blog-messages_api-node_firebase-appointment_scheduler's People
blog-messages_api-node_firebase-appointment_scheduler's Issues
server-sdk-2.11.2.tgz: 1 vulnerabilities (highest severity is: 7.5) - autoclosed
Vulnerable Library - server-sdk-2.11.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/decode-uri-component/package.json
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Vulnerabilities
CVE | Severity | Dependency | Type | Fixed in (server-sdk version) | Remediation Available | |
---|---|---|---|---|---|---|
CVE-2022-38900 | 7.5 | decode-uri-component-0.2.0.tgz | Transitive | 2.11.3 | ✅ |
Details
CVE-2022-38900
Vulnerable Library - decode-uri-component-0.2.0.tgz
A better decodeURIComponent
Library home page: https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/decode-uri-component/package.json
Dependency Hierarchy:
- server-sdk-2.11.2.tgz (Root Library)
- query-string-7.1.1.tgz
- ❌ decode-uri-component-0.2.0.tgz (Vulnerable Library)
- query-string-7.1.1.tgz
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
Vulnerability Details
decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.
Publish Date: 2022-11-28
URL: CVE-2022-38900
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: GHSA-w573-4hg7-7wgq
Release Date: 2022-11-28
Fix Resolution (decode-uri-component): 0.2.1
Direct dependency fix Resolution (@vonage/server-sdk): 2.11.3
⛑️ Automatic Remediation is available for this issue
⛑️ Automatic Remediation is available for this issue.
firebase-tools-10.9.2.tgz: 14 vulnerabilities (highest severity is: 10.0) - autoclosed
Vulnerable Library - firebase-tools-10.9.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/firebase-tools/node_modules/vm2/package.json
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Vulnerabilities
CVE | Severity | Dependency | Type | Fixed in (firebase-tools version) | Remediation Available | |
---|---|---|---|---|---|---|
CVE-2022-36067 | 10.0 | vm2-3.9.9.tgz | Transitive | 11.0.0 | ✅ | |
CVE-2023-30547 | 10.0 | vm2-3.9.9.tgz | Transitive | N/A* | ❌ | |
CVE-2023-29199 | 10.0 | vm2-3.9.9.tgz | Transitive | N/A* | ❌ | |
CVE-2023-29017 | 9.8 | vm2-3.9.9.tgz | Transitive | 11.0.0 | ✅ | |
CVE-2022-25893 | 9.8 | vm2-3.9.9.tgz | Transitive | 11.0.0 | ✅ | |
CVE-2022-23539 | 8.1 | jsonwebtoken-8.5.1.tgz | Transitive | 11.21.0 | ✅ | |
CVE-2022-23540 | 7.6 | jsonwebtoken-8.5.1.tgz | Transitive | 11.21.0 | ✅ | |
CVE-2022-24999 | 7.5 | detected in multiple dependencies | Transitive | 11.0.0 | ✅ | |
CVE-2022-25878 | 7.5 | protobufjs-6.11.2.tgz | Transitive | 11.1.0 | ✅ | |
CVE-2022-3517 | 7.5 | minimatch-3.0.4.tgz | Transitive | N/A* | ❌ | |
CVE-2022-25881 | 7.5 | http-cache-semantics-4.1.0.tgz | Transitive | 11.0.0 | ✅ | |
CVE-2022-23541 | 6.3 | jsonwebtoken-8.5.1.tgz | Transitive | 11.21.0 | ✅ | |
CVE-2023-28155 | 6.1 | request-2.88.2.tgz | Transitive | N/A* | ❌ | |
CVE-2022-33987 | 5.3 | got-9.6.0.tgz | Transitive | 11.21.0 | ✅ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
Details
CVE-2022-36067
Vulnerable Library - vm2-3.9.9.tgz
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Securely!
Library home page: https://registry.npmjs.org/vm2/-/vm2-3.9.9.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/firebase-tools/node_modules/vm2/package.json
Dependency Hierarchy:
- firebase-tools-10.9.2.tgz (Root Library)
- proxy-agent-5.0.0.tgz
- pac-proxy-agent-5.0.0.tgz
- pac-resolver-5.0.0.tgz
- degenerator-3.0.1.tgz
- ❌ vm2-3.9.9.tgz (Vulnerable Library)
- degenerator-3.0.1.tgz
- pac-resolver-5.0.0.tgz
- pac-proxy-agent-5.0.0.tgz
- proxy-agent-5.0.0.tgz
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
Vulnerability Details
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds.
Publish Date: 2022-09-06
URL: CVE-2022-36067
CVSS 3 Score Details (10.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: GHSA-mrgp-mrhc-5jrq
Release Date: 2022-09-06
Fix Resolution (vm2): 3.9.11
Direct dependency fix Resolution (firebase-tools): 11.0.0
⛑️ Automatic Remediation is available for this issue
CVE-2023-30547
Vulnerable Library - vm2-3.9.9.tgz
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Securely!
Library home page: https://registry.npmjs.org/vm2/-/vm2-3.9.9.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/firebase-tools/node_modules/vm2/package.json
Dependency Hierarchy:
- firebase-tools-10.9.2.tgz (Root Library)
- proxy-agent-5.0.0.tgz
- pac-proxy-agent-5.0.0.tgz
- pac-resolver-5.0.0.tgz
- degenerator-3.0.1.tgz
- ❌ vm2-3.9.9.tgz (Vulnerable Library)
- degenerator-3.0.1.tgz
- pac-resolver-5.0.0.tgz
- pac-proxy-agent-5.0.0.tgz
- proxy-agent-5.0.0.tgz
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
Vulnerability Details
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside handleException()
which can be used to escape the sandbox and run arbitrary code in host context. This vulnerability was patched in the release of version 3.9.17
of vm2
. There are no known workarounds for this vulnerability. Users are advised to upgrade.
Publish Date: 2023-04-17
URL: CVE-2023-30547
CVSS 3 Score Details (10.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-30547
Release Date: 2023-04-17
Fix Resolution: vm2 - 3.9.17
CVE-2023-29199
Vulnerable Library - vm2-3.9.9.tgz
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Securely!
Library home page: https://registry.npmjs.org/vm2/-/vm2-3.9.9.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/firebase-tools/node_modules/vm2/package.json
Dependency Hierarchy:
- firebase-tools-10.9.2.tgz (Root Library)
- proxy-agent-5.0.0.tgz
- pac-proxy-agent-5.0.0.tgz
- pac-resolver-5.0.0.tgz
- degenerator-3.0.1.tgz
- ❌ vm2-3.9.9.tgz (Vulnerable Library)
- degenerator-3.0.1.tgz
- pac-resolver-5.0.0.tgz
- pac-proxy-agent-5.0.0.tgz
- proxy-agent-5.0.0.tgz
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
Vulnerability Details
There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass handleException()
and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context. A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.16
of vm2
.
Publish Date: 2023-04-14
URL: CVE-2023-29199
CVSS 3 Score Details (10.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: GHSA-xj72-wvfv-8985
Release Date: 2023-04-14
Fix Resolution: vm2 - 3.9.16
CVE-2023-29017
Vulnerable Library - vm2-3.9.9.tgz
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Securely!
Library home page: https://registry.npmjs.org/vm2/-/vm2-3.9.9.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/firebase-tools/node_modules/vm2/package.json
Dependency Hierarchy:
- firebase-tools-10.9.2.tgz (Root Library)
- proxy-agent-5.0.0.tgz
- pac-proxy-agent-5.0.0.tgz
- pac-resolver-5.0.0.tgz
- degenerator-3.0.1.tgz
- ❌ vm2-3.9.9.tgz (Vulnerable Library)
- degenerator-3.0.1.tgz
- pac-resolver-5.0.0.tgz
- pac-proxy-agent-5.0.0.tgz
- proxy-agent-5.0.0.tgz
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
Vulnerability Details
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to Error.prepareStackTrace
in case of unhandled async errors. A threat actor could bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.15 of vm2. There are no known workarounds.
Publish Date: 2023-04-06
URL: CVE-2023-29017
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-29017
Release Date: 2023-04-06
Fix Resolution (vm2): 3.9.15
Direct dependency fix Resolution (firebase-tools): 11.0.0
⛑️ Automatic Remediation is available for this issue
CVE-2022-25893
Vulnerable Library - vm2-3.9.9.tgz
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Securely!
Library home page: https://registry.npmjs.org/vm2/-/vm2-3.9.9.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/firebase-tools/node_modules/vm2/package.json
Dependency Hierarchy:
- firebase-tools-10.9.2.tgz (Root Library)
- proxy-agent-5.0.0.tgz
- pac-proxy-agent-5.0.0.tgz
- pac-resolver-5.0.0.tgz
- degenerator-3.0.1.tgz
- ❌ vm2-3.9.9.tgz (Vulnerable Library)
- degenerator-3.0.1.tgz
- pac-resolver-5.0.0.tgz
- pac-proxy-agent-5.0.0.tgz
- proxy-agent-5.0.0.tgz
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
Vulnerability Details
The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.
Publish Date: 2022-12-21
URL: CVE-2022-25893
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: GHSA-4w2j-2rg4-5mjw
Release Date: 2022-12-21
Fix Resolution (vm2): 3.9.10
Direct dependency fix Resolution (firebase-tools): 11.0.0
⛑️ Automatic Remediation is available for this issue
CVE-2022-23539
Vulnerable Library - jsonwebtoken-8.5.1.tgz
JSON Web Token implementation (symmetric and asymmetric)
Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/jsonwebtoken/package.json,/node_modules/firebase-tools/node_modules/jsonwebtoken/package.json
Dependency Hierarchy:
- firebase-tools-10.9.2.tgz (Root Library)
- ❌ jsonwebtoken-8.5.1.tgz (Vulnerable Library)
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
Vulnerability Details
Versions <=8.5.1
of jsonwebtoken
library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the allowInvalidAsymmetricKeyTypes
option to true
in the sign()
and/or verify()
functions.
Publish Date: 2022-12-23
URL: CVE-2022-23539
CVSS 3 Score Details (8.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: GHSA-8cf7-32gw-wr33
Release Date: 2022-12-23
Fix Resolution (jsonwebtoken): 9.0.0
Direct dependency fix Resolution (firebase-tools): 11.21.0
⛑️ Automatic Remediation is available for this issue
CVE-2022-23540
Vulnerable Library - jsonwebtoken-8.5.1.tgz
JSON Web Token implementation (symmetric and asymmetric)
Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/jsonwebtoken/package.json,/node_modules/firebase-tools/node_modules/jsonwebtoken/package.json
Dependency Hierarchy:
- firebase-tools-10.9.2.tgz (Root Library)
- ❌ jsonwebtoken-8.5.1.tgz (Vulnerable Library)
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
Vulnerability Details
In versions <=8.5.1
of jsonwebtoken
library, lack of algorithm definition in the jwt.verify()
function can lead to signature validation bypass due to defaulting to the none
algorithm for signature verification. Users are affected if you do not specify algorithms in the jwt.verify()
function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the jwt.verify()
method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the none
algorithm. If you need 'none' algorithm, you have to explicitly specify that in jwt.verify()
options.
Publish Date: 2022-12-22
URL: CVE-2022-23540
CVSS 3 Score Details (7.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: High
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-23540
Release Date: 2022-12-22
Fix Resolution (jsonwebtoken): 9.0.0
Direct dependency fix Resolution (firebase-tools): 11.21.0
⛑️ Automatic Remediation is available for this issue
CVE-2022-24999
Vulnerable Libraries - qs-6.7.0.tgz, qs-6.5.2.tgz
qs-6.7.0.tgz
A querystring parser that supports nesting and arrays, with a depth limit
Library home page: https://registry.npmjs.org/qs/-/qs-6.7.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/firebase-tools/node_modules/qs/package.json
Dependency Hierarchy:
- firebase-tools-10.9.2.tgz (Root Library)
- express-4.17.1.tgz
- ❌ qs-6.7.0.tgz (Vulnerable Library)
- express-4.17.1.tgz
qs-6.5.2.tgz
A querystring parser that supports nesting and arrays, with a depth limit
Library home page: https://registry.npmjs.org/qs/-/qs-6.5.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/firebase-tools/node_modules/request/node_modules/qs/package.json
Dependency Hierarchy:
- firebase-tools-10.9.2.tgz (Root Library)
- request-2.88.2.tgz
- ❌ qs-6.5.2.tgz (Vulnerable Library)
- request-2.88.2.tgz
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
Vulnerability Details
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).
Publish Date: 2022-11-26
URL: CVE-2022-24999
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999
Release Date: 2022-11-26
Fix Resolution (qs): 6.7.3
Direct dependency fix Resolution (firebase-tools): 11.0.0
Fix Resolution (qs): 6.5.3
Direct dependency fix Resolution (firebase-tools): 11.0.0
⛑️ Automatic Remediation is available for this issue
CVE-2022-25878
Vulnerable Library - protobufjs-6.11.2.tgz
Protocol Buffers for JavaScript (& TypeScript).
Library home page: https://registry.npmjs.org/protobufjs/-/protobufjs-6.11.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/firebase-tools/node_modules/protobufjs/package.json
Dependency Hierarchy:
- firebase-tools-10.9.2.tgz (Root Library)
- pubsub-2.18.4.tgz
- google-gax-2.28.1.tgz
- ❌ protobufjs-6.11.2.tgz (Vulnerable Library)
- google-gax-2.28.1.tgz
- pubsub-2.18.4.tgz
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
Vulnerability Details
The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files
Publish Date: 2022-05-27
URL: CVE-2022-25878
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25878
Release Date: 2022-05-27
Fix Resolution (protobufjs): 6.11.3
Direct dependency fix Resolution (firebase-tools): 11.1.0
⛑️ Automatic Remediation is available for this issue
CVE-2022-3517
Vulnerable Library - minimatch-3.0.4.tgz
a glob matcher in javascript
Library home page: https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/firebase-tools/node_modules/minimatch/package.json
Dependency Hierarchy:
- firebase-tools-10.9.2.tgz (Root Library)
- ❌ minimatch-3.0.4.tgz (Vulnerable Library)
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
Vulnerability Details
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.
Publish Date: 2022-10-17
URL: CVE-2022-3517
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2022-10-17
Fix Resolution: minimatch - 3.0.5
CVE-2022-25881
Vulnerable Library - http-cache-semantics-4.1.0.tgz
Parses Cache-Control and other headers. Helps building correct HTTP caches and proxies
Library home page: https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.1.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/firebase-tools/node_modules/http-cache-semantics/package.json
Dependency Hierarchy:
- firebase-tools-10.9.2.tgz (Root Library)
- superstatic-8.0.0.tgz
- re2-1.17.3.tgz
- node-gyp-8.4.1.tgz
- make-fetch-happen-9.1.0.tgz
- ❌ http-cache-semantics-4.1.0.tgz (Vulnerable Library)
- make-fetch-happen-9.1.0.tgz
- node-gyp-8.4.1.tgz
- re2-1.17.3.tgz
- superstatic-8.0.0.tgz
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
Vulnerability Details
This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
Publish Date: 2023-01-31
URL: CVE-2022-25881
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-25881
Release Date: 2023-01-31
Fix Resolution (http-cache-semantics): 4.1.1
Direct dependency fix Resolution (firebase-tools): 11.0.0
⛑️ Automatic Remediation is available for this issue
CVE-2022-23541
Vulnerable Library - jsonwebtoken-8.5.1.tgz
JSON Web Token implementation (symmetric and asymmetric)
Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/jsonwebtoken/package.json,/node_modules/firebase-tools/node_modules/jsonwebtoken/package.json
Dependency Hierarchy:
- firebase-tools-10.9.2.tgz (Root Library)
- ❌ jsonwebtoken-8.5.1.tgz (Vulnerable Library)
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
Vulnerability Details
jsonwebtoken is an implementation of JSON Web Tokens. Versions <= 8.5.1
of jsonwebtoken
library can be misconfigured so that passing a poorly implemented key retrieval function referring to the secretOrPublicKey
argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.
Publish Date: 2022-12-22
URL: CVE-2022-23541
CVSS 3 Score Details (6.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: GHSA-hjrf-2m68-5959
Release Date: 2022-12-22
Fix Resolution (jsonwebtoken): 9.0.0
Direct dependency fix Resolution (firebase-tools): 11.21.0
⛑️ Automatic Remediation is available for this issue
CVE-2023-28155
Vulnerable Library - request-2.88.2.tgz
Simplified HTTP request client.
Library home page: https://registry.npmjs.org/request/-/request-2.88.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/firebase-tools/node_modules/request/package.json,/node_modules/request/package.json
Dependency Hierarchy:
- firebase-tools-10.9.2.tgz (Root Library)
- ❌ request-2.88.2.tgz (Vulnerable Library)
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
Vulnerability Details
** UNSUPPORTED WHEN ASSIGNED ** The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Publish Date: 2023-03-16
URL: CVE-2023-28155
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
CVE-2022-33987
Vulnerable Library - got-9.6.0.tgz
Simplified HTTP requests
Library home page: https://registry.npmjs.org/got/-/got-9.6.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/firebase-tools/node_modules/got/package.json
Dependency Hierarchy:
- firebase-tools-10.9.2.tgz (Root Library)
- update-notifier-5.1.0.tgz
- latest-version-5.1.0.tgz
- package-json-6.5.0.tgz
- ❌ got-9.6.0.tgz (Vulnerable Library)
- package-json-6.5.0.tgz
- latest-version-5.1.0.tgz
- update-notifier-5.1.0.tgz
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
Vulnerability Details
The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
Publish Date: 2022-06-18
URL: CVE-2022-33987
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33987
Release Date: 2022-06-18
Fix Resolution (got): 11.8.6
Direct dependency fix Resolution (firebase-tools): 11.21.0
⛑️ Automatic Remediation is available for this issue
⛑️ Automatic Remediation is available for this issue.
firebase-admin-9.12.0.tgz: 6 vulnerabilities (highest severity is: 7.5) - autoclosed
Vulnerable Library - firebase-admin-9.12.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/node-forge/package.json
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Vulnerabilities
CVE | Severity | Dependency | Type | Fixed in (firebase-admin version) | Remediation Available | |
---|---|---|---|---|---|---|
CVE-2022-24434 | 7.5 | dicer-0.3.1.tgz | Transitive | N/A* | ❌ | |
CVE-2022-24772 | 7.5 | node-forge-0.10.0.tgz | Transitive | 10.0.2 | ✅ | |
CVE-2022-24771 | 7.5 | node-forge-0.10.0.tgz | Transitive | 10.0.2 | ✅ | |
WS-2022-0008 | 6.6 | node-forge-0.10.0.tgz | Transitive | 10.0.2 | ✅ | |
CVE-2022-0122 | 6.1 | node-forge-0.10.0.tgz | Transitive | 10.0.2 | ✅ | |
CVE-2022-24773 | 5.3 | node-forge-0.10.0.tgz | Transitive | 10.0.2 | ✅ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
Details
CVE-2022-24434
Vulnerable Library - dicer-0.3.1.tgz
A very fast streaming multipart parser for node.js
Library home page: https://registry.npmjs.org/dicer/-/dicer-0.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/dicer/package.json
Dependency Hierarchy:
- firebase-admin-9.12.0.tgz (Root Library)
- ❌ dicer-0.3.1.tgz (Vulnerable Library)
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
Vulnerability Details
This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes.
Publish Date: 2022-05-20
URL: CVE-2022-24434
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
CVE-2022-24772
Vulnerable Library - node-forge-0.10.0.tgz
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/node-forge/package.json
Dependency Hierarchy:
- firebase-admin-9.12.0.tgz (Root Library)
- ❌ node-forge-0.10.0.tgz (Vulnerable Library)
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
Vulnerability Details
Forge (also called node-forge
) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo
ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge
version 1.3.0. There are currently no known workarounds.
Publish Date: 2022-03-18
URL: CVE-2022-24772
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24772
Release Date: 2022-03-18
Fix Resolution (node-forge): 1.3.0
Direct dependency fix Resolution (firebase-admin): 10.0.2
⛑️ Automatic Remediation is available for this issue
CVE-2022-24771
Vulnerable Library - node-forge-0.10.0.tgz
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/node-forge/package.json
Dependency Hierarchy:
- firebase-admin-9.12.0.tgz (Root Library)
- ❌ node-forge-0.10.0.tgz (Vulnerable Library)
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
Vulnerability Details
Forge (also called node-forge
) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge
version 1.3.0. There are currently no known workarounds.
Publish Date: 2022-03-18
URL: CVE-2022-24771
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24771
Release Date: 2022-03-18
Fix Resolution (node-forge): 1.3.0
Direct dependency fix Resolution (firebase-admin): 10.0.2
⛑️ Automatic Remediation is available for this issue
WS-2022-0008
Vulnerable Library - node-forge-0.10.0.tgz
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/node-forge/package.json
Dependency Hierarchy:
- firebase-admin-9.12.0.tgz (Root Library)
- ❌ node-forge-0.10.0.tgz (Vulnerable Library)
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
Vulnerability Details
The forge.debug API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.
Publish Date: 2022-01-08
URL: WS-2022-0008
CVSS 3 Score Details (6.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: GHSA-5rrq-pxf6-6jx5
Release Date: 2022-01-08
Fix Resolution (node-forge): 1.0.0
Direct dependency fix Resolution (firebase-admin): 10.0.2
⛑️ Automatic Remediation is available for this issue
CVE-2022-0122
Vulnerable Library - node-forge-0.10.0.tgz
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/node-forge/package.json
Dependency Hierarchy:
- firebase-admin-9.12.0.tgz (Root Library)
- ❌ node-forge-0.10.0.tgz (Vulnerable Library)
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
Vulnerability Details
forge is vulnerable to URL Redirection to Untrusted Site
Mend Note: Converted from WS-2022-0007, on 2022-11-07.
Publish Date: 2022-01-06
URL: CVE-2022-0122
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: GHSA-gf8q-jrpm-jvxq
Release Date: 2022-01-06
Fix Resolution (node-forge): 1.0.0
Direct dependency fix Resolution (firebase-admin): 10.0.2
⛑️ Automatic Remediation is available for this issue
CVE-2022-24773
Vulnerable Library - node-forge-0.10.0.tgz
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/node-forge/package.json
Dependency Hierarchy:
- firebase-admin-9.12.0.tgz (Root Library)
- ❌ node-forge-0.10.0.tgz (Vulnerable Library)
Found in HEAD commit: 8da69422766f3882d31c57abbef3da03be4e489a
Found in base branch: main
Vulnerability Details
Forge (also called node-forge
) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check DigestInfo
for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in node-forge
version 1.3.0. There are currently no known workarounds.
Publish Date: 2022-03-18
URL: CVE-2022-24773
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24773
Release Date: 2022-03-18
Fix Resolution (node-forge): 1.3.0
Direct dependency fix Resolution (firebase-admin): 10.0.2
⛑️ Automatic Remediation is available for this issue
⛑️ Automatic Remediation is available for this issue.
server-sdk-2.11.3.tgz: 2 vulnerabilities (highest severity is: 9.8)
Vulnerable Library - server-sdk-2.11.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/tough-cookie/package.json
Found in HEAD commit: 7604f38d31f29b3cbf8eb3a35ec4af162eec33a4
Vulnerabilities
CVE | Severity | Dependency | Type | Fixed in (server-sdk version) | Remediation Available | |
---|---|---|---|---|---|---|
CVE-2023-26136 | 9.8 | tough-cookie-2.5.0.tgz | Transitive | N/A* | ❌ | |
CVE-2023-28155 | 6.1 | request-2.88.2.tgz | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
Details
CVE-2023-26136
Vulnerable Library - tough-cookie-2.5.0.tgz
RFC6265 Cookies and Cookie Jar for node.js
Library home page: https://registry.npmjs.org/tough-cookie/-/tough-cookie-2.5.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/tough-cookie/package.json
Dependency Hierarchy:
- server-sdk-2.11.3.tgz (Root Library)
- request-2.88.2.tgz
- ❌ tough-cookie-2.5.0.tgz (Vulnerable Library)
- request-2.88.2.tgz
Found in HEAD commit: 7604f38d31f29b3cbf8eb3a35ec4af162eec33a4
Found in base branch: main
Vulnerability Details
Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.
Publish Date: 2023-07-01
URL: CVE-2023-26136
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-26136
Release Date: 2023-07-01
Fix Resolution: tough-cookie - 4.1.3
CVE-2023-28155
Vulnerable Library - request-2.88.2.tgz
Simplified HTTP request client.
Library home page: https://registry.npmjs.org/request/-/request-2.88.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/request/package.json
Dependency Hierarchy:
- server-sdk-2.11.3.tgz (Root Library)
- ❌ request-2.88.2.tgz (Vulnerable Library)
Found in HEAD commit: 7604f38d31f29b3cbf8eb3a35ec4af162eec33a4
Found in base branch: main
Vulnerability Details
** UNSUPPORTED WHEN ASSIGNED ** The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Publish Date: 2023-03-16
URL: CVE-2023-28155
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.