Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 41 vulnerabilities #57

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 41 vulnerabilities #57

wants to merge 1 commit into from

Conversation

rajendradbpb
Copy link
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
    • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Prototype Pollution
SNYK-JS-AJV-584908		 Yes No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 Yes Proof of Concept
high severity 579/1000
Why? Has a fix available, CVSS 7.3		 Arbitrary File Overwrite
SNYK-JS-FSTREAM-174725		 Yes No Known Exploit
high severity 584/1000
Why? Has a fix available, CVSS 7.4		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-HAWK-2808852		 Yes No Known Exploit
medium severity 703/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 6.2		 Missing Release of Resource after Effective Lifetime
SNYK-JS-INFLIGHT-6095116		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-INI-1048974		 Yes Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ISMYJSONVALID-597165		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Arbitrary Code Execution
SNYK-JS-ISMYJSONVALID-597167		 Yes Proof of Concept
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-JSONPOINTER-1577288		 Yes Proof of Concept
critical severity 811/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 9.8		 Prototype Pollution
SNYK-JS-JSONPOINTER-598804		 Yes Proof of Concept
high severity 644/1000
Why? Has a fix available, CVSS 8.6		 Prototype Pollution
SNYK-JS-JSONSCHEMA-1920922		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905		 Yes Proof of Concept
high severity 681/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.2		 Command Injection
SNYK-JS-LODASH-1040724		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-450202		 Yes Proof of Concept
high severity 731/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.2		 Prototype Pollution
SNYK-JS-LODASH-567746		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-608086		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-73638		 Yes Proof of Concept
medium severity 541/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 4.4		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-73639		 Yes Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-3050818		 Yes No Known Exploit
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Prototype Pollution
SNYK-JS-MINIMIST-2429795		 Yes Proof of Concept
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-MINIMIST-559764		 Yes Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Prototype Poisoning
SNYK-JS-QS-3153490		 Yes Proof of Concept
medium severity 646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5		 Server-side Request Forgery (SSRF)
SNYK-JS-REQUEST-3361831		 Yes Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795		 Yes Proof of Concept
high severity 624/1000
Why? Has a fix available, CVSS 8.2		 Arbitrary File Overwrite
SNYK-JS-TAR-1536528		 Yes No Known Exploit
high severity 624/1000
Why? Has a fix available, CVSS 8.2		 Arbitrary File Overwrite
SNYK-JS-TAR-1536531		 Yes No Known Exploit
low severity 410/1000
Why? Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-TAR-1536758		 Yes No Known Exploit
high severity 639/1000
Why? Has a fix available, CVSS 8.5		 Arbitrary File Write
SNYK-JS-TAR-1579147		 Yes No Known Exploit
high severity 639/1000
Why? Has a fix available, CVSS 8.5		 Arbitrary File Write
SNYK-JS-TAR-1579152		 Yes No Known Exploit
high severity 639/1000
Why? Has a fix available, CVSS 8.5		 Arbitrary File Write
SNYK-JS-TAR-1579155		 Yes No Known Exploit
high severity 726/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.1		 Arbitrary File Overwrite
SNYK-JS-TAR-174125		 Yes Proof of Concept
medium severity 646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5		 Prototype Pollution
SNYK-JS-TOUGHCOOKIE-5672873		 Yes Proof of Concept
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:bson:20180225		 Yes Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Insecure Randomness
npm:cryptiles:20180710		 Yes No Known Exploit
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
npm:deep-extend:20180409		 Yes Proof of Concept
high severity 579/1000
Why? Has a fix available, CVSS 7.3		 Prototype Pollution
npm:extend:20180424		 Yes No Known Exploit
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 Prototype Pollution
npm:hoek:20180212		 Yes Proof of Concept
low severity 571/1000
Why? Mature exploit, Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:is-my-json-valid:20180214		 Yes Mature
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 Prototype Pollution
npm:lodash:20180130		 Yes Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
npm:sshpk:20180409		 Yes Proof of Concept
medium severity 646/1000
Why? Mature exploit, Has a fix available, CVSS 5.2		 Uninitialized Memory Exposure
npm:stringstream:20180511		 Yes Mature

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: connect-mongodb-session The new version differs by 26 commits.

See the full diff

Package name: log4js The new version differs by 250 commits.
  • 9fdbed5 6.4.0
  • 788c7a8 Merge pull request #1150 from log4js-node/update-changelog
  • 7fdb141 chore: updated changelog for 6.4.0
  • e6bd888 Merge pull request #1151 from log4js-node/feat-zero-backup
  • ac599e4 allow for zero backup - in sync with https://github.com/fix: allow for zero backups and zero daysToKeep log4js-node/streamroller#74
  • 53248cd Merge pull request #1149 from log4js-node/migrate-daysToKeep-to-numBackups
  • 436d9b4 Merge pull request #1148 from log4js-node/update-docs
  • d6b017e chore(docs): updated fileSync.md and misc comments
  • d4617a7 chore(deps): migrated from daysToKeep to numBackups due to streamroller@^3.0.0
  • 0ad0133 Merge pull request #1147 from log4js-node/update-deps
  • 773962b Merge pull request #1146 from log4js-node/update-deps
  • 823bb46 Merge pull request #1145 from log4js-node/update-deps
  • 6cc0035 chore(deps): bump streamroller from 3.0.1 to 3.0.2
  • 0f39859 chore(deps): bump date-format from 4.0.2 to 4.0.3
  • 85ac31e chore(deps-dev): bump eslint from from 8.6.0 to 8.7.0
  • acd41ef Merge pull request #1144 from log4js-node/refactor
  • 4c4bbe8 chore(refactor): using writer.writable instead of alive for checking
  • e86a809 Merge pull request #1097 from 4eb0da/datefile-error-handling
  • 34ab3b2 Merge pull request #1143 from log4js-node/update-test
  • 8cba85f chore(test): renamed tap.teardown() to tap.tearDown() for consistency (while both works, only tap.tearDown() is documented)
  • a0baec2 chore(test): fixed teardown() causing tests to fail due to fs errors on removal
  • 51ac865 Merge pull request #1103 from polo-language/recording-typescript
  • 653a20f Merge pull request #1028 from techmunk/master
  • 43a2199 chore(test): Changed default TAP test suite timeout from 30s to 45s because Windows takes a long time

See the full diff

Package name: mongoose The new version differs by 250 commits.
  • 76fae6d chore: release 5.3.9
  • 40d4177 Merge pull request #7213 from NewEraCracker/master
  • 751397c fix(document): run setter only once when doing `.set()` underneath a single nested subdoc
  • 10837d4 test(document): repro #7196
  • 10a63a9 Bump version of bson dependency to match mongodb-core
  • d10274e docs(transactions): add example of aborting a transaction
  • d245847 Merge branch 'master' of github.com:Automattic/mongoose
  • 551a75b chore: add cpc to some pages that were missing it
  • 1ca3514 Merge pull request #7210 from gfranco93/patch-1
  • c1606b6 Merge pull request #7207 from lineus/fix-7098
  • e9d538e Merge pull request #7203 from lineus/fix-7202
  • 8f16b67 fix(document): surface errors in subdoc pre validate
  • 87005a1 test(document): repro #7187
  • 5b1d81c Documentation fix: fixed anchor link
  • eebfb36 docs(query): add note re: cursor()
  • c1e2617 docs(query): improve find() docs re: #7188
  • 526f82d fix(query): run default functions after hydrating the loaded document
  • 320d5f8 test(query): repro #7182
  • 64c6d15 if our update schema path is a nested array do not skip query casting.
  • 5d122e8 test for #7098
  • 5ba13a7 refactor(test): move strictQuery tests to query.test.js since they do not use findOneAndUpdate()
  • 4121629 chore: refer to correct issue #7178
  • 22ed5d2 fix(query): handle strictQuery: 'throw' with nested path correctly
  • 8c16354 test(query): repro #7152

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Arbitrary Code Execution
🦉 More lessons are available in Snyk Learn

@snyk-bot
fix: package.json & package-lock.json to reduce vulnerabilities
c623cd8 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-AJV-584908
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-FSTREAM-174725
- https://snyk.io/vuln/SNYK-JS-HAWK-2808852
- https://snyk.io/vuln/SNYK-JS-INFLIGHT-6095116
- https://snyk.io/vuln/SNYK-JS-INI-1048974
- https://snyk.io/vuln/SNYK-JS-ISMYJSONVALID-597165
- https://snyk.io/vuln/SNYK-JS-ISMYJSONVALID-597167
- https://snyk.io/vuln/SNYK-JS-JSONPOINTER-1577288
- https://snyk.io/vuln/SNYK-JS-JSONPOINTER-598804
- https://snyk.io/vuln/SNYK-JS-JSONSCHEMA-1920922
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-LODASH-450202
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
- https://snyk.io/vuln/SNYK-JS-LODASH-608086
- https://snyk.io/vuln/SNYK-JS-LODASH-73638
- https://snyk.io/vuln/SNYK-JS-LODASH-73639
- https://snyk.io/vuln/SNYK-JS-MINIMATCH-3050818
- https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/SNYK-JS-QS-3153490
- https://snyk.io/vuln/SNYK-JS-REQUEST-3361831
- https://snyk.io/vuln/SNYK-JS-SEMVER-3247795
- https://snyk.io/vuln/SNYK-JS-TAR-1536528
- https://snyk.io/vuln/SNYK-JS-TAR-1536531
- https://snyk.io/vuln/SNYK-JS-TAR-1536758
- https://snyk.io/vuln/SNYK-JS-TAR-1579147
- https://snyk.io/vuln/SNYK-JS-TAR-1579152
- https://snyk.io/vuln/SNYK-JS-TAR-1579155
- https://snyk.io/vuln/SNYK-JS-TAR-174125
- https://snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873
- https://snyk.io/vuln/npm:bson:20180225
- https://snyk.io/vuln/npm:cryptiles:20180710
- https://snyk.io/vuln/npm:deep-extend:20180409
- https://snyk.io/vuln/npm:extend:20180424
- https://snyk.io/vuln/npm:hoek:20180212
- https://snyk.io/vuln/npm:is-my-json-valid:20180214
- https://snyk.io/vuln/npm:lodash:20180130
- https://snyk.io/vuln/npm:sshpk:20180409
- https://snyk.io/vuln/npm:stringstream:20180511
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@rajendradbpb @snyk-bot