derberg / minerva

Microservice written in Node. Used on workshops that treats about documenting REST APIs

Minerva

Microservice written in Node. Used on workshops that treat about documenting REST APIs.

API specification: http://minerva-derberg.rhcloud.com/meta-data/api.raml

Run server in developement mode:

npm install
npm run develop

Run server on CF:

npm install
npm start

minerva's Issues

CVE-2017-15010 High Severity Vulnerability detected by WhiteSource

CVE-2017-15010 - High Severity Vulnerability

Vulnerable Library - tough-cookie-0.12.1.tgz

RFC6265 Cookies and Cookie Jar for node.js

path: /tmp/git/minerva/node_modules/tough-cookie/package.json

Library home page: http://registry.npmjs.org/tough-cookie/-/tough-cookie-0.12.1.tgz

Dependency Hierarchy:

• popsicle-0.5.13.tgz (Root Library)
  • ❌ tough-cookie-0.12.1.tgz (Vulnerable Library)

Vulnerability Details

A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU.

Publish Date: 2017-10-04

URL: CVE-2017-15010

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/525

Release Date: 2017-09-21

Fix Resolution: Update to version 2.3.3 or later.

---

Step up your Open Source Security Game with WhiteSource here

CVE-2016-1000232 Medium Severity Vulnerability detected by WhiteSource

CVE-2016-1000232 - Medium Severity Vulnerability

Vulnerable Library - tough-cookie-0.12.1.tgz

RFC6265 Cookies and Cookie Jar for node.js

path: /tmp/git/minerva/node_modules/tough-cookie/package.json

Library home page: http://registry.npmjs.org/tough-cookie/-/tough-cookie-0.12.1.tgz

Dependency Hierarchy:

• popsicle-0.5.13.tgz (Root Library)
  • ❌ tough-cookie-0.12.1.tgz (Vulnerable Library)

Vulnerability Details

NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0.

Publish Date: 2018-09-05

URL: CVE-2016-1000232

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: salesforce/tough-cookie@e4fc2e0

Release Date: 2016-07-21

Fix Resolution: Replace or update the following files: parsing_test.js, cookie.js

---

Step up your Open Source Security Game with WhiteSource here