Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk-dev] Fix for 32 vulnerabilities #3526

Closed
wants to merge 1 commit into from
Closed

[Snyk-dev] Fix for 32 vulnerabilities #3526

wants to merge 1 commit into from

Conversation

swinton
Copy link
Contributor

@swinton swinton commented Aug 2, 2022

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • test/fixtures/demo-os/package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-AWSSDK-1059424		 Yes Proof of Concept
high severity 706/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.7		 Remote Memory Exposure
SNYK-JS-BL-608877		 No Proof of Concept
high severity 671/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7		 Remote Code Execution (RCE)
SNYK-JS-HANDLEBARS-1056767		 Yes Proof of Concept
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-HANDLEBARS-1279029		 Yes Proof of Concept
high severity 579/1000
Why? Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-HANDLEBARS-173692		 Yes No Known Exploit
medium severity 646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5		 Prototype Pollution
SNYK-JS-HANDLEBARS-567742		 Yes Proof of Concept
high severity 584/1000
Why? Has a fix available, CVSS 7.4		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-HAWK-2808852		 No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-JSBEAUTIFY-2311652		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905		 No Proof of Concept
high severity 681/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.2		 Command Injection
SNYK-JS-LODASH-1040724		 No Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-450202		 No Proof of Concept
high severity 731/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.2		 Prototype Pollution
SNYK-JS-LODASH-567746		 No Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-608086		 No Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-73638		 No Proof of Concept
medium severity 541/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 4.4		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-73639		 No Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-1019388		 Yes No Known Exploit
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Prototype Pollution
SNYK-JS-MINIMIST-2429795		 No Proof of Concept
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-MINIMIST-559764		 No Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-UGLIFYJS-1727251		 Yes No Known Exploit
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:debug:20170905		 No No Known Exploit
high severity 579/1000
Why? Has a fix available, CVSS 7.3		 Prototype Pollution
npm:extend:20180424		 No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Cross-site Scripting (XSS)
npm:handlebars:20151207		 Yes No Known Exploit
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:hawk:20160119		 No No Known Exploit
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 Prototype Pollution
npm:hoek:20180212		 No Proof of Concept
medium severity 539/1000
Why? Has a fix available, CVSS 6.5		 Timing Attack
npm:http-signature:20150122		 No No Known Exploit
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 Prototype Pollution
npm:lodash:20180130		 No Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
npm:minimatch:20160620		 Yes No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
npm:ms:20151024		 No No Known Exploit
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:ms:20170412		 No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
npm:negotiator:20160616		 No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Prototype Override Protection Bypass
npm:qs:20170213		 No No Known Exploit
medium severity 576/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.1		 Uninitialized Memory Exposure
npm:tunnel-agent:20170305		 No Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: body-parser The new version differs by 197 commits.
  • b2659a7 1.18.2
  • 6339bf7 perf: remove argument reassignment
  • d5f9a4a deps: debug@2.6.9
  • d041563 1.18.1
  • 9efa9ab deps: content-type@~1.0.4
  • f1ef6cc deps: qs@6.5.1
  • e438db5 deps: raw-body@2.3.2
  • 15c3585 deps: iconv-lite@0.4.19
  • adfa01c 1.18.0
  • 0632e2f Include the "type" property on all generated errors
  • b8f97cd Include the "body" property on verify errors
  • c659e8a tests: add test for err.body on json parse error
  • 4e15325 tests: reorganize json error tests
  • 5bd7ed5 tests: reorganize json strict option tests
  • 3cb380b tests: store server on mocha context instead of variable shadowing
  • 29c8cd0 docs: document too many parameters error
  • 7b9cb14 Use http-errors to set status code on errors
  • 29a27f1 docs: fix typo in jsdoc comment
  • 448dc57 Fix JSON strict violation error to match native parse error
  • 87df7e6 tests: add leading whitespace strict json test
  • 1841248 deps: raw-body@2.3.1
  • e666dbe deps: http-errors@~1.6.2
  • c2a110a deps: bytes@3.0.0
  • a1a2e31 build: Node.js@8.4

See the full diff

Package name: bookshelf The new version differs by 250 commits.

See the full diff

Package name: compression The new version differs by 117 commits.

See the full diff

Package name: cookie-session The new version differs by 43 commits.

See the full diff

Package name: glob The new version differs by 76 commits.
  • 3a7e71d v5.0.15
  • 841fda0 use latest minimatch
  • 4ba54a8 Skip some tests on Windows, make others pass
  • 3936e1e Build: Add build for node v4
  • c47d451 v5.0.14
  • 821fac8 Handle ENOTSUP for sync glob as well as async
  • 9625618 Test for when readdir raises ENOTSUP
  • 0a2b519 Generate fixtures more effectively, with -O instead of eval
  • f96190b Use js for benchmark cleanup
  • 957fd93 Fix some 'use strict' errors
  • bf3381e Treat ENOTSUP like ENOTDIR in readdir
  • 507733d v5.0.13
  • f5878af Do not emit 'match' events for ignored items
  • 9439afd v5.0.12
  • 6071f3a Revert "Use graceful-fs if available"
  • 38ff16c v5.0.11
  • f09292b Use graceful-fs if available
  • 4f39b60 Remove duplicate option description
  • e3cdccc v5.0.10
  • 480da05 ignore .nyc_output, upgrade tap, use coverage, rm fixtures
  • 155124b add more sync cb thrower tests
  • f7302ca Test base-matching
  • 7530e88 v5.0.9
  • b185987 reduce cases where tests need to be regenerated

See the full diff

Package name: request The new version differs by 250 commits.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Remote Code Execution (RCE)
🦉 Prototype Pollution
🦉 Cross-site Scripting (XSS)
🦉 More lessons are available in Snyk Learn

@snyk-bot
fix: test/fixtures/demo-os/package.json to reduce vulnerabilities
288d891 
The following vulnerabilities are fixed with an upgrade:
- https://dev.snyk.io/vuln/SNYK-JS-AWSSDK-1059424
- https://dev.snyk.io/vuln/SNYK-JS-BL-608877
- https://dev.snyk.io/vuln/SNYK-JS-HANDLEBARS-1056767
- https://dev.snyk.io/vuln/SNYK-JS-HANDLEBARS-1279029
- https://dev.snyk.io/vuln/SNYK-JS-HANDLEBARS-173692
- https://dev.snyk.io/vuln/SNYK-JS-HANDLEBARS-567742
- https://dev.snyk.io/vuln/SNYK-JS-HAWK-2808852
- https://dev.snyk.io/vuln/SNYK-JS-JSBEAUTIFY-2311652
- https://dev.snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://dev.snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://dev.snyk.io/vuln/SNYK-JS-LODASH-450202
- https://dev.snyk.io/vuln/SNYK-JS-LODASH-567746
- https://dev.snyk.io/vuln/SNYK-JS-LODASH-608086
- https://dev.snyk.io/vuln/SNYK-JS-LODASH-73638
- https://dev.snyk.io/vuln/SNYK-JS-LODASH-73639
- https://dev.snyk.io/vuln/SNYK-JS-MINIMATCH-1019388
- https://dev.snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://dev.snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://dev.snyk.io/vuln/SNYK-JS-UGLIFYJS-1727251
- https://dev.snyk.io/vuln/npm:debug:20170905
- https://dev.snyk.io/vuln/npm:extend:20180424
- https://dev.snyk.io/vuln/npm:handlebars:20151207
- https://dev.snyk.io/vuln/npm:hawk:20160119
- https://dev.snyk.io/vuln/npm:hoek:20180212
- https://dev.snyk.io/vuln/npm:http-signature:20150122
- https://dev.snyk.io/vuln/npm:lodash:20180130
- https://dev.snyk.io/vuln/npm:minimatch:20160620
- https://dev.snyk.io/vuln/npm:ms:20151024
- https://dev.snyk.io/vuln/npm:ms:20170412
- https://dev.snyk.io/vuln/npm:negotiator:20160616
- https://dev.snyk.io/vuln/npm:qs:20170213
- https://dev.snyk.io/vuln/npm:tunnel-agent:20170305
@swinton swinton requested review from a team as code owners August 2, 2022 20:52
@lili2311 lili2311 closed this Oct 13, 2022
@darscan darscan deleted the snyk-fix-552094d5c12cafcf4e0845ad94f3877d branch January 20, 2023 18:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jonathansantilli jonathansantilli Awaiting requested review from jonathansantilli jonathansantilli was automatically assigned from snyk/snyk-open-source

@robcresswell robcresswell Awaiting requested review from robcresswell robcresswell was automatically assigned from snyk/snyk-open-source

@jk05 jk05 Awaiting requested review from jk05 jk05 was automatically assigned from snyk/snyk-open-source

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@swinton @lili2311 @snyk-bot