-
Notifications
You must be signed in to change notification settings - Fork 1
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chore(deps): update peerdependency sequelize to v6 [security] #28
Open
renovate
wants to merge
1
commit into
master
Choose a base branch
from
renovate/npm-sequelize-vulnerability
base: master
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
11fb72b
to
7266b3e
Compare
7266b3e
to
f856c7b
Compare
f856c7b
to
db33c74
Compare
db33c74
to
f65b458
Compare
f65b458
to
40f5011
Compare
40f5011
to
0707672
Compare
0707672
to
464dd73
Compare
464dd73
to
25e9f4a
Compare
25e9f4a
to
72565d0
Compare
72565d0
to
88498ee
Compare
88498ee
to
7b9ba2b
Compare
7b9ba2b
to
3960bd5
Compare
3960bd5
to
a67d5f5
Compare
a67d5f5
to
09033cf
Compare
09033cf
to
4297075
Compare
4297075
to
f7f2e72
Compare
f7f2e72
to
e33db54
Compare
e33db54
to
ba37ca3
Compare
8903db9
to
1685525
Compare
1685525
to
148d348
Compare
148d348
to
3131ced
Compare
|
3131ced
to
5767602
Compare
5767602
to
b2c6920
Compare
b2c6920
to
358e906
Compare
358e906
to
e599815
Compare
e599815
to
11d0217
Compare
11d0217
to
99d88be
Compare
99d88be
to
bc2ea1d
Compare
bc2ea1d
to
1d2378b
Compare
1d2378b
to
0b653a5
Compare
0b653a5
to
ca80634
Compare
ca80634
to
26e7d77
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
None yet
0 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^4.41
->^6.29.0
4.41.0
->6.29.0
GitHub Vulnerability Alerts
CVE-2019-10752
Affected versions of
sequelize
are vulnerable to SQL Injection. The functionsequelize.json()
incorrectly formatted sub paths for JSON queries, which allows attackers to inject SQL statements and execute arbitrary SQL queries if user input is passed to the query. Exploitation example:Recommendation
If you are using
sequelize
5.x, upgrade to version 5.15.1 or later.If you are using
sequelize
4.x, upgrade to version 4.44.3 or later.CVE-2019-10748
Affected versions of
sequelize
are vulnerable to SQL Injection. The package fails to sanitize JSON path keys in the MariaDB and MySQL dialects, which may allow attackers to inject SQL statements and execute arbitrary SQL queries.Recommendation
If you are using
sequelize
5.x, upgrade to version 5.8.11 or later.If you are using
sequelize
4.x, upgrade to version 4.44.3 or later.If you are using
sequelize
3.x, upgrade to version 3.35.1 or later.GHSA-fw4p-36j9-rrj3
Versions of
sequelize
prior to 4.44.4 are vulnerable to Denial of Service (DoS). The SQLite dialect fails to catch aTypeError
exception for theresults
variable. Theresults
value may be undefined and trigger the error on a.map
call. This may allow attackers to submit malicious input that forces the exception and crashes the Node process.The following proof-of-concept crashes the Node process:
Recommendation
Upgrade to version 4.44.4 or later.
CVE-2023-25813
Impact
The SQL injection exploit is related to replacements. Here is such an example:
In the following query, some parameters are passed through replacements, and some are passed directly through the
where
option.This is a very legitimate use case, but this query was vulnerable to SQL injection due to how Sequelize processed the query: Sequelize built a first query using the
where
option, then passed it over tosequelize.query
which parsed the resulting SQL to inject all:replacements
.If the user passed values such as
Sequelize would first generate this query:
Then would inject replacements in it, which resulted in this:
As you can see this resulted in arbitrary user-provided SQL being executed.
Patches
The issue was fixed in Sequelize 6.19.1
Workarounds
Do not use the
replacements
and thewhere
option in the same query if you are not using Sequelize >= 6.19.1References
See this thread for more information: https://github.com/sequelize/sequelize/issues/14519
Snyk: https://security.snyk.io/vuln/SNYK-JS-SEQUELIZE-2932027
CVE-2023-22580
Due to improper input filtering in the sequelize js library, can malicious queries lead to sensitive information disclosure.
CVE-2023-22579
Impact
Providing an invalid value to the
where
option of a query caused Sequelize to ignore that option instead of throwing an error.A finder call like the following did not throw an error:
As this option is typically used with plain javascript objects, be aware that this only happens at the top level of this option.
Patches
This issue has been patched in
sequelize@6.28.1
&@sequelize/core@7.0.0.alpha-20
References
A discussion thread about this issue is open at https://github.com/sequelize/sequelize/discussions/15698
CVE: CVE-2023-22579
Snyk: https://security.snyk.io/vuln/SNYK-JS-SEQUELIZE-3324090
CVE-2023-22578
Impact
Sequelize 6.28.2 and prior has a dangerous feature where using parentheses in the attribute option would make Sequelize use the string as-is in the SQL
Produced
Patches
This feature was deprecated in Sequelize 5, and using it prints a deprecation warning.
This issue has been patched in
@sequelize/core@7.0.0.alpha-20
andsequelize@6.29.0
.In Sequelize 7, it now produces the following:
In Sequelize 6, it throws an error explaining that we had to introduce a breaking change, and requires the user to explicitly opt-in to either the Sequelize 7 behavior (always escape) or the Sequelize 5 behavior (inline attributes that include
()
without escaping). See https://github.com/sequelize/sequelize/pull/15710 for more information.Mitigations
Do not use user-provided content to build your list or attributes. If you do, make sure that attribute in question actually exists on your model by checking that it exists in the
rawAttributes
property of your model first.A discussion thread about this issue is open at https://github.com/sequelize/sequelize/discussions/15694
CVE: CVE-2023-22578
Release Notes
sequelize/sequelize (sequelize)
v6.29.0
Compare Source
Features
v6.28.2
Compare Source
Bug Fixes
v6.28.1
Compare Source
Bug Fixes
v6.28.0
Compare Source
Features
v6.27.0
Compare Source
Features
v6.26.0
Compare Source
Features
v6.25.8
Compare Source
Bug Fixes
v6.25.7
Compare Source
Bug Fixes
v6.25.6
Compare Source
Bug Fixes
v6.25.5
Compare Source
Bug Fixes
v6.25.4
Compare Source
Bug Fixes
v6.25.3
Compare Source
Bug Fixes
v6.25.2
Compare Source
Bug Fixes
InferAttributes
(v6) (#15135) (851daaf)v6.25.1
Compare Source
Bug Fixes
v6.25.0
Compare Source
Features
dialectOptions.connectString
(#15042) (06ad05d)v6.24.0
Compare Source
Features
QueryGenerator#tableExistsQuery
(#15087) (a44772e)v6.23.2
Compare Source
Bug Fixes
v6.23.1
Compare Source
Bug Fixes
v6.23.0
Compare Source
Features
v6.22.1
Compare Source
Bug Fixes
v6.22.0
Compare Source
Features
v6.21.6
Compare Source
Bug Fixes
v6.21.5
Compare Source
Bug Fixes
v6.21.4
Compare Source
Bug Fixes
v6.21.3
Compare Source
Bug Fixes
v6.21.2
Compare Source
Bug Fixes
$
infn
args (#14678) (7bb60e3)v6.21.1
Compare Source
Bug Fixes
v6.21.0
Compare Source
Features
v6.20.1
Compare Source
Bug Fixes
v6.20.0
Compare Source
Features
v6.19.2
Compare Source
Bug Fixes
ARRAY[]
& followed by;
(#14518) (e37c572)v6.19.1
Compare Source
Bug Fixes
:replacements
inside of strings (#14472) (ccaa399)v6.19.0
Compare Source
Bug Fixes
WhereOptions
more accurate (#14368) (0d0aade)Features
Model.init
aware of pre-configured foreign keys (#14370) (5954d2c)v6.18.0
Compare Source
Features
v6.17.0
Compare Source
Bug Fixes
GroupedCountResultItem
interface (#14154) (a81b7ab)Model.update
(#14155) (b80aeed)Features
Model.getAttributes
stricter (#14017) (e974e20)v6.16.3
Compare Source
Bug Fixes
v6.16.2
Compare Source
Bug Fixes
v6.16.1
Compare Source
Bug Fixes
package.json
in Sequelize.version (#14073) (b95c213)v6.16.0
Compare Source
Features
v6.15.1
Compare Source
Bug Fixes
$nested.syntax$
in WhereAttributeHash (#13983) (4a513cf)Sequelize.where
(#14018) (99c612b)v6.15.0
Compare Source
Bug Fixes
Features
Sequelize#query
method (#13881) (7c58851)v6.14.1
Compare Source
Bug Fixes
v6.14.0
Compare Source
Bug Fixes
count
andfindAndCountAll
(#13786) (b06c1fc)Features
InferAttributes
utility type (#13909) (fd42687)v6.13.0
Compare Source
Bug Fixes
Features
v6.12.5
Compare Source
Bug Fixes
v6.12.4
Compare Source
Bug Fixes
v6.12.3
Compare Source
Bug Fixes
v6.12.2
Compare Source
Bug Fixes
v6.12.1
Compare Source
Bug Fixes
v6.12.0
Compare Source
Bug Fixes
Features
v6.11.0
Compare Source
Features
v6.10.0
Compare Source
Bug Fixes
Features
v6.9.0
Compare Source
Bug Fixes
Features
v6.8.0
Compare Source
Bug Fixes
isIn
validator (#12962) (d511d91)findCreateFind
to work with postgres transactions (#13482) (84421d7)subQuery
tofalse
(#13490) (0943339)Features
query_timeout
dialect option (#13258) (3ca085d)v6.7.0
Compare Source
Bug Fixes
Features
v6.6.5
Compare Source
Bug Fixes
v6.6.4
Compare Source
Bug Fixes
Transactionable
compatible withTransactionOptions
(#13334) (cd2de40)ARRAY(ENUM)
(#13210) (1cfbd33)ignoreDuplicates
option (#13220) (b33d78e)schema
for queryInterface methods (#13223) (6b0b532)returning
can specify column names (#13215) (143cc84)ON CONFLICT
with unique index (#13345) (6dcb565)v6.6.2
Compare Source
Bug Fixes
Model.prototype.previous()
(#13042) (5b16b32)v6.6.1
Compare Source
Bug Fixes
AND
in sql fornot
/between
(#13043) (a663c54)(keyof TAttributes)[]
inUpdateOptions.returning
(#13130) (97ba242)string
fromOrder
type (#13057) (ac39f8a)v6.6.0
Compare Source
Bug Fixes
sequelize.col
inattributes
(#13105) (3fd64cb)WhereValue
(#13028) (8892507)queryGenerator
property (#13126) (9cb4d7f)Model#previous
type (#13106) (466e361)ValidationErrorItem
types (#13108) (e35a9bf)Features
deferrable
option (#13096) (f98bd7e)v6.5.1
Compare Source
Bug Fixes
null
(#13093) (ced4dc7)v6.5.0
Compare Source
Second release in 2021! 🎉
Bug Fixes
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.