Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVE-2022-0122 (Medium) detected in node-forge-0.10.0.tgz #1112

Closed
mend-for-github-com bot opened this issue Jan 7, 2022 · 2 comments · Fixed by #1239
Closed

CVE-2022-0122 (Medium) detected in node-forge-0.10.0.tgz #1112

mend-for-github-com bot opened this issue Jan 7, 2022 · 2 comments · Fixed by #1239
Assignees
@tmarkley
Labels
cve Security vulnerabilities detected by Dependabot or Mend medium severity Medium severity CVE Mend: dependency security vulnerability Security vulnerability detected by Mend v2.0.0

Comments

@mend-for-github-com
Copy link

mend-for-github-com bot commented Jan 7, 2022 •
edited
Loading

CVE-2022-0122 - Medium Severity Vulnerability

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Dependency Hierarchy:

  • ❌ node-forge-0.10.0.tgz (Vulnerable Library)

Found in HEAD commit: 3d9f5425b6bb5dae38277bc68c45cb86ae608642

Found in base branch: main

Vulnerability Details

forge is vulnerable to URL Redirection to Untrusted Site

Publish Date: 2022-01-06

URL: CVE-2022-0122

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gf8q-jrpm-jvxq

Release Date: 2022-01-06

Fix Resolution: 1.2.1
@mend-for-github-com mend-for-github-com bot added the Mend: dependency security vulnerability Security vulnerability detected by Mend label Jan 7, 2022
@tmarkley tmarkley added cve Security vulnerabilities detected by Dependabot or Mend medium severity Medium severity CVE labels Jan 7, 2022
AMoo-Miki pushed a commit to AMoo-Miki/OpenSearch-Dashboards that referenced this issue Feb 10, 2022
@monfera
feat(partition): order slices and sectors (opensearch-project#1112)
72c0d1b
AMoo-Miki pushed a commit to AMoo-Miki/OpenSearch-Dashboards that referenced this issue Feb 10, 2022
@semantic-release-bot
chore(release): 28.1.0 [skip ci]
d94ba32 
# [28.1.0](elastic/elastic-charts@v28.0.1...v28.1.0) (2021-04-13)

### Bug Fixes

* **legend:** sizing for short labels with scrollbar ([opensearch-project#1115](elastic/elastic-charts#1115)) ([ebf2552](elastic/elastic-charts@ebf2552))
* **xy:** negative bar highlight and click ([opensearch-project#1109](elastic/elastic-charts#1109)) ([065673c](elastic/elastic-charts@065673c)), closes [opensearch-project#1100](elastic/elastic-charts#1100)

### Features

* **a11y:** improve chart figure ([opensearch-project#1104](elastic/elastic-charts#1104)) ([373ea72](elastic/elastic-charts@373ea72))
* **partition:** order slices and sectors ([opensearch-project#1112](elastic/elastic-charts#1112)) ([72c0d1b](elastic/elastic-charts@72c0d1b))
* **partitions:** small multipies events pass on smAccessorValue ([opensearch-project#1106](elastic/elastic-charts#1106)) ([0e1f7de](elastic/elastic-charts@0e1f7de))
* **xy:** optionally rounds the domain to nice values ([opensearch-project#1087](elastic/elastic-charts#1087)) ([9c2eefc](elastic/elastic-charts@9c2eefc))
* **xy:** specify pixel and ratio width for bars ([opensearch-project#1114](elastic/elastic-charts#1114)) ([6294d5f](elastic/elastic-charts@6294d5f))
* mosaic ([opensearch-project#1113](elastic/elastic-charts#1113)) ([15c0d78](elastic/elastic-charts@15c0d78))
@tmarkley
Copy link
Contributor 

$ yarn why node-forge
yarn why v1.22.17
[1/4] Why do we have the module "node-forge"...?
[2/4] Initialising dependency graph...
warning Resolution field "typescript@4.0.2" is incompatible with requested version "typescript@~4.5.2"
[3/4] Finding dependency...
[4/4] Calculating file sizes...
=> Found "node-forge@0.10.0"
info Has been hoisted to "node-forge"
info Reasons this module exists
   - "workspace-aggregator-081297c8-05ca-4128-8865-4db8afe8e29e" depends on it
   - Specified in "dependencies"
   - Hoisted from "_project_#node-forge"
   - Hoisted from "_project_#@elastic#request-crypto#node-jose#node-forge"
   - Hoisted from "_project_#@osd#ui-framework#webpack-dev-server#selfsigned#node-forge"
info Disk size without dependencies: "1.77MB"
info Disk size with unique dependencies: "1.77MB"
info Disk size with transitive dependencies: "1.77MB"
info Number of shared dependencies: 0
Done in 1.53s.

@tmarkley
Copy link
Contributor 

$ npm ls node-forge
opensearch-dashboards@2.0.0 /home/ubuntu/ws/OpenSearch-Dashboards
├─┬ @elastic/request-crypto@1.1.4
│ └─┬ node-jose@1.1.0
│   └── node-forge@0.10.0 deduped invalid: "^0.7.6" from node_modules/node-jose
├─┬ @osd/ui-framework@1.0.0 -> ./packages/osd-ui-framework
│ └─┬ webpack-dev-server@3.11.2
│   └─┬ selfsigned@1.10.11
│     └── node-forge@0.10.0 deduped invalid: "^0.7.6" from node_modules/node-jose
└── node-forge@0.10.0

@tmarkley tmarkley self-assigned this Feb 11, 2022
tmarkley pushed a commit to tmarkley/OpenSearch-Dashboards that referenced this issue Feb 11, 2022
Upgrades node-forge from v0.10.0 to v1.2.1
8160ef4 
* [CHANGELOG](https://github.com/digitalbazaar/forge/blob/v1.2.1/CHANGELOG.md)
* The major version bump introduces breaking changes, but none of them
apply to Dashboards.
* Upgrades `@elastic/request-crypto` from `1.1.4` to `2.0.0` which has
a downstream dependency on `node-forge`.
  * `@elastic/request-crypto` uses `node-jose@2.0.0` which still depends
  on `node-forge@0.10.0` so we need a manual resolution for
  `node-jose@2.1.0`.

Resolves opensearch-project#1112

Signed-off-by: Tommy Markley <markleyt@amazon.com>
@tmarkley tmarkley mentioned this issue Feb 11, 2022
Merged
7 tasks
@tmarkley tmarkley mentioned this issue Feb 21, 2022
Closed
tmarkley pushed a commit that referenced this issue Feb 22, 2022
Upgrades node-forge from v0.10.0 to v1.2.1 (#1239)
15b561e 
* [CHANGELOG](https://github.com/digitalbazaar/forge/blob/v1.2.1/CHANGELOG.md)
* The major version bump introduces breaking changes, but none of them
apply to Dashboards.
* Upgrades `@elastic/request-crypto` from `1.1.4` to `2.0.0` which has
a downstream dependency on `node-forge`.
  * `@elastic/request-crypto` uses `node-jose@2.0.0` which still depends
  on `node-forge@0.10.0` so we need a manual resolution for
  `node-jose@2.1.0`.

Resolves #1112
Resolves #1134 

Signed-off-by: Tommy Markley <markleyt@amazon.com>
@ZilongX ZilongX mentioned this issue Sep 29, 2022
Closed
6 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@tmarkley tmarkley

Labels
cve Security vulnerabilities detected by Dependabot or Mend medium severity Medium severity CVE Mend: dependency security vulnerability Security vulnerability detected by Mend v2.0.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Upgrades node-forge from v0.10.0 to v1.2.1 tmarkley/OpenSearch-Dashboards
1 participant
@tmarkley