jest-cli-22.4.4.tgz: 7 vulnerabilities (highest severity is: 9.8) #21
Labels
Mend: dependency security vulnerability
Security vulnerability detected by Mend
Comments
dev-mend-for-github-com
bot
added
the
Mend: dependency security vulnerability
dev-mend-for-github-com
bot
changed the title
dev-mend-for-github-com
bot
changed the title
dev-mend-for-github-com
bot
changed the title
dev-mend-for-github-com
bot
changed the title
dev-mend-for-github-com
bot
changed the title
dev-mend-for-github-com
bot
changed the title
dev-mend-for-github-com
bot
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Path to dependency file: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/package.json
Path to vulnerable library: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/node_modules/yargs-parser/package.json,/npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/node_modules/yargs-parser/package.json
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - inherits-2.0.4.tgz
Browser-friendly inheritance fully compatible with standard node.js inherits()
Library home page: https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
Created automatically by the test suite
Publish Date: 2010-06-07
URL: CVE-289561-266276
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Vulnerable Library - merge-1.2.1.tgz
Merge multiple objects into one, optionally creating a new cloned object. Similar to the jQuery.extend but more flexible. Works in Node.js and the browser.
Library home page: https://registry.npmjs.org/merge/-/merge-1.2.1.tgz
Path to dependency file: /npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/package.json
Path to vulnerable library: /npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/node_modules/merge/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/node_modules/merge/package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
A Prototype Pollution vulnerability was found in merge before 2.1.0 via the merge.recursive function. It can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects.
Publish Date: 2020-10-09
URL: WS-2020-0218
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2020-10-09
Fix Resolution (merge): 2.1.0
Direct dependency fix Resolution (jest-cli): 24.0.0
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Libraries - braces-2.3.2.tgz, braces-1.8.5.tgz
braces-2.3.2.tgz
Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.
Library home page: https://registry.npmjs.org/braces/-/braces-2.3.2.tgz
Path to dependency file: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/package.json
Path to vulnerable library: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/node_modules/readdirp/node_modules/braces/package.json,/npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/node_modules/readdirp/node_modules/braces/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/node_modules/sane/node_modules/braces/package.json,/npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/node_modules/sane/node_modules/braces/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json
Dependency Hierarchy:
braces-1.8.5.tgz
Fastest brace expansion for node.js, with the most complete support for the Bash 4.3 braces specification.
Library home page: https://registry.npmjs.org/braces/-/braces-1.8.5.tgz
Path to dependency file: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/package.json
Path to vulnerable library: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/node_modules/braces/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/pnpm/lockfile_only_change/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/lockfile_only_change/node_modules/braces/package.json,/updater/vendor/cache/npm_and_yarn/helpers/node_modules/braces/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/node_modules/braces/package.json,/npm_and_yarn/spec/fixtures/projects/yarn/lockfile_only_change/node_modules/braces/package.json,/npm_and_yarn/helpers/node_modules/braces/package.json,/npm_and_yarn/spec/fixtures/projects/pnpm/lockfile_only_change/package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
The NPM package
braces, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. Inlib/parse.js,if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.Publish Date: 2024-05-13
URL: CVE-2024-4068
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2024-05-13
Fix Resolution: braces - 3.0.3
Vulnerable Library - json5-0.5.1.tgz
JSON for the ES5 era.
Library home page: https://registry.npmjs.org/json5/-/json5-0.5.1.tgz
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The
parsemethod of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named__proto__, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned byJSON5.parseand not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned fromJSON5.parse. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution.JSON5.parseshould restrict parsing of__proto__keys when parsing JSON strings to objects. As a point of reference, theJSON.parsemethod included in JavaScript ignores__proto__keys. Simply changingJSON5.parsetoJSON.parsein the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.Publish Date: 2022-12-24
URL: CVE-2022-46175
CVSS 3 Score Details (7.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175
Release Date: 2022-12-24
Fix Resolution (json5): 1.0.2
Direct dependency fix Resolution (jest-cli): 24.0.0
Vulnerable Library - request-2.88.2.tgz
Simplified HTTP request client.
Library home page: https://registry.npmjs.org/request/-/request-2.88.2.tgz
Path to dependency file: /npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/package.json
Path to vulnerable library: /npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/node_modules/request/package.json,/updater/vendor/cache/npm_and_yarn/helpers/node_modules/npm/node_modules/request/package.json,/updater/vendor/cache/npm_and_yarn/helpers/node_modules/request/package.json,/npm_and_yarn/helpers/node_modules/npm/node_modules/request/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/node_modules/request/package.json,/npm_and_yarn/helpers/node_modules/request/package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Publish Date: 2023-03-16
URL: CVE-2023-28155
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Vulnerable Library - yargs-parser-8.1.0.tgz
the mighty option parser used by yargs
Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-8.1.0.tgz
Path to dependency file: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/package.json
Path to vulnerable library: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/node_modules/yargs-parser/package.json,/npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/node_modules/yargs-parser/package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.
Publish Date: 2020-03-16
URL: CVE-2020-7608
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2020-03-16
Fix Resolution (yargs-parser): 13.1.2
Direct dependency fix Resolution (jest-cli): 24.9.0
⛑️ Automatic Remediation will be attempted for this issue.
Vulnerable Library - mem-1.1.0.tgz
Memoize functions - An optimization used to speed up consecutive function calls by caching the result of calls with identical input
Library home page: https://registry.npmjs.org/mem/-/mem-1.1.0.tgz
Path to dependency file: /npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/package.json
Path to vulnerable library: /npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/node_modules/mem/package.json,/npm_and_yarn/spec/fixtures/projects/yarn/lockfile_only_change/node_modules/mem/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/lockfile_only_change/node_modules/mem/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/dist_tag/node_modules/npm/node_modules/libnpx/node_modules/yargs/node_modules/os-locale/node_modules/mem/package.json,/npm_and_yarn/spec/fixtures/projects/yarn/dist_tag/node_modules/npm/node_modules/libnpx/node_modules/yargs/node_modules/os-locale/node_modules/mem/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/node_modules/mem/package.json
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
In 'mem' before v4.0.0 there is a Denial of Service (DoS) vulnerability as a result of a failure in removal old values from the cache.
Publish Date: 2018-08-27
URL: WS-2019-0307
CVSS 3 Score Details (5.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1084
Release Date: 2018-08-27
Fix Resolution (mem): 4.0.0
Direct dependency fix Resolution (jest-cli): 23.0.0-charlie.0
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.
The text was updated successfully, but these errors were encountered: