) - :x: **qs-0.6.6.tgz** (Vulnerable Library)

Found in HEAD commit: 2c6a2a3bfebd356a0f80c5e4c83d4252e0efec2c

Found in base branch: main

### Vulnerability Details

Denial-of-Service Extended Event Loop Blocking.The qs module does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time

Publish Date: 2014-07-31

URL: WS-2014-0005

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/WS-2014-0005

Release Date: 2014-07-31

Fix Resolution (qs): 1.0.0

Direct dependency fix Resolution (express): 4.8.0

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2017-16138 ### Vulnerable Library - mime-1.2.11.tgz

A comprehensive library for mime-type mapping

Library home page: https://registry.npmjs.org/mime/-/mime-1.2.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mime/package.json

Dependency Hierarchy: - express-4.0.0.tgz (Root Library) - type-is-1.0.0.tgz - :x: **mime-1.2.11.tgz** (Vulnerable Library)

Found in HEAD commit: 2c6a2a3bfebd356a0f80c5e4c83d4252e0efec2c

Found in base branch: main

### Vulnerability Details

The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.

Publish Date: 2018-06-07

URL: CVE-2017-16138

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16138

Release Date: 2018-06-07

Fix Resolution (mime): 1.4.1

Direct dependency fix Resolution (express): 4.16.0

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2014-10064 ### Vulnerable Library - qs-0.6.6.tgz

querystring parser

Library home page: https://registry.npmjs.org/qs/-/qs-0.6.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/qs/package.json

Dependency Hierarchy: - express-4.0.0.tgz (Root Library) - :x: **qs-0.6.6.tgz** (Vulnerable Library)

Found in HEAD commit: 2c6a2a3bfebd356a0f80c5e4c83d4252e0efec2c

Found in base branch: main

### Vulnerability Details

The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.

Publish Date: 2018-05-31

URL: CVE-2014-10064

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2014-10064

Release Date: 2018-05-31

Fix Resolution (qs): 1.0.0

Direct dependency fix Resolution (express): 4.8.0

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2017-16119 ### Vulnerable Libraries - fresh-0.2.2.tgz, fresh-0.2.0.tgz

### fresh-0.2.2.tgz

HTTP response freshness testing

Library home page: https://registry.npmjs.org/fresh/-/fresh-0.2.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/fresh/package.json

Dependency Hierarchy: - express-4.0.0.tgz (Root Library) - :x: **fresh-0.2.2.tgz** (Vulnerable Library) ### fresh-0.2.0.tgz

HTTP response freshness testing

Library home page: https://registry.npmjs.org/fresh/-/fresh-0.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/serve-static/node_modules/fresh/package.json

Dependency Hierarchy: - express-4.0.0.tgz (Root Library) - serve-static-1.0.1.tgz - send-0.1.4.tgz - :x: **fresh-0.2.0.tgz** (Vulnerable Library)

Found in HEAD commit: 2c6a2a3bfebd356a0f80c5e4c83d4252e0efec2c

Found in base branch: main

### Vulnerability Details

Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.

Publish Date: 2018-06-07

URL: CVE-2017-16119

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/526

Release Date: 2018-06-07

Fix Resolution (fresh): 0.5.2

Direct dependency fix Resolution (express): 4.15.5

Fix Resolution (fresh): 0.5.2

Direct dependency fix Resolution (express): 4.15.5

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2014-6394 ### Vulnerable Libraries - send-0.1.4.tgz, send-0.2.0.tgz

### send-0.1.4.tgz

Better streaming static file server with Range and conditional-GET support

Library home page: https://registry.npmjs.org/send/-/send-0.1.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/serve-static/node_modules/send/package.json

Dependency Hierarchy: - express-4.0.0.tgz (Root Library) - serve-static-1.0.1.tgz - :x: **send-0.1.4.tgz** (Vulnerable Library) ### send-0.2.0.tgz

Better streaming static file server with Range and conditional-GET support

Library home page: https://registry.npmjs.org/send/-/send-0.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/send/package.json

Dependency Hierarchy: - express-4.0.0.tgz (Root Library) - :x: **send-0.2.0.tgz** (Vulnerable Library)

Found in HEAD commit: 2c6a2a3bfebd356a0f80c5e4c83d4252e0efec2c

Found in base branch: main

### Vulnerability Details

visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory.

Publish Date: 2014-10-08

URL: CVE-2014-6394

### CVSS 3 Score Details (7.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2014-6394

Release Date: 2014-10-08

Fix Resolution (send): 0.8.4

Direct dependency fix Resolution (express): 4.8.8

Fix Resolution (send): 0.8.4

Direct dependency fix Resolution (express): 4.8.8

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2016-10539 ### Vulnerable Library - negotiator-0.3.0.tgz

HTTP content negotiation

Library home page: https://registry.npmjs.org/negotiator/-/negotiator-0.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/negotiator/package.json

Dependency Hierarchy: - express-4.0.0.tgz (Root Library) - accepts-1.0.0.tgz - :x: **negotiator-0.3.0.tgz** (Vulnerable Library)

Found in HEAD commit: 2c6a2a3bfebd356a0f80c5e4c83d4252e0efec2c

Found in base branch: main

### Vulnerability Details

negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.

Publish Date: 2018-05-31

URL: CVE-2016-10539

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/106

Release Date: 2018-05-31

Fix Resolution (negotiator): 0.6.1

Direct dependency fix Resolution (express): 4.14.0

In order to enable automatic remediation, please create workflow rules

CVE-2015-8859 ### Vulnerable Libraries - send-0.1.4.tgz, send-0.2.0.tgz

### send-0.1.4.tgz

Better streaming static file server with Range and conditional-GET support

Library home page: https://registry.npmjs.org/send/-/send-0.1.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/serve-static/node_modules/send/package.json

Dependency Hierarchy: - express-4.0.0.tgz (Root Library) - serve-static-1.0.1.tgz - :x: **send-0.1.4.tgz** (Vulnerable Library) ### send-0.2.0.tgz

Better streaming static file server with Range and conditional-GET support

Library home page: https://registry.npmjs.org/send/-/send-0.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/send/package.json

Dependency Hierarchy: - express-4.0.0.tgz (Root Library) - :x: **send-0.2.0.tgz** (Vulnerable Library)

Found in HEAD commit: 2c6a2a3bfebd356a0f80c5e4c83d4252e0efec2c

Found in base branch: main

### Vulnerability Details

The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.

Publish Date: 2017-01-23

URL: CVE-2015-8859

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-8859

Release Date: 2017-01-23

Fix Resolution (send): 0.11.1

Direct dependency fix Resolution (express): 4.11.1

Fix Resolution (send): 0.11.1

Direct dependency fix Resolution (express): 4.11.1

In order to enable automatic remediation, please create workflow rules

CVE-2017-1000048 ### Vulnerable Library - qs-0.6.6.tgz

querystring parser

Library home page: https://registry.npmjs.org/qs/-/qs-0.6.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/qs/package.json

Dependency Hierarchy: - express-4.0.0.tgz (Root Library) - :x: **qs-0.6.6.tgz** (Vulnerable Library)

Found in HEAD commit: 2c6a2a3bfebd356a0f80c5e4c83d4252e0efec2c

Found in base branch: main

### Vulnerability Details

the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.

Publish Date: 2017-07-17

URL: CVE-2017-1000048

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000048

Release Date: 2017-07-17

Fix Resolution (qs): 6.0.4

Direct dependency fix Resolution (express): 4.14.0

In order to enable automatic remediation, please create workflow rules

CVE-2017-16137 ### Vulnerable Library - debug-0.8.1.tgz

small debugging utility

Library home page: https://registry.npmjs.org/debug/-/debug-0.8.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/express/node_modules/debug/package.json

Dependency Hierarchy: - express-4.0.0.tgz (Root Library) - :x: **debug-0.8.1.tgz** (Vulnerable Library)

Found in HEAD commit: 2c6a2a3bfebd356a0f80c5e4c83d4252e0efec2c

Found in base branch: main

### Vulnerability Details

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Publish Date: 2018-06-07

URL: CVE-2017-16137

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-16137

Release Date: 2018-06-07

Fix Resolution (debug): 2.6.9

Direct dependency fix Resolution (express): 4.15.5

In order to enable automatic remediation, please create workflow rules

CVE-2014-7191 ### Vulnerable Library - qs-0.6.6.tgz

querystring parser

Library home page: https://registry.npmjs.org/qs/-/qs-0.6.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/qs/package.json

Dependency Hierarchy: - express-4.0.0.tgz (Root Library) - :x: **qs-0.6.6.tgz** (Vulnerable Library)

Found in HEAD commit: 2c6a2a3bfebd356a0f80c5e4c83d4252e0efec2c

Found in base branch: main

### Vulnerability Details

The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.

Publish Date: 2014-10-19

URL: CVE-2014-7191

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2014-7191

Release Date: 2014-10-19

Fix Resolution (qs): 1.0.0

Direct dependency fix Resolution (express): 4.8.0

In order to enable automatic remediation, please create workflow rules

CVE-2016-1000236 ### Vulnerable Library - cookie-signature-1.0.3.tgz

Sign and unsign cookies

Library home page: https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/cookie-signature/package.json

Dependency Hierarchy: - express-4.0.0.tgz (Root Library) - :x: **cookie-signature-1.0.3.tgz** (Vulnerable Library)

Found in HEAD commit: 2c6a2a3bfebd356a0f80c5e4c83d4252e0efec2c

Found in base branch: main

### Vulnerability Details

Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.

Publish Date: 2019-11-19

URL: CVE-2016-1000236

### CVSS 3 Score Details (4.4)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: High - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-92vm-wfm5-mxvv

Release Date: 2019-11-19

Fix Resolution (cookie-signature): 1.0.4

Direct dependency fix Resolution (express): 4.4.5

In order to enable automatic remediation, please create workflow rules

CVE-2015-1164 ### Vulnerable Library - serve-static-1.0.1.tgz

Serve static files

Library home page: https://registry.npmjs.org/serve-static/-/serve-static-1.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/serve-static/package.json

Dependency Hierarchy: - express-4.0.0.tgz (Root Library) - :x: **serve-static-1.0.1.tgz** (Vulnerable Library)

Found in HEAD commit: 2c6a2a3bfebd356a0f80c5e4c83d4252e0efec2c

Found in base branch: main

### Vulnerability Details

Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the PATH_INFO to the default URI.

Publish Date: 2015-01-21

URL: CVE-2015-1164

### CVSS 3 Score Details (3.7)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-1164

Release Date: 2015-01-21

Fix Resolution (serve-static): 1.7.2

Direct dependency fix Resolution (express): 4.10.0

In order to enable automatic remediation, please create workflow rules

CVE-2014-6393 ### Vulnerable Library - express-4.0.0.tgz

Sinatra inspired web development framework

Library home page: https://registry.npmjs.org/express/-/express-4.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/express/package.json

Dependency Hierarchy: - :x: **express-4.0.0.tgz** (Vulnerable Library)

Found in HEAD commit: 2c6a2a3bfebd356a0f80c5e4c83d4252e0efec2c

Found in base branch: main

### Vulnerability Details

The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via characters in a non-standard encoding.

Publish Date: 2017-08-09

URL: CVE-2014-6393

### CVSS 3 Score Details (3.7)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6393

Release Date: 2017-08-09

Fix Resolution: 4.5.0

In order to enable automatic remediation, please create workflow rules

:rescue_worker_helmet: Automatic Remediation is available for this issue.

mend-for-github-com[bot] commented 1 year ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.