Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 42 vulnerabilities #82

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 42 vulnerabilities #82

wants to merge 1 commit into from

Conversation

snyk-bot
Copy link

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:

    • package.json
    • package-lock.json

  • Adding or updating a Snyk policy (.snyk) file; this file is required in order to apply Snyk vulnerability patches.
    Find out more.

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Prototype Pollution
SNYK-JS-AJV-584908		 Yes No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-ASYNC-2441827		 Yes Proof of Concept
high severity 630/1000
Why? Has a fix available, CVSS 8.1		 Internal Property Tampering
SNYK-JS-BSON-561052		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-GLOBPARENT-1016905		 Yes Proof of Concept
medium severity 484/1000
Why? Has a fix available, CVSS 5.4		 Open Redirect
SNYK-JS-GOT-2932019		 Yes No Known Exploit
high severity 584/1000
Why? Has a fix available, CVSS 7.4		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-HAWK-2808852		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-I18NEXT-1065979		 Yes No Known Exploit
medium severity 459/1000
Why? Has a fix available, CVSS 4.9		 Buffer Overflow
SNYK-JS-I18NEXT-575536		 Yes No Known Exploit
medium severity 561/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 4.8		 Prototype Pollution
SNYK-JS-I18NEXT-585930		 Yes Proof of Concept
medium severity 509/1000
Why? Has a fix available, CVSS 5.9		 Denial of Service (DoS)
SNYK-JS-JSYAML-173999		 Yes No Known Exploit
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Arbitrary Code Execution
SNYK-JS-JSYAML-174129		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Directory Traversal
SNYK-JS-MOMENT-2440688		 No No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MOMENT-2944238		 No Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Denial of Service (DoS)
SNYK-JS-MONGODB-473855		 Yes No Known Exploit
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-MONGOOSE-1086688		 Yes Proof of Concept
high severity 671/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7		 Prototype Pollution
SNYK-JS-MONGOOSE-2961688		 Yes Proof of Concept
medium severity 509/1000
Why? Has a fix available, CVSS 5.9		 Information Exposure
SNYK-JS-MONGOOSE-472486		 No No Known Exploit
medium severity 661/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.8		 Arbitrary Code Injection
SNYK-JS-MORGAN-72579		 No Proof of Concept
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-MPATH-1577289		 Yes Proof of Concept
high severity 579/1000
Why? Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-MPATH-72672		 No No Known Exploit
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-MQUERY-1050858		 Yes Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-MQUERY-1089718		 Yes Proof of Concept
high severity 751/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.6		 Command Injection
SNYK-JS-NODEMAILER-1038834		 Yes Proof of Concept
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 HTTP Header Injection
SNYK-JS-NODEMAILER-1296415		 Yes Proof of Concept
medium severity 454/1000
Why? Has a fix available, CVSS 4.8		 Session Fixation
SNYK-JS-PASSPORT-2840631		 No No Known Exploit
medium severity 641/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.4		 Command Injection
SNYK-JS-PM2-474304		 Yes Proof of Concept
medium severity 641/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.4		 Command Injection
SNYK-JS-PM2-474345		 Yes Proof of Concept
high severity 676/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.1		 Improper Privilege Management
SNYK-JS-SHELLJS-2332187		 Yes Proof of Concept
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 Prototype Pollution
SNYK-JS-UNDEFSAFE-548940		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090599		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090600		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090601		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090602		 Yes Proof of Concept
high severity 681/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.2		 Command Injection
SNYK-JS-VIZION-565230		 Yes Proof of Concept
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:braces:20180219		 No Proof of Concept
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 Prototype Pollution
npm:hoek:20180212		 Yes Proof of Concept
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:moment:20170905		 No No Known Exploit
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:validator:20180218		 Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: connect-mongo The new version differs by 90 commits.
  • 63ca966 docs: update readme and bump version to 3.0.0
  • aceb1ee chore: bump version to 3.0.0-rc.2
  • 0e4a234 test: add test cases on event listener
  • e77a7f1 test: replace mocha with jest (#324)
  • ad39e88 test: replace deprecated collection.insert to collection.insertOne
  • 545c06e docs: update README on testing
  • 2d5442e chore: upgrade depns mocha
  • 5d3a321 chore: upgrade nyc depns
  • 54cd91d chore: upgrade depns
  • afb7a12 docs: remove some badges
  • 6c2484b docs: update README for supporting version
  • c925c92 test: fix test case
  • 6827330 chore: bump version to 3.0.0-rc.1
  • f62692b ci: update .npmignore
  • aa2637d ci: remove node 6 support and add linting in travis
  • 801291b fix linting error
  • f928547 travis add test on Node 12
  • 12275f0 better linting
  • eb23b1e linting fix
  • 66194c7 bump major version to 3.0.0-rc
  • f29084f Wait for client open, before calling db. (#321)
  • d252bfc Install Stale bot
  • 15d91c1 Transparent crypto support (#314)
  • 08ccada Update readme refer to latest release to avoid confusion

See the full diff

Package name: express-validator The new version differs by 250 commits.
  • cd4136e 6.5.0
  • 612e2d9 Don't modify requests if oneOf chain didn't succeed (#877)
  • 7595c94 chain: comment out isDate for now
  • 8b604af chain: add missing methods to Validators interface
  • ab6ffe4 npm: upgrade validator to 13.0.0 (#874)
  • 29374cb 6.4.1
  • 70af46e npm: audit fix dependencies
  • efbfe3a Only consider . to be special char for now
  • 42819ae npm: update dependencies
  • 7736384 Remove console.log
  • 3814c0a Fix use of special chars in selectors
  • 0c450a9 docs: fix... typo? (#842)
  • 246f2ea docs: improve wording in matchedData page (#846)
  • 6123155 docs: improve wording in whole-body validation (#845)
  • 3124129 docs: fix typo in schema validation and improve wording (#844)
  • d85b368 docs: fix verb tense in the custom validator page (#841)
  • 19531ec docs: fix verb tense in the validationResult page (#847)
  • f868e23 docs: small fixes in the wildcard feature (#843)
  • 31d73c2 npm: add build script
  • 008a0ae docs: migrate usages of sanitize to check
  • 4bbe421 6.4.0
  • acb2ad7 npm: run docs:build before git add on versioning
  • 5e293cf Compile TS to ES2017 (#826)
  • 0163461 npm: upgrade a few packages (#825)

See the full diff

Package name: i18next The new version differs by 250 commits.
  • aeab3ca 19.8.5
  • f58c423 new version
  • 932f5f6 fix potential prototype pollution when backend plugin resolves a malicious language value
  • 2dc8267 Merge pull request #1533 from pravi/update-rollup-plugin-babel
  • dae2b32 chore: update build dependency (use @ rollup/plugin-babel)
  • 4f9ef14 Merge pull request #1532 from pravi/update-node-resolve-plugin
  • a90fb69 chore: update rollup and plugins
  • ad88092 use fallbackLng as default lng
  • ba564b3 19.8.4
  • 1816290 prepare new release
  • 1ed5a71 Updated FormatFunction signature to match codebase (#1520)
  • 2516e89 Update config.yml
  • 94dd384 Update config.yml
  • 877e250 commit build result
  • fa98508 Merge pull request #1518 from KristjanESPERANTO/patch-1
  • 749519e Update URLs
  • 03ef4ed 19.8.3
  • ed6169f fix prototype pollution with constructor
  • 5d808cd updated @ babel/runtime to ^7.12.0, runtime file extensions issue resolved (#1513)
  • cb780ad 19.8.2
  • d736006 allow nesting recursively with context (could theoretically generate infinite loop, prevented in #1480)
  • 685aa0f 19.8.1
  • b44f64c log optimizations for clone instances
  • ba2613b 19.8.0

See the full diff

Package name: i18next-node-fs-backend The new version differs by 40 commits.
  • 41d4166 update changelog
  • ccffd22 Merge pull request #238 from ceastman-ibm/patch-1
  • 67ee4c2 Update js-yaml to a non vulnerable version
  • 26e20ac rebuild
  • 13157e2 Merge pull request #237 from felixmosh/fix-236
  • 229a7f1 Bump dep versions due to DOS vulnerability
  • 0056a49 Merge pull request #233 from ffflorian/patch-1
  • 714e078 Add repository to package.json
  • 7e946e7 rebuild
  • 1122cb7 Merge pull request #230 from jonathanz/patch-1
  • 14844ac fix [ReferenceError: language is not defined]
  • 6135a7f update version
  • 07ac0af rebuild
  • 7952dec Merge pull request #226 from lovro-bikic/master
  • 6854cc4 update addPath to support functions and paths
  • f061442 change `var` to `let` in src
  • 19b5b0d fix dependencies
  • cfdc02c transpile to ES5
  • ca9f110 run build script
  • 4e1afb2 update loadPath to support functions as parameters
  • 479ac5f update travis target
  • 97d8d7a remove dep
  • bd52d90 remove cson parser, adds option.parse for custom parsing
  • 209127a Update README.md

See the full diff

Package name: less The new version differs by 127 commits.
  • b873737 Merge pull request #3177 from Kartoffelsalat/master
  • bd2a93f chore(package): update request to 2.83.0
  • 3699921 Merge pull request #3170 from thorn0/patch-1
  • 6985541 Having `inline` and `less` imports of the same name lead to a race condition
  • 2f1386f Merge pull request #3168 from matthew-dean/master
  • 4272871 Fixes #3116 - lessc not loading plugins in 3.0
  • ba5ad9c Point badges at master branch
  • 4962988 Update CHANGELOG.md
  • 12fe0c6 Update README.md
  • 45d06b9 Merge pull request #3163 from matthew-dean/master
  • 9590b7b Add dist files
  • 0b6536b Merge branch '3.x'
  • a48c24c calc() fix - fixes #974 (partially #1880)
  • 367b46a Merge pull request #3161 from matthew-dean/3.x
  • 4508495 Remove legacy upgrade
  • 2a4a63a Update CHANGELOG.md with 3.x list
  • bb6da28 Update README.md
  • f80a021 Merge pull request #3159 from matthew-dean/3.x
  • 8b4524f Bump to 3.0.0-RC.1
  • d30e3a6 Merge pull request #3150 from anthony-redFox/3.x
  • 0b7c81c Removed install npm 2 version for appveyor. It was hotfix for old node version.
  • 5d230dd Drop node 0.10 and 0.12 and added node 9 matrix testing
  • 385da8f Update stale.yml
  • d384779 Create stale.yml

See the full diff

Package name: mongoose The new version differs by 250 commits.
  • ca7996b chore: release 5.13.15
  • e75732a Merge pull request #12307 from Automattic/vkarpov15/fix-5x-build
  • a1144dc test: run node 7 tests with upgraded npm re: #12297
  • dfc4ad7 test: try upgrading npm for node v4 tests re: #12297
  • b9e985c test: more strict @ types/node version
  • 4d813fa test: fix @ types/node version in tests re: #12297
  • 99b4189 Merge pull request #12297 from shubanker/issue/prototype-pollution-5.x-patch
  • 5eb11dd made function non async
  • 6a19731 fix(schema): disallow setting __proto__ when creating schema with dotted properties
  • a2ec28d Merge pull request #11366 from laissonsilveira/5.x
  • 05ce577 Fix broken link from findandmodify method deprecation
  • d2b846f chore: release 5.13.14
  • 69c1f6c docs(models): fix up nModified example for 5.x
  • 4cfc4d6 fix(timestamps): avoid setting `createdAt` on documents that already exist but dont have createdAt
  • a738440 chore: release 5.13.13
  • 4d12a62 Merge pull request #10942 from jneal-afs/fix-query-set-ts-type
  • c3463c4 Merge pull request #10916 from iovanom/gh-10902-v5
  • ff5ddb5 fix: hardcode base 10 for nodeMajorVersion parseInt() call
  • d205c4d make value optional
  • c6fd7f7 Fix ts types for query set
  • 22e9b3b [gh-10902 v5] Add node major version to utils
  • 5468642 [gh-10902 v5] Emit end event in before close
  • 271bc60 Merge pull request #10910 from lorand-horvath/patch-2
  • b7ebeec Update mongodb driver to 3.7.3

See the full diff

Package name: morgan The new version differs by 27 commits.

See the full diff

Package name: nodemailer The new version differs by 193 commits.

See the full diff

Package name: nodemon The new version differs by 250 commits.
  • 27e91c3 fix: update packge-lock
  • 0144e4f fix: bump update-notifier to v6.0.0 (#2029)
  • c870342 chore: update supporters
  • 5c0b472 chore: add supporter
  • e26aaa9 fix: support windows by using path.delimiter
  • 9d1afd7 docs: add syntax highlighting to sample-nodemon.md (#1982) (#2004)
  • de5d32a docs: Unified Node.js capitalization (#1986)
  • e890927 docs: add note to faq with example showing how to watch any file extension (#1931)
  • bc4547b chore: update sponsors
  • 07159c5 chore: add supporters
  • cd100da chore: update supporters
  • 6a34922 chore: supporters
  • e5d6067 chore: updating supporters
  • 242f9f7 Merge branch 'main' of github.com:remy/nodemon
  • 141e58c chore: update supporters
  • 53422af ci(release): workflow uses 'npm' cache (#1933)
  • 581c641 ci(node.js): workflow uses 'npm' cache (#1934)
  • cb1c8b9 docs: Fix typo in faq.md (#1950)
  • 54784ab fix: bump prod dep versions
  • 26db983 chore: update supporters
  • 61e7abd fix: add windows signals SIGUSR2 & SIGUSR1 to terminate the process (#1938)
  • b449171 docs: Fix typo in faq.md
  • 0a3175f chore: update supporters
  • 18516d8 chore: add supporter

See the full diff

Package name: passport The new version differs by 160 commits.

See the full diff

Package name: pm2 The new version differs by 250 commits.

See the full diff

Package name: validator The new version differs by 250 commits.
  • 47ee5ad 13.7.0
  • 496fc8b fix(rtrim): remove regex to prevent ReDOS attack (#1738)
  • 45901ec Merge pull request #1851 from validatorjs/chore/fix-merge-conflicts
  • 83cb7f8 chore: merge conflict clean-up
  • f17e220 feat(isMobilePhone): add El Salvador es-SV locale
  • 5b06703 feat(isMobilePhone): add Palestine ar-PS locale
  • a3faa83 feat(isMobilePhone): add Botswana en-BW locale
  • 26605f9 feat(isMobilePhone): add Turkmenistan tk-TM
  • 0e5d5d4 feat(isMobilePhone): add Guyana en-GY locale
  • f7ff349 feat(isMobilePhone): add Frech Polynesia fr-PF locale
  • 8627e48 feat(isMobilePhone): add Kiribati en-KI locale
  • ed60123 feat(isMobilePhone): add Tajikistan tg-TJ locale (#1846)
  • c96d805 feat(isMobilePhone): add Maldives dv-MV locale
  • 5c2d69e feat(isMobilePhone): regex for Burkina Faso fr-BF and Namibia en-NA locales
  • fc0fefc feat(isMobilePhone): add Bhutan dz-BT locale (#1770)
  • 01d3da3 feat(isMobilePhone): add Tajikistan tg-TJ locale (#1846)
  • a...

@snyk-bot
fix: package.json, package-lock.json & .snyk to reduce vulnerabilities
97846fb 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-AJV-584908
- https://snyk.io/vuln/SNYK-JS-ASYNC-2441827
- https://snyk.io/vuln/SNYK-JS-BSON-561052
- https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
- https://snyk.io/vuln/SNYK-JS-GOT-2932019
- https://snyk.io/vuln/SNYK-JS-HAWK-2808852
- https://snyk.io/vuln/SNYK-JS-I18NEXT-1065979
- https://snyk.io/vuln/SNYK-JS-I18NEXT-575536
- https://snyk.io/vuln/SNYK-JS-I18NEXT-585930
- https://snyk.io/vuln/SNYK-JS-JSYAML-173999
- https://snyk.io/vuln/SNYK-JS-JSYAML-174129
- https://snyk.io/vuln/SNYK-JS-MOMENT-2440688
- https://snyk.io/vuln/SNYK-JS-MOMENT-2944238
- https://snyk.io/vuln/SNYK-JS-MONGODB-473855
- https://snyk.io/vuln/SNYK-JS-MONGOOSE-1086688
- https://snyk.io/vuln/SNYK-JS-MONGOOSE-2961688
- https://snyk.io/vuln/SNYK-JS-MONGOOSE-472486
- https://snyk.io/vuln/SNYK-JS-MORGAN-72579
- https://snyk.io/vuln/SNYK-JS-MPATH-1577289
- https://snyk.io/vuln/SNYK-JS-MPATH-72672
- https://snyk.io/vuln/SNYK-JS-MQUERY-1050858
- https://snyk.io/vuln/SNYK-JS-MQUERY-1089718
- https://snyk.io/vuln/SNYK-JS-NODEMAILER-1038834
- https://snyk.io/vuln/SNYK-JS-NODEMAILER-1296415
- https://snyk.io/vuln/SNYK-JS-PASSPORT-2840631
- https://snyk.io/vuln/SNYK-JS-PM2-474304
- https://snyk.io/vuln/SNYK-JS-PM2-474345
- https://snyk.io/vuln/SNYK-JS-SHELLJS-2332187
- https://snyk.io/vuln/SNYK-JS-UNDEFSAFE-548940
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090599
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090600
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090601
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090602
- https://snyk.io/vuln/SNYK-JS-VIZION-565230
- https://snyk.io/vuln/npm:braces:20180219
- https://snyk.io/vuln/npm:hoek:20180212
- https://snyk.io/vuln/npm:moment:20170905
- https://snyk.io/vuln/npm:validator:20180218


The following vulnerabilities are fixed with a Snyk patch:
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
- https://snyk.io/vuln/npm:extend:20180424
- https://snyk.io/vuln/npm:hoek:20180212
- https://snyk.io/vuln/npm:moment:20170905
- https://snyk.io/vuln/npm:stringstream:20180511
- https://snyk.io/vuln/npm:uglify-js:20151024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
1 participant
@snyk-bot