Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

@usebruno/app-0.3.0.tgz: 9 vulnerabilities (highest severity is: 8.8) reachable #6

Open
mend-for-github-com bot opened this issue May 27, 2024 · 0 comments
Open

@usebruno/app-0.3.0.tgz: 9 vulnerabilities (highest severity is: 8.8) reachable #6

mend-for-github-com bot opened this issue May 27, 2024 · 0 comments
Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend

Comments

@mend-for-github-com
Copy link

Vulnerable Library - @usebruno/app-0.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/micromatch/package.json

Found in HEAD commit: 1c09e8a668ad72df9daf7b367489d7d5939d13ed

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (@usebruno/app version) Remediation Possible** Reachability
CVE-2024-28849 Medium 6.5 Not Defined 0.0% follow-redirects-1.15.5.tgz Transitive N/A* ❌

Reachable
CVE-2023-45857 Medium 6.5 Not Defined 0.1% axios-0.27.2.tgz Transitive N/A* ❌

Reachable
CVE-2021-23358 High 7.2 Not Defined 1.3000001% underscore-1.6.0.tgz Transitive N/A* ❌

Unreachable
CVE-2023-44270 Medium 5.3 Not Defined 0.1% postcss-8.4.14.tgz Transitive N/A* ❌

Unreachable
CVE-2024-4367 High 8.8 Not Defined 0.0% pdfjs-dist-3.11.174.tgz Transitive N/A* ❌
CVE-2024-4068 High 7.5 Not Defined 0.0% braces-3.0.2.tgz Transitive N/A* ❌
CVE-2024-34342 High 7.1 Not Defined 0.0% react-pdf-7.7.0.tgz Transitive N/A* ❌
CVE-2024-28863 Medium 6.5 Not Defined 0.0% tar-6.2.0.tgz Transitive N/A* ❌
CVE-2024-4067 Medium 5.3 Not Defined 0.0% micromatch-4.0.5.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-28849

Vulnerable Library - follow-redirects-1.15.5.tgz

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • @usebruno/app-0.3.0.tgz (Root Library)
    • posthog-node-2.6.0.tgz
      • axios-0.27.2.tgz
        • ❌ follow-redirects-1.15.5.tgz (Vulnerable Library)

Found in HEAD commit: 1c09e8a668ad72df9daf7b367489d7d5939d13ed

Found in base branch: main

Reachability Analysis

This vulnerability is potentially reachable

@usebruno/app-0.3.0/src/components/Sidebar/GoldenEdition/index.js (Application)
  -> posthog-node-2.6.0/lib/index.cjs.js (Extension)
   -> axios-0.27.2/index.js (Extension)
    -> axios-0.27.2/lib/axios.js (Extension)
     -> axios-0.27.2/lib/defaults/index.js (Extension)
      -> axios-0.27.2/lib/adapters/http.js (Extension)
       -> ❌ follow-redirects-1.15.5/index.js (Vulnerable Component)

Vulnerability Details

follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Publish Date: 2024-03-14

URL: CVE-2024-28849

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cxjh-pqwp-8mfp

Release Date: 2024-03-14

Fix Resolution: follow-redirects - 1.15.6

CVE-2023-45857

Vulnerable Library - axios-0.27.2.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.27.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/posthog-node/node_modules/axios/package.json

Dependency Hierarchy:

  • @usebruno/app-0.3.0.tgz (Root Library)
    • posthog-node-2.6.0.tgz
      • ❌ axios-0.27.2.tgz (Vulnerable Library)

Found in HEAD commit: 1c09e8a668ad72df9daf7b367489d7d5939d13ed

Found in base branch: main

Reachability Analysis

This vulnerability is potentially reachable

@usebruno/app-0.3.0/src/components/Sidebar/GoldenEdition/index.js (Application)
  -> posthog-node-2.6.0/lib/index.cjs.js (Extension)
   -> axios-0.27.2/index.js (Extension)
    -> axios-0.27.2/lib/axios.js (Extension)
     -> axios-0.27.2/lib/defaults/index.js (Extension)
      -> ❌ axios-0.27.2/lib/adapters/xhr.js (Vulnerable Component)

Vulnerability Details

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

Publish Date: 2023-11-08

URL: CVE-2023-45857

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-11-08

Fix Resolution: axios - 1.6.0

CVE-2021-23358

Vulnerable Library - underscore-1.6.0.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/underscore/package.json

Dependency Hierarchy:

  • @usebruno/app-0.3.0.tgz (Root Library)
    • jsonlint-1.6.3.tgz
      • nomnom-1.8.1.tgz
        • ❌ underscore-1.6.0.tgz (Vulnerable Library)

Found in HEAD commit: 1c09e8a668ad72df9daf7b367489d7d5939d13ed

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 1.3000001%

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2

CVE-2023-44270

Vulnerable Library - postcss-8.4.14.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-8.4.14.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/next/node_modules/postcss/package.json

Dependency Hierarchy:

  • @usebruno/app-0.3.0.tgz (Root Library)
    • next-12.3.3.tgz
      • ❌ postcss-8.4.14.tgz (Vulnerable Library)

Found in HEAD commit: 1c09e8a668ad72df9daf7b367489d7d5939d13ed

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.

Publish Date: 2023-09-29

URL: CVE-2023-44270

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-44270

Release Date: 2023-09-29

Fix Resolution: postcss - 8.4.31

CVE-2024-4367

Vulnerable Library - pdfjs-dist-3.11.174.tgz

Library home page: https://registry.npmjs.org/pdfjs-dist/-/pdfjs-dist-3.11.174.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/pdfjs-dist/package.json

Dependency Hierarchy:

  • @usebruno/app-0.3.0.tgz (Root Library)
    • ❌ pdfjs-dist-3.11.174.tgz (Vulnerable Library)

Found in HEAD commit: 1c09e8a668ad72df9daf7b367489d7d5939d13ed

Found in base branch: main

Vulnerability Details

A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

Publish Date: 2024-05-14

URL: CVE-2024-4367

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wgrm-67xf-hhpq

Release Date: 2024-05-14

Fix Resolution: pdfjs-dist - 4.2.67

CVE-2024-4068

Vulnerable Library - braces-3.0.2.tgz

Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.

Library home page: https://registry.npmjs.org/braces/-/braces-3.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/braces/package.json

Dependency Hierarchy:

  • @usebruno/app-0.3.0.tgz (Root Library)
    • codemirror-graphql-1.2.5.tgz
      • graphql-language-service-3.2.5.tgz
        • graphql-language-service-types-1.8.7.tgz
          • graphql-config-4.5.0.tgz
            • json-file-loader-7.4.18.tgz
              • globby-11.1.0.tgz
                • fast-glob-3.3.2.tgz
                  • micromatch-4.0.5.tgz
                    • ❌ braces-3.0.2.tgz (Vulnerable Library)

Found in HEAD commit: 1c09e8a668ad72df9daf7b367489d7d5939d13ed

Found in base branch: main

Vulnerability Details

The NPM package braces, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
Mend Note: After conducting a further research, it was concluded that CVE-2024-4068 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of braces should follow the fix recommendation as noted.

Publish Date: 2024-05-14

URL: CVE-2024-4068

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2024-05-14

Fix Resolution: braces - 3.0.3

CVE-2024-34342

Vulnerable Library - react-pdf-7.7.0.tgz

Library home page: https://registry.npmjs.org/react-pdf/-/react-pdf-7.7.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/react-pdf/package.json

Dependency Hierarchy:

  • @usebruno/app-0.3.0.tgz (Root Library)
    • ❌ react-pdf-7.7.0.tgz (Vulnerable Library)

Found in HEAD commit: 1c09e8a668ad72df9daf7b367489d7d5939d13ed

Found in base branch: main

Vulnerability Details

react-pdf displays PDFs in React apps. If PDF.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. This vulnerability is fixed in 7.7.3 and 8.0.2.

Publish Date: 2024-05-07

URL: CVE-2024-34342

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

CVSS 3 Score Details (7.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-87hq-q4gp-9wr4

Release Date: 2024-05-07

Fix Resolution: react-pdf - 7.7.3,8.0.2

CVE-2024-28863

Vulnerable Library - tar-6.2.0.tgz

Library home page: https://registry.npmjs.org/tar/-/tar-6.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tar/package.json

Dependency Hierarchy:

  • @usebruno/app-0.3.0.tgz (Root Library)
    • pdfjs-dist-3.11.174.tgz
      • canvas-2.11.2.tgz
        • node-pre-gyp-1.0.11.tgz
          • ❌ tar-6.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 1c09e8a668ad72df9daf7b367489d7d5939d13ed

Found in base branch: main

Vulnerability Details

node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.

Publish Date: 2024-03-21

URL: CVE-2024-28863

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-f5x3-32g6-xq36

Release Date: 2024-03-21

Fix Resolution: tar - 6.2.1

CVE-2024-4067

Vulnerable Library - micromatch-4.0.5.tgz

Glob matching for javascript/node.js. A replacement and faster alternative to minimatch and multimatch.

Library home page: https://registry.npmjs.org/micromatch/-/micromatch-4.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/micromatch/package.json

Dependency Hierarchy:

  • @usebruno/app-0.3.0.tgz (Root Library)
    • codemirror-graphql-1.2.5.tgz
      • graphql-language-service-3.2.5.tgz
        • graphql-language-service-types-1.8.7.tgz
          • graphql-config-4.5.0.tgz
            • json-file-loader-7.4.18.tgz
              • globby-11.1.0.tgz
                • fast-glob-3.3.2.tgz
                  • ❌ micromatch-4.0.5.tgz (Vulnerable Library)

Found in HEAD commit: 1c09e8a668ad72df9daf7b367489d7d5939d13ed

Found in base branch: main

Vulnerability Details

The NPM package micromatch is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in micromatch.braces() in index.js because the pattern .* will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching.
Mend Note: After conducting a further research, it was concluded that CVE-2024-4067 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of micromatch should follow the fix recommendation as noted.

Publish Date: 2024-05-14

URL: CVE-2024-4067

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2024-05-14

Fix Resolution: micromatch - 4.0.6
@mend-for-github-com mend-for-github-com bot added the Mend: dependency security vulnerability Security vulnerability detected by Mend label May 27, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
0 participants