Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 59 vulnerabilities #73

Merged
merged 1 commit into from
Feb 19, 2024
Merged

[Snyk] Fix for 59 vulnerabilities #73

merged 1 commit into from
Feb 19, 2024

Conversation

cniweb
Copy link
Owner

@cniweb cniweb commented Feb 15, 2024

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:

    • package.json
    • package-lock.json

  • Adding or updating a Snyk policy (.snyk) file; this file is required in order to apply Snyk vulnerability patches.
    Find out more.

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Prototype Pollution
SNYK-JS-AJV-584908		 Yes No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 Yes Proof of Concept
high severity /1000
Why?		 Prototype Pollution
SNYK-JS-ASYNC-2441827		 Yes Proof of Concept
high severity /1000
Why?		 Insecure Encryption
SNYK-JS-BCRYPT-572911		 Yes No Known Exploit
medium severity /1000
Why?		 Cryptographic Issues
SNYK-JS-BCRYPT-575033		 Yes Proof of Concept
high severity /1000
Why?		 Denial of Service (DoS)
SNYK-JS-ENGINEIO-3136336		 Yes No Known Exploit
high severity 584/1000
Why? Has a fix available, CVSS 7.4		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-HAWK-2808852		 Yes No Known Exploit
high severity /1000
Why?		 Denial of Service (DoS)
SNYK-JS-HTMLTOTEXT-571464		 Yes No Known Exploit
medium severity 631/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.2		 Missing Release of Resource after Effective Lifetime
SNYK-JS-INFLIGHT-6095116		 Yes Proof of Concept
high severity /1000
Why?		 Prototype Pollution
SNYK-JS-INI-1048974		 Yes Proof of Concept
high severity /1000
Why?		 Prototype Pollution
SNYK-JS-JSONSCHEMA-1920922		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905		 Yes Proof of Concept
high severity 681/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.2		 Command Injection
SNYK-JS-LODASH-1040724		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-450202		 Yes Proof of Concept
high severity /1000
Why?		 Prototype Pollution
SNYK-JS-LODASH-567746		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-608086		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-73638		 Yes Proof of Concept
medium severity 541/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 4.4		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-73639		 Yes Proof of Concept
medium severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-3050818		 Yes No Known Exploit
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Prototype Pollution
SNYK-JS-MINIMIST-2429795		 Yes Proof of Concept
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-MINIMIST-559764		 Yes Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Directory Traversal
SNYK-JS-MOMENT-2440688		 Yes No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MOMENT-2944238		 Yes Proof of Concept
high severity /1000
Why?		 Prototype Pollution
SNYK-JS-MQUERY-1050858		 No Proof of Concept
high severity /1000
Why?		 Command Injection
SNYK-JS-NODEMAILER-1038834		 Yes Proof of Concept
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 HTTP Header Injection
SNYK-JS-NODEMAILER-1296415		 Yes Proof of Concept
medium severity 658/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-NODEMAILER-6219989		 Yes Proof of Concept
medium severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-PATHPARSE-1077067		 Yes Proof of Concept
high severity /1000
Why?		 Remote Code Execution (RCE)
SNYK-JS-PUG-1071616		 Yes Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Prototype Poisoning
SNYK-JS-QS-3153490		 Yes Proof of Concept
medium severity 646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5		 Server-side Request Forgery (SSRF)
SNYK-JS-REQUEST-3361831		 Yes Proof of Concept
high severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795		 Yes Proof of Concept
medium severity /1000
Why?		 Insecure Defaults
SNYK-JS-SOCKETIO-1024859		 Yes Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Denial of Service (DoS)
SNYK-JS-SOCKETIOPARSER-1056752		 Yes Proof of Concept
critical severity 704/1000
Why? Has a fix available, CVSS 9.8		 Improper Input Validation
SNYK-JS-SOCKETIOPARSER-3091012		 Yes No Known Exploit
high severity /1000
Why?		 Arbitrary File Overwrite
SNYK-JS-TAR-1536528		 Yes No Known Exploit
high severity /1000
Why?		 Arbitrary File Overwrite
SNYK-JS-TAR-1536531		 Yes No Known Exploit
low severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-TAR-1536758		 Yes No Known Exploit
high severity /1000
Why?		 Arbitrary File Write
SNYK-JS-TAR-1579147		 Yes No Known Exploit
high severity /1000
Why?		 Arbitrary File Write
SNYK-JS-TAR-1579152		 Yes No Known Exploit
high severity /1000
Why?		 Arbitrary File Write
SNYK-JS-TAR-1579155		 Yes No Known Exploit
medium severity 646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5		 Prototype Pollution
SNYK-JS-TOUGHCOOKIE-5672873		 Yes Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-UGLIFYJS-1727251		 Yes No Known Exploit
medium severity /1000
Why?		 Arbitrary Code Injection
SNYK-JS-UNDERSCORE-1080984		 Yes Proof of Concept
high severity /1000
Why?		 Prototype Pollution
SNYK-JS-UNDERSCOREDEEP-2936792		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-WS-1296835		 Yes Proof of Concept
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:debug:20170905		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
npm:deep-extend:20180409		 Yes Proof of Concept
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Insecure Defaults
npm:engine.io-client:20160426		 No No Known Exploit
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 Prototype Pollution
npm:hoek:20180212		 Yes Proof of Concept
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 Prototype Pollution
npm:lodash:20180130		 Yes Proof of Concept
medium severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
npm:ms:20151024		 Yes No Known Exploit
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:ms:20170412		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
npm:parsejson:20170908		 Yes No Known Exploit
high severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
npm:underscore.string:20170908		 Yes No Known Exploit
medium severity 539/1000
Why? Has a fix available, CVSS 6.5		 Remote Memory Exposure
npm:ws:20160104		 No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Denial of Service (DoS)
npm:ws:20160624		 No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Insecure Randomness
npm:ws:20160920		 No No Known Exploit
high severity 761/1000
Why? Mature exploit, Has a fix available, CVSS 7.5		 Denial of Service (DoS)
npm:ws:20171108		 No Mature

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: bcrypt The new version differs by 193 commits.
  • 2f124bd Fix artifact upload path
  • 10eacf5 Prepare v5.0.1
  • 6eacfe1 Merge pull request #856 from kelektiv/update-deps
  • feb477c Update node-pre-gyp to 1.0.0
  • 42c8b0c Merge pull request #852 from kelektiv/update-deps
  • bafefc3 Update packages
  • 7c5d8df Merge pull request #851 from recrsn/node-15-ci
  • 1ba55f9 Add Node 15 to CI
  • 19c06c1 Update Node version compatibility info
  • 09cb4fc Merge pull request #825 from dogon11/patch-1
  • 2821c03 Merge pull request #811 from techhead/use_buffers
  • 63c8403 Merge pull request #838 from alete89/docs/improve-hash-info
  • 984ef18 remove reference to $2y$ algo identifier
  • 630c897 fixes: #828
  • 0f93284 README.md typo fix
  • 4125ebc Update README.md
  • f503e57 Create SECURITY.md
  • f158e6e Allow optional use of Node Buffers.
  • 8866277 Deploy on any travis tag
  • 61139e6 v5.0.0
  • 1bde62c Update node-pre-gyp to 0.15.0
  • 40770d6 Add NodeJS 14 to appveyor CI
  • 5916a46 Merge pull request #807 from techhead/known_length
  • f28e916 Reword comment

See the full diff

Package name: body-parser The new version differs by 101 commits.

See the full diff

Package name: email-templates The new version differs by 189 commits.

See the full diff

Package name: less-middleware The new version differs by 21 commits.

See the full diff

Package name: mongoose The new version differs by 250 commits.
  • d7fc59c chore: release 5.11.7
  • d318339 fix(index.d.ts): make `Document#id` optional so types that use `id` can use `Model<IMyType & Document>`
  • a9b317a chore: upgrade mquery -> 3.2.3
  • 43f88db fix(document): ensure calling `get()` with empty string returns undefined for mongoose-plugin-autoinc
  • 369efe1 Merge pull request #9692 from sahasayan/patch-4
  • f879c4d chore: update opencollective sponsors
  • 1be4d87 fix(model): set `isNew` to false for documents that were successfully inserted by `insertMany` with `ordered = false` when an error occurred
  • b2da840 test(model): repro #9677
  • 15d6660 fix(index.d.ts): add missing Aggregate#skip() & Aggregate#limit()
  • dd348b1 chore: release 5.11.6
  • 3ec01fa fix(index.d.ts): allow calling `mongoose.model()` and `Connection#model()` with model as generic param
  • ccfa041 Merge pull request #9686 from cjroebuck/patch-1
  • 7a52e45 Merge pull request #9685 from sahasayan/patch-3
  • a5c98c2 Allow array of validators in SchemaTypeOptions
  • 48907ea fix(index.d.ts): allow 2 generic types in mongoose.model function
  • a17a2c3 Merge pull request #9683 from isengartz/master
  • 61595f0 fix(index.d.ts): allow passing ObjectId properties as strings to `create()` and `findOneAndReplace()`
  • 8e20ee6 optional next() parameter for post middleware
  • 8a52485 Merge pull request #9680 from orgads/aggregate
  • 1ef8274 fix(middleware): ensure sync errors in pre hooks always bubble up to the calling code
  • 067e3a2 fix(index.d.ts): Fix return type of Model#aggregate()
  • 0e2058d chore: release 5.11.5
  • 6d9fb4d fix(index.d.ts): add missing `SchemaTypeOpts` and `ConnectionOptions` aliases for backwards compat
  • a85adb9 test: fix tests re: #9669

See the full diff

Package name: nodemailer The new version differs by 172 commits.

See the full diff

Package name: socket.io The new version differs by 250 commits.
  • baa6804 chore(release): 2.5.0
  • f223178 fix: prevent the socket from joining a room after disconnection
  • 226cc16 fix: only set 'connected' to true after middleware execution
  • 05e1278 fix: fix race condition in dynamic namespaces
  • 22d4bdf fix: ignore packet received after disconnection
  • dfded53 chore: update engine.io version to 3.6.0
  • e6b8697 chore(release): 2.4.1
  • a169050 revert: fix(security): do not allow all origins by default
  • 873fdc5 chore(release): 2.4.0
  • f78a575 fix(security): do not allow all origins by default
  • d33a619 fix: properly overwrite the query sent in the handshake
  • 3951a79 chore: bump engine.io version
  • 6fa026f ci: migrate to GitHub Actions
  • 47161a6 [chore] Release 2.3.0
  • cf39362 [chore] Bump socket.io-parser to version 3.4.0
  • 4d01b2c test: remove deprecated Buffer usage (#3481)
  • 8227192 [docs] Fix the default value of the 'origins' parameter (#3464)
  • 1150eb5 [chore] Bump engine.io to version 3.4.0
  • 9c1e73c [chore] Update the license of the chat example (#3410)
  • df05b73 [chore] Release 2.2.0
  • b00ae50 [feat] Add cache-control header when serving the client source (#2907)
  • d3c653d [docs] Add Touch Support to the whiteboard example (#3104)
  • a7fbd1a [fix] Throw an error when trying to access the clients of a dynamic namespace (#3355)
  • 190d22b [chore] Bump dependencies

See the full diff

Package name: socket.io-redis The new version differs by 47 commits.

See the full diff

With a Snyk patch:
Severity Priority Score (*) Issue Exploit Maturity
high severity /1000
Why?		 Prototype Pollution
SNYK-JS-LODASH-567746		 Proof of Concept
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:ms:20170412		 No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Insecure Encryption
🦉 More lessons are available in Snyk Learn

@snyk-bot
fix: package.json, package-lock.json & .snyk to reduce vulnerabilities
f677919 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-AJV-584908
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-ASYNC-2441827
- https://snyk.io/vuln/SNYK-JS-BCRYPT-572911
- https://snyk.io/vuln/SNYK-JS-BCRYPT-575033
- https://snyk.io/vuln/SNYK-JS-ENGINEIO-3136336
- https://snyk.io/vuln/SNYK-JS-HAWK-2808852
- https://snyk.io/vuln/SNYK-JS-HTMLTOTEXT-571464
- https://snyk.io/vuln/SNYK-JS-INFLIGHT-6095116
- https://snyk.io/vuln/SNYK-JS-INI-1048974
- https://snyk.io/vuln/SNYK-JS-JSONSCHEMA-1920922
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-LODASH-450202
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
- https://snyk.io/vuln/SNYK-JS-LODASH-608086
- https://snyk.io/vuln/SNYK-JS-LODASH-73638
- https://snyk.io/vuln/SNYK-JS-LODASH-73639
- https://snyk.io/vuln/SNYK-JS-MINIMATCH-3050818
- https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/SNYK-JS-MOMENT-2440688
- https://snyk.io/vuln/SNYK-JS-MOMENT-2944238
- https://snyk.io/vuln/SNYK-JS-MQUERY-1050858
- https://snyk.io/vuln/SNYK-JS-NODEMAILER-1038834
- https://snyk.io/vuln/SNYK-JS-NODEMAILER-1296415
- https://snyk.io/vuln/SNYK-JS-NODEMAILER-6219989
- https://snyk.io/vuln/SNYK-JS-PATHPARSE-1077067
- https://snyk.io/vuln/SNYK-JS-PUG-1071616
- https://snyk.io/vuln/SNYK-JS-QS-3153490
- https://snyk.io/vuln/SNYK-JS-REQUEST-3361831
- https://snyk.io/vuln/SNYK-JS-SEMVER-3247795
- https://snyk.io/vuln/SNYK-JS-SOCKETIO-1024859
- https://snyk.io/vuln/SNYK-JS-SOCKETIOPARSER-1056752
- https://snyk.io/vuln/SNYK-JS-SOCKETIOPARSER-3091012
- https://snyk.io/vuln/SNYK-JS-TAR-1536528
- https://snyk.io/vuln/SNYK-JS-TAR-1536531
- https://snyk.io/vuln/SNYK-JS-TAR-1536758
- https://snyk.io/vuln/SNYK-JS-TAR-1579147
- https://snyk.io/vuln/SNYK-JS-TAR-1579152
- https://snyk.io/vuln/SNYK-JS-TAR-1579155
- https://snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873
- https://snyk.io/vuln/SNYK-JS-UGLIFYJS-1727251
- https://snyk.io/vuln/SNYK-JS-UNDERSCORE-1080984
- https://snyk.io/vuln/SNYK-JS-UNDERSCOREDEEP-2936792
- https://snyk.io/vuln/SNYK-JS-WS-1296835
- https://snyk.io/vuln/npm:debug:20170905
- https://snyk.io/vuln/npm:deep-extend:20180409
- https://snyk.io/vuln/npm:engine.io-client:20160426
- https://snyk.io/vuln/npm:hoek:20180212
- https://snyk.io/vuln/npm:lodash:20180130
- https://snyk.io/vuln/npm:ms:20151024
- https://snyk.io/vuln/npm:ms:20170412
- https://snyk.io/vuln/npm:parsejson:20170908
- https://snyk.io/vuln/npm:underscore.string:20170908
- https://snyk.io/vuln/npm:ws:20160104
- https://snyk.io/vuln/npm:ws:20160624
- https://snyk.io/vuln/npm:ws:20160920
- https://snyk.io/vuln/npm:ws:20171108


The following vulnerabilities are fixed with a Snyk patch:
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
- https://snyk.io/vuln/npm:ms:20170412
@cniweb cniweb merged commit 27695cb into master Feb 19, 2024
1 of 2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@cniweb @snyk-bot