Bulk vulnerability fix - Lockfile fix

[debricked]

Bulk vulnerability fix - Lockfile fix

This pull request will update your transitive dependencies within the allowed version intervals provided by your direct dependencies.

Fixed vulnerabilities:

CVE–2021–23343

• Description

  NVD

  All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

  GitHub

  Regular Expression Denial of Service in path-parse

  Affected versions of npm package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

• CVSS details - 7.5

   

  CVSS3 metrics
  Attack Vector	Network
  Attack Complexity	Low
  Privileges Required	None
  User interaction	None
  Scope	Unchanged
  Confidentiality	None
  Integrity	None
  Availability	High

• References

      ReDoS in path-parse · Issue #8 · jbgutierrez/path-parse · GitHub
      Pony Mail!
      fixed regexes to avoid ReDoS attacks by jeffrey-pinyan-ithreat · Pull Request #10 · jbgutierrez/path-parse · GitHub
      NVD - CVE-2021-23343
      Regular Expression Denial of Service in path-parse · CVE-2021-23343 · GitHub Advisory Database · GitHub

CVE–2021–23364

• Description

  GitHub

  Regular Expression Denial of Service in browserslist

  The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

  NVD

  The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

• CVSS details - 5.3

   

  CVSS3 metrics
  Attack Vector	Network
  Attack Complexity	Low
  Privileges Required	None
  User interaction	None
  Scope	Unchanged
  Confidentiality	None
  Integrity	None
  Availability	Low

• References

      THIRD PARTY
      Regular Expression Denial of Service in browserslist · CVE-2021-23364 · GitHub Advisory Database · GitHub
      Fix unsafe regexp · browserslist/browserslist@c091916 · GitHub
      Fix ReDoS by yetingli · Pull Request #593 · browserslist/browserslist · GitHub
      MISC
      browserslist/index.js at e82f32d1d4100d6bc79ea0b6b6a2d281a561e33c · browserslist/browserslist · GitHub

CVE–2021–23362

• Description

  GitHub

  Regular Expression Denial of Service in hosted-git-info

  The npm package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity

  NVD

  The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

• CVSS details - 5.3

   

  CVSS3 metrics
  Attack Vector	Network
  Attack Complexity	Low
  Privileges Required	None
  User interaction	None
  Scope	Unchanged
  Confidentiality	None
  Integrity	None
  Availability	Low

• References

      Commits · npm/hosted-git-info · GitHub
      fix: backport regex fix from #76 · npm/hosted-git-info@29adfe5 · GitHub
      chore(release): 2.8.9 · npm/hosted-git-info@8d4b369 · GitHub
      THIRD PARTY
      Regular Expression Denial of Service in hosted-git-info · CVE-2021-23362 · GitHub Advisory Database · GitHub
      fix: simplify the regular expression for shortcut matching · npm/hosted-git-info@bede0dc · GitHub

CVE–2020–7597

• Description

  Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

  The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

  GitHub

  codecov NPM module allows remote attackers to execute arbitrary commands

  codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596.

  NVD

  codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596.

• CVSS details - 8.8

   

  CVSS3 metrics
  Attack Vector	Network
  Attack Complexity	Low
  Privileges Required	Low
  User interaction	None
  Scope	Unchanged
  Confidentiality	High
  Integrity	High
  Availability	High

• References

      NVD - CVE-2020-7597
      [CE-1330] Escaping args (#167) · codecov/codecov-node@02cf13d · GitHub
      codecov NPM module allows remote attackers to execute arbitrary commands · CVE-2020-7597 · GitHub Advisory Database · GitHub

CVE–2020–15123

• Description

  Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

  The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

  GitHub

  Command injection in codecov (npm package)

  Impact

  The upload method has a command injection vulnerability. Clients of the codecov-node library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.

  A similar CVE was issued: CVE-2020-7597, but the fix was incomplete. It only blocked &, and command injection is still possible using backticks instead to bypass the sanitizer.

  We have written a CodeQL query, which automatically detects this vulnerability. You can see the results of the query on the codecov-node project here.

  Patches

  This has been patched in version 3.7.1

  Workarounds

  None, however, the attack surface is low in this case. Particularly in the standard use of codecov, where the module is used directly in a build pipeline, not built against as a library in another application that may supply malicious input and perform command injection.

  References

  • CVE-2020-7597

  For more information

  If you have any questions or comments about this advisory:

  • Contact us via our Security Email

  NVD

  In codecov (npm package) before version 3.7.1 the upload method has a command injection vulnerability. Clients of the codecov-node library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. A similar CVE (CVE-2020-7597 for GHSA-5q88-cjfq-g2mh) was issued but the fix was incomplete. It only blocked &, and command injection is still possible using backticks instead to bypass the sanitizer. The attack surface is low in this case. Particularly in the standard use of codecov, where the module is used directly in a build pipeline, not built against as a library in another application that may supply malicious input and perform command injection.

• CVSS details - 9.3

   

  CVSS3 metrics
  Attack Vector	Network
  Attack Complexity	Low
  Privileges Required	None
  User interaction	Required
  Scope	Changed
  Confidentiality	High
  Integrity	High
  Availability	None

• References

      THIRD PARTY
      codecov NPM module allows remote attackers to execute arbitrary commands · CVE-2020-7597 · GitHub Advisory Database · GitHub
      Switch from execSync to execFileSync (#180) · codecov/codecov-node@c0711c6 · GitHub
      Switch from execSync to execFileSync by drazisil · Pull Request #180 · codecov/codecov-node · GitHub
      Command injection in upload method · Advisory · codecov/codecov-node · GitHub
      LGTM
      Command injection in codecov (npm package) · CVE-2020-15123 · GitHub Advisory Database · GitHub

CVE–2019–20149

• Description

  Exposure of Resource to Wrong Sphere

  The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

  GitHub

  Validation Bypass in kind-of

  Versions of kind-of 6.x prior to 6.0.3 are vulnerable to a Validation Bypass. A maliciously crafted object can alter the result of the type check, allowing attackers to bypass the type checking validation.

  Recommendation

  Upgrade to versions 6.0.3 or later.

  NVD

  ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

• CVSS details - 7.5

   

  CVSS3 metrics
  Attack Vector	Network
  Attack Complexity	Low
  Privileges Required	None
  User interaction	None
  Scope	Unchanged
  Confidentiality	None
  Integrity	High
  Availability	None

• References

      Validation Bypass in kind-of · CVE-2019-20149 · GitHub Advisory Database · GitHub
      THIRD PARTY
      type checking · Issue #30 · jonschlinkert/kind-of · GitHub
      fix type checking vul in ctorName by xiaofen9 · Pull Request #31 · jonschlinkert/kind-of · GitHub

CVE–2019–10747

• Description

  Uncontrolled Resource Consumption

  The software does not properly control the allocation and maintenance of a limited resource thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

  GitHub

  Prototype Pollution in set-value

  Versions of set-value prior to 3.0.1 or 2.0.1 are vulnerable to Prototype Pollution. The set function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.

  Recommendation

  If you are using set-value 3.x, upgrade to version 3.0.1 or later.
  If you are using set-value 2.x, upgrade to version 2.0.1 or later.

  NVD

  set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads.

• CVSS details - 9.8

   

  CVSS3 metrics
  Attack Vector	Network
  Attack Complexity	Low
  Privileges Required	None
  User interaction	None
  Scope	Unchanged
  Confidentiality	High
  Integrity	High
  Availability	High

• References

      Prototype Pollution in set-value · CVE-2019-10747 · GitHub Advisory Database · GitHub
      NVD - CVE-2019-10747
      Pony Mail!
      [SECURITY] Fedora 30 Update: nodejs-set-value-2.0.1-1.fc30 - package-announce - Fedora Mailing-Lists
      [SECURITY] Fedora 31 Update: nodejs-set-value-2.0.1-1.fc31 - package-announce - Fedora Mailing-Lists
      disallow proto keys · jonschlinkert/set-value@95e9d99 · GitHub
      GitHub - jonschlinkert/set-value: Set nested properties on an object using dot-notation.

CVE–2021–32640

• Description

  Uncontrolled Resource Consumption

  The software does not properly control the allocation and maintenance of a limited resource thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

  GitHub

  ReDoS in Sec-Websocket-Protocol header

  Impact

  A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server.

  Proof of concept

  for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
    const value = 'b' + ' '.repeat(length) + 'x';
    const start = process.hrtime.bigint();
  
    value.trim().split(/ *, */);
  
    const end = process.hrtime.bigint();
  
    console.log('length = %d, time = %f ns', length, end - start);
  }

  Patches

  The vulnerability was fixed in ws@7.4.6 (websockets/ws@00c425e) and backported to ws@6.2.2 (websockets/ws@78c676d) and ws@5.2.3 (websockets/ws@76d47c1).

  Workarounds

  In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.

  Credits

  The vulnerability was responsibly disclosed along with a fix in private by Robert McLaughlin from University of California, Santa Barbara.

  NVD

  ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server. The vulnerability has been fixed in ws@7.4.6 (websockets/ws@00c425e). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.

• CVSS details - 5.3

   

  CVSS3 metrics
  Attack Vector	Network
  Attack Complexity	Low
  Privileges Required	None
  User interaction	None
  Scope	Unchanged
  Confidentiality	None
  Integrity	None
  Availability	Low

• References

      THIRD PARTY
      ReDoS in Sec-Websocket-Protocol header · CVE-2021-32640 · GitHub Advisory Database · GitHub
      ReDoS in Sec-Websocket-Protocol header · Advisory · websockets/ws · GitHub
      [security] Fix ReDoS vulnerability · websockets/ws@00c425e · GitHub
      Pony Mail!

CVE–2019–16769

• Description

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

  GitHub

  Cross-Site Scripting in serialize-javascript

  Versions of serialize-javascript prior to 2.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize serialized regular expressions. This vulnerability does not affect Node.js applications.

  Recommendation

  Upgrade to version 2.1.1 or later.

  NVD

  The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.

• CVSS details - 5.4

   

  CVSS3 metrics
  Attack Vector	Network
  Attack Complexity	Low
  Privileges Required	Low
  User interaction	Required
  Scope	Changed
  Confidentiality	Low
  Integrity	Low
  Availability	None

• References

      Cross-Site Scripting in serialize-javascript · CVE-2019-16769 · GitHub Advisory Database · GitHub
      NVD - CVE-2019-16769
      regular expressions Cross-Site Scripting (XSS) vulnerability · Advisory · yahoo/serialize-javascript · GitHub

CVE–2020–7660

• Description

  Deserialization of Untrusted Data

  The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

  GitHub

  Insecure serialization leading to RCE in serialize-javascript

  serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".

  An object such as {"foo": /1"/, "bar": "a\"@__R-<UID>-0__@"} was serialized as {"foo": /1"/, "bar": "a\/1"/}, which allows an attacker to escape the bar key. This requires the attacker to control the values of both foo and bar and guess the value of <UID>. The UID has a keyspace of approximately 4 billion making it a realistic network attack.

  The following proof-of-concept calls console.log() when the running eval():
  eval('('+ serialize({"foo": /1" + console.log(1)/i, "bar": '"@__R-<UID>-0__@'}) + ')');

  NVD

  serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".

• CVSS details - 8.1

   

  CVSS3 metrics
  Attack Vector	Network
  Attack Complexity	High
  Privileges Required	None
  User interaction	None
  Scope	Unchanged
  Confidentiality	High
  Integrity	High
  Availability	High

• References

      Insecure serialization leading to RCE in serialize-javascript · CVE-2020-7660 · GitHub Advisory Database · GitHub
      Don't replace regex / function placeholders within string literals (#79) · yahoo/serialize-javascript@f21a6fb · GitHub
      NVD - CVE-2020-7660

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more at Debricked