Open mend-for-github-com[bot] opened 2 years ago
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
Vulnerable Library - express-4.13.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /vulnerable-node-master/node_modules/fresh/package.json,/node_modules/fresh/package.json
Found in HEAD commit: c80902d8d16e96120b727551e8d6b5f0174fe207
Vulnerabilities
Details
CVE-2016-10539
### Vulnerable Library - negotiator-0.5.3.tgzHTTP content negotiation
Library home page: https://registry.npmjs.org/negotiator/-/negotiator-0.5.3.tgz
Path to dependency file: /vulnerable-node-master/package.json
Path to vulnerable library: /vulnerable-node-master/node_modules/negotiator/package.json,/node_modules/negotiator/package.json
Dependency Hierarchy: - express-4.13.4.tgz (Root Library) - accepts-1.2.13.tgz - :x: **negotiator-0.5.3.tgz** (Vulnerable Library)
Found in HEAD commit: c80902d8d16e96120b727551e8d6b5f0174fe207
Found in base branch: master
### Vulnerability Detailsnegotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.
Publish Date: 2018-05-31
URL: CVE-2016-10539
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.npmjs.com/advisories/106
Release Date: 2018-05-31
Fix Resolution (negotiator): 0.6.1
Direct dependency fix Resolution (express): 4.14.0
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2017-16138
### Vulnerable Library - mime-1.3.4.tgzA comprehensive library for mime-type mapping
Library home page: https://registry.npmjs.org/mime/-/mime-1.3.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/mime/package.json,/vulnerable-node-master/node_modules/mime/package.json
Dependency Hierarchy: - express-4.13.4.tgz (Root Library) - send-0.13.1.tgz - :x: **mime-1.3.4.tgz** (Vulnerable Library)
Found in HEAD commit: c80902d8d16e96120b727551e8d6b5f0174fe207
Found in base branch: master
### Vulnerability DetailsThe mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.
Publish Date: 2018-06-07
URL: CVE-2017-16138
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16138
Release Date: 2018-06-07
Fix Resolution (mime): 1.4.1
Direct dependency fix Resolution (express): 4.16.0
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2017-16119
### Vulnerable Library - fresh-0.3.0.tgzHTTP response freshness testing
Library home page: https://registry.npmjs.org/fresh/-/fresh-0.3.0.tgz
Path to dependency file: /vulnerable-node-master/package.json
Path to vulnerable library: /vulnerable-node-master/node_modules/fresh/package.json,/node_modules/fresh/package.json
Dependency Hierarchy: - express-4.13.4.tgz (Root Library) - :x: **fresh-0.3.0.tgz** (Vulnerable Library)
Found in HEAD commit: c80902d8d16e96120b727551e8d6b5f0174fe207
Found in base branch: master
### Vulnerability DetailsFresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
Publish Date: 2018-06-07
URL: CVE-2017-16119
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.npmjs.com/advisories/526
Release Date: 2018-06-07
Fix Resolution (fresh): 0.5.2
Direct dependency fix Resolution (express): 4.15.5
:rescue_worker_helmet: Automatic Remediation is available for this issue:rescue_worker_helmet: Automatic Remediation is available for this issue.