Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

[Snyk] Fix for 25 vulnerabilities #384

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Fix for 25 vulnerabilities #384

wants to merge 1 commit into from

Conversation

aliscco
Copy link
Owner

@aliscco aliscco commented Apr 28, 2023

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • node_modules/diff/package.json
    • node_modules/diff/.snyk

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 Yes Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Denial of Service (DoS)
SNYK-JS-ENGINEIO-1056749		 Yes Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Denial of Service (DoS)
SNYK-JS-ENGINEIO-3136336		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-GLOBPARENT-1016905		 Yes Proof of Concept
medium severity 591/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.4		 Cross-site Scripting (XSS)
SNYK-JS-KARMA-2395349		 Yes Proof of Concept
medium severity 484/1000
Why? Has a fix available, CVSS 5.4		 Open Redirect
SNYK-JS-KARMA-2396325		 Yes No Known Exploit
medium severity 489/1000
Why? Has a fix available, CVSS 5.5		 Information Exposure
SNYK-JS-LOG4JS-2348757		 Yes No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-3050818		 Yes No Known Exploit
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Prototype Pollution
SNYK-JS-MINIMIST-2429795		 Yes Proof of Concept
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-MINIMIST-559764		 Yes Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MOCHA-2863123		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MOCHA-561476		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Open Redirect
SNYK-JS-NODEFORGE-2330875		 Yes Proof of Concept
medium severity 529/1000
Why? Has a fix available, CVSS 6.3		 Prototype Pollution
SNYK-JS-NODEFORGE-2331908		 Yes No Known Exploit
medium severity 494/1000
Why? Has a fix available, CVSS 5.6		 Improper Verification of Cryptographic Signature
SNYK-JS-NODEFORGE-2430337		 Yes No Known Exploit
high severity 579/1000
Why? Has a fix available, CVSS 7.3		 Improper Verification of Cryptographic Signature
SNYK-JS-NODEFORGE-2430339		 Yes No Known Exploit
medium severity 494/1000
Why? Has a fix available, CVSS 5.6		 Improper Verification of Cryptographic Signature
SNYK-JS-NODEFORGE-2430341		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Insecure Defaults
SNYK-JS-SOCKETIO-1024859		 Yes Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Denial of Service (DoS)
SNYK-JS-SOCKETIOPARSER-1056752		 Yes Proof of Concept
critical severity 704/1000
Why? Has a fix available, CVSS 9.8		 Improper Input Validation
SNYK-JS-SOCKETIOPARSER-3091012		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-WS-1296835		 Yes Proof of Concept
high severity 726/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.1		 Arbitrary Code Injection
SNYK-JS-XMLHTTPREQUESTSSL-1082936		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Access Restriction Bypass
SNYK-JS-XMLHTTPREQUESTSSL-1255647		 Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: karma The new version differs by 250 commits.
  • ab4b328 chore(release): 6.3.16 [skip ci]
  • ff7edbb fix(security): mitigate the "Open Redirect Vulnerability"
  • c1befa0 chore(release): 6.3.15 [skip ci]
  • d9dade2 fix(helper): make mkdirIfNotExists helper resilient to concurrent calls
  • 653c762 ci: prevent duplicate CI tasks on creating a PR
  • c97e562 chore(release): 6.3.14 [skip ci]
  • 91d5acd fix: remove string template from client code
  • 69cfc76 fix: warn when `singleRun` and `autoWatch` are `false`
  • 839578c fix(security): remove XSS vulnerability in `returnUrl` query param
  • db53785 chore(release): 6.3.13 [skip ci]
  • 5bf2df3 fix(deps): bump log4js to resolve security issue
  • 36ad678 chore(release): 6.3.12 [skip ci]
  • 41bed33 fix: remove depreciation warning from log4js
  • c985155 docs: create security.md
  • c96f0c5 chore(release): 6.3.11 [skip ci]
  • a5219c5 fix(deps): pin colors package to 1.4.0 due to security vulnerability
  • de0df2f test: fix version regex in the CLI test case
  • eddb2e8 chore(release): 6.3.10 [skip ci]
  • 0d24bd9 fix(logger): create parent folders if they are missing
  • b8eafe9 chore(release): 6.3.9 [skip ci]
  • cf318e5 test: add test case for restarting test run on file change
  • 92ffe60 fix: restartOnFileChange option not restarting the test run
  • b153355 style: fix grammar error in browser capture log message
  • 8f798d5 chore(release): 6.3.8 [skip ci]

See the full diff

Package name: karma-mocha The new version differs by 18 commits.

See the full diff

Package name: mocha The new version differs by 250 commits.
  • 5f96d51 build(v10.1.0): release
  • ed74f16 build(v10.1.0): update CHANGELOG
  • 51d4746 chore(devDeps): update 'ESLint' to v8 (#4926)
  • 4e06a6f fix(browser): increase contrast for replay buttons (#4912)
  • 41567df Support prefers-color-scheme: dark (#4896)
  • 61b4b92 fix the regular expression for function `clean` in `utils.js` (#4770)
  • 77c18d2 chore: use standard 'Promise.allSettled' instead of polyfill (#4905)
  • 84b2f84 chore(ci): upgrade GH actions to latest versions (#4899)
  • 023f548 build(v10.0.0): release
  • 62b1566 build(v10.0.0): update CHANGELOG
  • fbe7a24 chore: update dependencies (#4878)
  • 2b98521 docs: replace 'git.io' short links (#4877) [ci skip]
  • 007fa65 chore(ci): add Node v18 to test matrix (#4876)
  • f6695f0 chore(esm): remove code for Node v12 (#4874)
  • 59f6192 chore(ci): conditionally skip 'push' event (#4872)
  • b863359 docs: fix 'fgrep' url (#4873)
  • baaa41a chore(ci): ignore changes to docs files (#4871)
  • ac81cc5 refactor!: drop support of 'growl' notification (#4866)
  • 3946453 chore(deps)!: upgrade 'minimatch' (#4865)
  • 592905b refactor!: rename 'bin/mocha' to 'bin/mocha.js' (#4863)
  • b7b849b refactor!: remove deprecated Runner signature (#4861)
  • 0608fa3 chore(site): fix supporters' download (#4859)
  • 785aeb1 chore(test): drop AMD/'requirejs' (#4857)
  • ed640c4 chore(devDeps): upgrade 'coffee-script' (#4856)

See the full diff

Package name: webpack-dev-server The new version differs by 250 commits.
  • 5280ee7 docs: fix typo
  • d834582 chore(release): 4.7.3
  • 7b8c85b chore(deps): update `selfsigned` (#4170)
  • d598325 chore: fix lint
  • c1907f1 refactor: remove redundant `if` statements (#4158)
  • e535f25 ci: debug (#4144)
  • 75999bb chore(release): 4.7.2
  • 90a96f7 ci: fix (#4143)
  • f6bc644 fix: compatible with `onAfterSetupMiddleware`
  • 317e4b9 docs: fix testing instructions (#4133)
  • ff4550e test: remove redundant test cases related to 3rd party code (#4131)
  • 0dd1ee6 test: add e2e tests for `setupExitSignals` option (#4130)
  • afe4975 chore(release): 4.1.7
  • 4e5d8ea fix: droped `url` package (#4132)
  • b0c98f0 chore(release): 4.7.0
  • 3138213 chore(deps): update (#4127)
  • 8f02c3f feat: added types
  • f4fb15f fix: update description of `onAfterSetupMiddleware` and `onBeforeSetupMiddleware` options (#4126)
  • 37b73d5 test: add e2e test for `WEBPACK_SERVE` env variable (#4125)
  • f5a9d05 chore(deps-dev): bump eslint from 8.4.1 to 8.5.0 (#4121)
  • c9b959f chore(deps): bump ws from 8.3.0 to 8.4.0 (#4124)
  • 42208aa chore(deps-dev): bump lint-staged from 12.1.2 to 12.1.3 (#4122)
  • f440f84 chore(deps): bump express from 4.17.1 to 4.17.2 (#4120)
  • c13aa56 feat: added the `setupMiddlewares` option (#4068)

See the full diff

With a Snyk patch:
Severity Priority Score (*) Issue Exploit Maturity
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
npm:minimatch:20160620		 No Known Exploit
medium severity 469/1000
Why? Has a fix available, CVSS 5.1		 Remote Memory Exposure
npm:request:20160119		 No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Cross-site Scripting (XSS)
🦉 Open Redirect
🦉 More lessons are available in Snyk Learn

@snyk-bot
fix: node_modules/diff/package.json & node_modules/diff/.snyk to redu…
0231120 
…ce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-ENGINEIO-1056749
- https://snyk.io/vuln/SNYK-JS-ENGINEIO-3136336
- https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
- https://snyk.io/vuln/SNYK-JS-KARMA-2395349
- https://snyk.io/vuln/SNYK-JS-KARMA-2396325
- https://snyk.io/vuln/SNYK-JS-LOG4JS-2348757
- https://snyk.io/vuln/SNYK-JS-MINIMATCH-3050818
- https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/SNYK-JS-MOCHA-2863123
- https://snyk.io/vuln/SNYK-JS-MOCHA-561476
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2330875
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2331908
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430337
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430339
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430341
- https://snyk.io/vuln/SNYK-JS-SOCKETIO-1024859
- https://snyk.io/vuln/SNYK-JS-SOCKETIOPARSER-1056752
- https://snyk.io/vuln/SNYK-JS-SOCKETIOPARSER-3091012
- https://snyk.io/vuln/SNYK-JS-WS-1296835
- https://snyk.io/vuln/SNYK-JS-XMLHTTPREQUESTSSL-1082936
- https://snyk.io/vuln/SNYK-JS-XMLHTTPREQUESTSSL-1255647


The following vulnerabilities are fixed with a Snyk patch:
- https://snyk.io/vuln/npm:minimatch:20160620
- https://snyk.io/vuln/npm:request:20160119
@aliscco aliscco mentioned this pull request Jun 21, 2023
Open
@aliscco aliscco mentioned this pull request Dec 2, 2023
Open
# for free to join this conversation on GitHub. Already have an account? # to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@aliscco @snyk-bot