osweekends / curratelo Goto Github PK

Vulnerable Library - base64url-1.0.6.tgz

For encoding to/from base64urls

Library home page: https://registry.npmjs.org/base64url/-/base64url-1.0.6.tgz

Path to dependency file: curratelo/package.json

Path to vulnerable library: curratelo/node_modules/firebase/node_modules/jsonwebtoken/node_modules/jws/node_modules/base64url/package.json

Dependency Hierarchy:

• firebase-3.0.5.tgz (Root Library)
  • jsonwebtoken-5.7.0.tgz
    • jws-3.1.3.tgz
      • ❌ base64url-1.0.6.tgz (Vulnerable Library)

Vulnerability Details

Versions of base64url before 3.0.0 are vulnerable to to out-of-bounds reads as it allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.

Publish Date: 2018-05-16

URL: WS-2018-0096

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/321687

Release Date: 2019-01-24

Fix Resolution: 3.0.0

Vulnerability Details

DoS in ws module due to excessively large websocket message.

Publish Date: 2016-06-23

URL: WS-2016-0031

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: N/A
  • Attack Complexity: N/A
  • Privileges Required: N/A
  • User Interaction: N/A
  • Scope: N/A
• Impact Metrics:
  • Confidentiality Impact: N/A
  • Integrity Impact: N/A
  • Availability Impact: N/A

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/120

Release Date: 2016-06-24

Fix Resolution: Update to version 1.1.1 of ws, or if that is not possible, set the `maxpayload` option for the `ws` server - make sure the value is less than 256MB.

Vulnerable Library - qs-0.6.6.tgz

querystring parser

Library home page: https://registry.npmjs.org/qs/-/qs-0.6.6.tgz

Path to dependency file: curratelo/package.json

Path to vulnerable library: curratelo/node_modules/feedparser/node_modules/qs/package.json

Dependency Hierarchy:

• rsj-0.0.4.tgz (Root Library)
  • feedparser-0.15.10.tgz
    • request-2.21.0.tgz
      • ❌ qs-0.6.6.tgz (Vulnerable Library)

Vulnerability Details

The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.

Publish Date: 2014-10-19

URL: CVE-2014-7191

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2014-7191

Release Date: 2014-10-19

Fix Resolution: 1.0.0

Vulnerable Library - qs-0.6.6.tgz

querystring parser

Library home page: https://registry.npmjs.org/qs/-/qs-0.6.6.tgz

Path to dependency file: curratelo/package.json

Path to vulnerable library: curratelo/node_modules/feedparser/node_modules/qs/package.json

Dependency Hierarchy:

• rsj-0.0.4.tgz (Root Library)
  • feedparser-0.15.10.tgz
    • request-2.21.0.tgz
      • ❌ qs-0.6.6.tgz (Vulnerable Library)

Vulnerability Details

Denial-of-Service Extended Event Loop Blocking.The qs module does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time

Publish Date: 2014-07-31

URL: WS-2014-0005

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/qs_dos_extended_event_loop_blocking

Release Date: 2014-08-06

Fix Resolution: Update qs to version 1.0.0 or greater

Vulnerable Library - negotiator-0.4.9.tgz

HTTP content negotiation

Library home page: https://registry.npmjs.org/negotiator/-/negotiator-0.4.9.tgz

Path to dependency file: curratelo/package.json

Path to vulnerable library: curratelo/node_modules/negotiator/package.json

Dependency Hierarchy:

• socket.io-1.4.8.tgz (Root Library)
  • engine.io-1.6.11.tgz
    • accepts-1.1.4.tgz
      • ❌ negotiator-0.4.9.tgz (Vulnerable Library)

Vulnerability Details

negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.

Publish Date: 2018-05-31

URL: CVE-2016-10539

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/106

Release Date: 2018-05-31

Fix Resolution: 0.6.1

Vulnerability Details

Affected version of ws (0.2.6 through 3.3.0 excluding 0.3.4-2, 0.3.5-2, 0.3.5-3, 0.3.5-4, 1.1.5, 2.0.0-beta.0, 2.0.0-beta.1 and 2.0.0-beta.2) are vulnerable to A specially crafted value of the Sec-WebSocket-Extensions header that used Object.prototype property names as extension or parameter names could be used to make a ws server crash.

Publish Date: 2017-11-08

URL: WS-2017-0421

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: websockets/ws@c4fe466

Release Date: 2017-11-08

Fix Resolution: 3.3.1

Vulnerable Library - lodash-3.10.1.tgz

The modern build of lodash modular utilities.

path: /curratelo/node_modules/x-ray-crawler/node_modules/lodash/package.json

Library home page: http://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Dependency Hierarchy:

• ❌ lodash-3.10.1.tgz (Vulnerable Library)

Vulnerability Details

In the node_module "lodash" before version 4.17.11 the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects.

Publish Date: 2018-11-25

URL: WS-2018-0210

CVSS 2 Score Details (3.5)

Base Score Metrics not available

Suggested Fix

Type: Change files

Origin: lodash/lodash@90e6199

Release Date: 2018-08-31

Fix Resolution: Replace or update the following files: lodash.js, test.js

Vulnerable Library - deep-extend-0.3.3.tgz

Recursive object extending.

Library home page: https://registry.npmjs.org/deep-extend/-/deep-extend-0.3.3.tgz

Path to dependency file: curratelo/package.json

Path to vulnerable library: curratelo/node_modules/deep-extend/package.json

Dependency Hierarchy:

• twitter-1.3.0.tgz (Root Library)
  • ❌ deep-extend-0.3.3.tgz (Vulnerable Library)

Vulnerability Details

The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

Publish Date: 2018-07-03

URL: CVE-2018-3750

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3750

Release Date: 2019-01-24

Fix Resolution: 0.5.1

Vulnerable Library - lodash-3.10.1.tgz

The modern build of lodash modular utilities.

path: /curratelo/node_modules/x-ray-crawler/node_modules/lodash/package.json

Library home page: http://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Dependency Hierarchy:

• ❌ lodash-3.10.1.tgz (Vulnerable Library)

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-3721

Fix Resolution: Upgrade to version lodash 4.17.5 or greater

Vulnerability Details

By sending an overly long websocket payload to a ws server, it is possible to crash the node process.

Publish Date: 2016-06-23

URL: WS-2016-0040

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: N/A
  • Attack Complexity: N/A
  • Privileges Required: N/A
  • User Interaction: N/A
  • Scope: N/A
• Impact Metrics:
  • Confidentiality Impact: N/A
  • Integrity Impact: N/A
  • Availability Impact: N/A

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/120/versions

Release Date: 2016-06-23

Fix Resolution: 1.1.1

Vulnerability Details

websockets uses Math.random function to generate masking key. This function is not random enough allowing an attacker to easily guess the key. Having the key an attacker can read the payload causing potential information disclosure.

Publish Date: 2016-09-20

URL: WS-2017-0107

CVSS 3 Score Details (7.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Adjacent
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: websockets/ws#832

Release Date: 2016-09-20

Fix Resolution: 2.0.0-beta.0

Vulnerable Library - mime-1.2.11.tgz

A comprehensive library for mime-type mapping

path: /curratelo/node_modules/feedparser/node_modules/mime/package.json

Library home page: http://registry.npmjs.org/mime/-/mime-1.2.11.tgz

Dependency Hierarchy:

• ❌ mime-1.2.11.tgz (Vulnerable Library)

Vulnerability Details

Affected version of mime (1.0.0 throw 1.4.0 and 2.0.0 throw 2.0.2), are vulnerable to regular expression denial of service.

Publish Date: 2017-09-27

URL: WS-2017-0330

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Vulnerable Library - concat-stream-1.4.10.tgz

writable stream that concatenates strings or binary data and calls a callback with the result

Library home page: https://registry.npmjs.org/concat-stream/-/concat-stream-1.4.10.tgz

Path to dependency file: curratelo/package.json

Path to vulnerable library: curratelo/node_modules/firebase/node_modules/jsonwebtoken/node_modules/jws/node_modules/base64url/node_modules/concat-stream/package.json

Dependency Hierarchy:

• firebase-3.0.5.tgz (Root Library)
  • jsonwebtoken-5.7.0.tgz
    • jws-3.1.3.tgz
      • base64url-1.0.6.tgz
        • ❌ concat-stream-1.4.10.tgz (Vulnerable Library)

Vulnerability Details

Versions of concat-stream before 1.5.2 are vulnerable to memory exposure if userp provided input is passed into write()

Versions <1.3.0 are not affected due to not using unguarded Buffer constructor.

Publish Date: 2018-04-25

URL: WS-2018-0075

CVSS 3 Score Details (5.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/597

Release Date: 2018-01-27

Fix Resolution: 1.5.2

Vulnerable Library - deep-extend-0.3.3.tgz

Recursive object extending.

path: /curratelo/node_modules/deep-extend/package.json

Library home page: http://registry.npmjs.org/deep-extend/-/deep-extend-0.3.3.tgz

Dependency Hierarchy:

• ❌ deep-extend-0.3.3.tgz (Vulnerable Library)

Vulnerability Details

Versions of deep-extend before 0.5.1 are vulnerable to prototype pollution.

Publish Date: 2018-04-25

URL: WS-2018-0091

CVSS 2 Score Details (2.0)

Base Score Metrics not available

Vulnerable Library - uglify-js-2.2.5.tgz

JavaScript parser, mangler/compressor and beautifier toolkit

path: /curratelo/node_modules/transformers/node_modules/uglify-js/package.json

Library home page: http://registry.npmjs.org/uglify-js/-/uglify-js-2.2.5.tgz

Dependency Hierarchy:

• ❌ uglify-js-2.2.5.tgz (Vulnerable Library)

Vulnerability Details

UglifyJS versions 2.4.23 and earlier are affected by a vulnerability which allows a specially crafted Javascript file to have altered functionality after minification.

Publish Date: 2015-08-24

URL: WS-2015-0024

CVSS 2 Score Details (8.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/39

Release Date: 2015-08-24

Fix Resolution: Upgrade UglifyJS to version >= 2.4.24.

Vulnerable Library - request-2.21.0.tgz

Simplified HTTP request client.

Library home page: https://registry.npmjs.org/request/-/request-2.21.0.tgz

Path to dependency file: curratelo/package.json

Path to vulnerable library: curratelo/node_modules/feedparser/node_modules/request/package.json

Dependency Hierarchy:

• rsj-0.0.4.tgz (Root Library)
  • feedparser-0.15.10.tgz
    • ❌ request-2.21.0.tgz (Vulnerable Library)

Vulnerability Details

Request is an http client. If a request is made using multipart, and the body type is a number, then the specified number of non-zero memory is passed in the body. This affects Request >=2.2.6 <2.47.0 || >2.51.0 <=2.67.0.

Publish Date: 2018-06-04

URL: CVE-2017-16026

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-16026

Release Date: 2018-06-04

Fix Resolution: 2.47.1,2.67.1

Vulnerable Library - debug-2.2.0.tgz

small debugging utility

Library home page: https://registry.npmjs.org/debug/-/debug-2.2.0.tgz

Path to dependency file: curratelo/package.json

Path to vulnerable library: curratelo/node_modules/x-ray/node_modules/debug/package.json

Dependency Hierarchy:

• x-ray-2.3.0.tgz (Root Library)
  • ❌ debug-2.2.0.tgz (Vulnerable Library)

Vulnerability Details

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Publish Date: 2018-06-07

URL: CVE-2017-16137

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-16137

Release Date: 2018-06-07

Fix Resolution: 2.6.9

Vulnerable Library - qs-0.6.6.tgz

querystring parser

Library home page: https://registry.npmjs.org/qs/-/qs-0.6.6.tgz

Path to dependency file: curratelo/package.json

Path to vulnerable library: curratelo/node_modules/feedparser/node_modules/qs/package.json

Dependency Hierarchy:

• rsj-0.0.4.tgz (Root Library)
  • feedparser-0.15.10.tgz
    • request-2.21.0.tgz
      • ❌ qs-0.6.6.tgz (Vulnerable Library)

Vulnerability Details

The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.

Publish Date: 2018-05-31

URL: CVE-2014-10064

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/28

Release Date: 2014-08-06

Fix Resolution: Update to version 1.0.0 or later

Vulnerable Library - uglify-js-2.2.5.tgz

JavaScript parser, mangler/compressor and beautifier toolkit

path: /curratelo/node_modules/transformers/node_modules/uglify-js/package.json

Library home page: http://registry.npmjs.org/uglify-js/-/uglify-js-2.2.5.tgz

Dependency Hierarchy:

• ❌ uglify-js-2.2.5.tgz (Vulnerable Library)

Vulnerability Details

Uglify-js is vulnerable to regular expression denial of service (ReDoS) when certain types of input is passed into .parse().

Publish Date: 2015-10-24

URL: WS-2015-0017

CVSS 2 Score Details (5.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/48

Release Date: 2015-10-24

Fix Resolution: Update to version 2.6.0 or later

Vulnerability Details

hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-03-30

URL: CVE-2018-3728

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3728

Release Date: 2018-03-30

Fix Resolution: 4.2.1,5.0.3

Vulnerable Library - cryptiles-0.2.2.tgz

General purpose crypto utilities

Library home page: https://registry.npmjs.org/cryptiles/-/cryptiles-0.2.2.tgz

Path to dependency file: curratelo/package.json

Path to vulnerable library: curratelo/node_modules/cryptiles/package.json

Dependency Hierarchy:

• rsj-0.0.4.tgz (Root Library)
  • feedparser-0.15.10.tgz
    • request-2.21.0.tgz
      • hawk-0.13.1.tgz
        • ❌ cryptiles-0.2.2.tgz (Vulnerable Library)

Vulnerability Details

Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2.

Publish Date: 2018-07-09

URL: CVE-2018-1000620

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000620

Release Date: 2018-07-09

Fix Resolution: v4.1.2

Vulnerable Library - ms-0.7.1.tgz

Tiny ms conversion utility

Library home page: https://registry.npmjs.org/ms/-/ms-0.7.1.tgz

Path to dependency file: curratelo/package.json

Path to vulnerable library: curratelo/node_modules/firebase/node_modules/jsonwebtoken/node_modules/ms/package.json,curratelo/node_modules/x-ray/node_modules/ms/package.json

Dependency Hierarchy:

• firebase-3.0.5.tgz (Root Library)
  • jsonwebtoken-5.7.0.tgz
    • ❌ ms-0.7.1.tgz (Vulnerable Library)

Vulnerability Details

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS).

Publish Date: 2017-04-12

URL: WS-2017-0247

CVSS 2 Score Details (3.4)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: vercel/ms#89

Release Date: 2017-04-12

Fix Resolution: 2.1.1

Vulnerable Library - hawk-0.13.1.tgz

HTTP Hawk Authentication Scheme

Library home page: https://registry.npmjs.org/hawk/-/hawk-0.13.1.tgz

Path to dependency file: curratelo/package.json

Path to vulnerable library: curratelo/node_modules/hawk/package.json

Dependency Hierarchy:

• rsj-0.0.4.tgz (Root Library)
  • feedparser-0.15.10.tgz
    • request-2.21.0.tgz
      • ❌ hawk-0.13.1.tgz (Vulnerable Library)

Vulnerability Details

Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service (CPU consumption or partial outage) via a long (1) header or (2) URI that is matched against an improper regular expression.

Publish Date: 2016-04-13

URL: CVE-2016-2515

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-2515

Release Date: 2016-04-13

Fix Resolution: 3.1.3,4.1.1

Vulnerable Library - parsejson-0.0.1.tgz

Method that parses a JSON string and returns a JSON object

Library home page: https://registry.npmjs.org/parsejson/-/parsejson-0.0.1.tgz

Path to dependency file: curratelo/package.json

Path to vulnerable library: curratelo/node_modules/parsejson/package.json

Dependency Hierarchy:

• socket.io-1.4.8.tgz (Root Library)
  • socket.io-client-1.4.8.tgz
    • engine.io-client-1.6.11.tgz
      • ❌ parsejson-0.0.1.tgz (Vulnerable Library)

Vulnerability Details

The parsejson module is vulnerable to regular expression denial of service when untrusted user input is passed into it to be parsed.

Publish Date: 2018-06-07

URL: CVE-2017-16113

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Vulnerable Library - request-2.21.0.tgz

Simplified HTTP request client.

path: /curratelo/node_modules/feedparser/node_modules/request/package.json

Library home page: http://registry.npmjs.org/request/-/request-2.21.0.tgz

Dependency Hierarchy:

• ❌ request-2.21.0.tgz (Vulnerable Library)

Vulnerability Details

There is a potential remote memory exposure vulnerability in request from version 2.2.5 before version 2.68.0. If the node process makes a request with a multipart attachment, and the type of the body option is a Number, then that many bytes of uninitialized memory will be sent in the body of the request.

Publish Date: 2016-03-22

URL: WS-2016-0025

CVSS 2 Score Details (6.1)

Base Score Metrics not available

Vulnerable Library - tunnel-agent-0.3.0.tgz

HTTP proxy tunneling agent. Formerly part of mikeal/request, now a standalone module.

Library home page: https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.3.0.tgz

Path to dependency file: curratelo/package.json

Path to vulnerable library: curratelo/node_modules/feedparser/node_modules/tunnel-agent/package.json

Dependency Hierarchy:

• rsj-0.0.4.tgz (Root Library)
  • feedparser-0.15.10.tgz
    • request-2.21.0.tgz
      • ❌ tunnel-agent-0.3.0.tgz (Vulnerable Library)

Vulnerability Details

Versions of tunnel-agent before 0.6.0 are vulnerable to memory exposure.

This is exploitable if user supplied input is provided to the auth value and is a number.

Publish Date: 2017-03-05

URL: WS-2018-0076

CVSS 3 Score Details (5.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/598

Release Date: 2018-01-27

Fix Resolution: 0.6.0

Vulnerable Library - constantinople-3.0.2.tgz

Determine whether a JavaScript expression evaluates to a constant (using UglifyJS)

Library home page: https://registry.npmjs.org/constantinople/-/constantinople-3.0.2.tgz

Path to dependency file: curratelo/package.json

Path to vulnerable library: curratelo/node_modules/constantinople/package.json

Dependency Hierarchy:

• jade-1.11.0.tgz (Root Library)
  • ❌ constantinople-3.0.2.tgz (Vulnerable Library)

Vulnerability Details

Versions of constantinople prior to 3.1.1 are vulnerable to a sandbox bypass which can lead to arbitrary code execution.

Publish Date: 2018-04-21

URL: WS-2018-0068

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/568

Release Date: 2018-01-24

Fix Resolution: 3.1.1