-
Notifications
You must be signed in to change notification settings - Fork 2
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(deps): update dependency sequelize to v6 [security] #68
Open
renovate
wants to merge
1
commit into
master
Choose a base branch
from
renovate/npm-sequelize-vulnerability
base: master
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
9e13b25
to
968253d
Compare
7034d40
to
fb80aa3
Compare
dc0cfde
to
f718004
Compare
5d6aea5
to
1fe5267
Compare
1fe5267
to
c90c9f4
Compare
d7c4026
to
054825f
Compare
1dabf76
to
632a5eb
Compare
d501fbd
to
1213393
Compare
90d1c15
to
bc0a5e3
Compare
0b0585d
to
67d6549
Compare
67d6549
to
7493f82
Compare
2b1225a
to
6deafbf
Compare
7f59261
to
808b0b3
Compare
4a0c6bb
to
fc4bc22
Compare
e7b1670
to
0f60c49
Compare
178d3dd
to
efc3e14
Compare
d03d838
to
786a032
Compare
6f69416
to
b0b0ea8
Compare
77e05d8
to
464f74b
Compare
64988b0
to
7afeca4
Compare
03f77f1
to
e739a9c
Compare
e739a9c
to
c4db120
Compare
c4db120
to
1695be5
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
None yet
0 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^4.17.2
->^6.29.0
GitHub Vulnerability Alerts
CVE-2023-25813
Impact
The SQL injection exploit is related to replacements. Here is such an example:
In the following query, some parameters are passed through replacements, and some are passed directly through the
where
option.This is a very legitimate use case, but this query was vulnerable to SQL injection due to how Sequelize processed the query: Sequelize built a first query using the
where
option, then passed it over tosequelize.query
which parsed the resulting SQL to inject all:replacements
.If the user passed values such as
Sequelize would first generate this query:
Then would inject replacements in it, which resulted in this:
As you can see this resulted in arbitrary user-provided SQL being executed.
Patches
The issue was fixed in Sequelize 6.19.1
Workarounds
Do not use the
replacements
and thewhere
option in the same query if you are not using Sequelize >= 6.19.1References
See this thread for more information: https://github.com/sequelize/sequelize/issues/14519
Snyk: https://security.snyk.io/vuln/SNYK-JS-SEQUELIZE-2932027
CVE-2023-22580
Due to improper input filtering in the sequelize js library, can malicious queries lead to sensitive information disclosure.
CVE-2023-22579
Impact
Providing an invalid value to the
where
option of a query caused Sequelize to ignore that option instead of throwing an error.A finder call like the following did not throw an error:
As this option is typically used with plain javascript objects, be aware that this only happens at the top level of this option.
Patches
This issue has been patched in
sequelize@6.28.1
&@sequelize/core@7.0.0.alpha-20
References
A discussion thread about this issue is open at https://github.com/sequelize/sequelize/discussions/15698
CVE: CVE-2023-22579
Snyk: https://security.snyk.io/vuln/SNYK-JS-SEQUELIZE-3324090
CVE-2023-22578
Impact
Sequelize 6.28.2 and prior has a dangerous feature where using parentheses in the attribute option would make Sequelize use the string as-is in the SQL
Produced
Patches
This feature was deprecated in Sequelize 5, and using it prints a deprecation warning.
This issue has been patched in
@sequelize/core@7.0.0.alpha-20
andsequelize@6.29.0
.In Sequelize 7, it now produces the following:
In Sequelize 6, it throws an error explaining that we had to introduce a breaking change, and requires the user to explicitly opt-in to either the Sequelize 7 behavior (always escape) or the Sequelize 5 behavior (inline attributes that include
()
without escaping). See https://github.com/sequelize/sequelize/pull/15710 for more information.Mitigations
Do not use user-provided content to build your list or attributes. If you do, make sure that attribute in question actually exists on your model by checking that it exists in the
rawAttributes
property of your model first.A discussion thread about this issue is open at https://github.com/sequelize/sequelize/discussions/15694
CVE: CVE-2023-22578
Release Notes
sequelize/sequelize (sequelize)
v6.29.0
Compare Source
Features
v6.28.2
Compare Source
Bug Fixes
v6.28.1
Compare Source
Bug Fixes
v6.28.0
Compare Source
Features
v6.27.0
Compare Source
Features
v6.26.0
Compare Source
Features
v6.25.8
Compare Source
Bug Fixes
v6.25.7
Compare Source
Bug Fixes
v6.25.6
Compare Source
Bug Fixes
v6.25.5
Compare Source
Bug Fixes
v6.25.4
Compare Source
Bug Fixes
v6.25.3
Compare Source
Bug Fixes
v6.25.2
Compare Source
Bug Fixes
InferAttributes
(v6) (#15135) (851daaf)v6.25.1
Compare Source
Bug Fixes
v6.25.0
Compare Source
Features
dialectOptions.connectString
(#15042) (06ad05d)v6.24.0
Compare Source
Features
QueryGenerator#tableExistsQuery
(#15087) (a44772e)v6.23.2
Compare Source
Bug Fixes
v6.23.1
Compare Source
Bug Fixes
v6.23.0
Compare Source
Features
v6.22.1
Compare Source
Bug Fixes
v6.22.0
Compare Source
Features
v6.21.6
Compare Source
Bug Fixes
v6.21.5
Compare Source
Bug Fixes
v6.21.4
Compare Source
Bug Fixes
v6.21.3
Compare Source
Bug Fixes
v6.21.2
Compare Source
Bug Fixes
$
infn
args (#14678) (7bb60e3)v6.21.1
Compare Source
Bug Fixes
v6.21.0
Compare Source
Features
v6.20.1
Compare Source
Bug Fixes
v6.20.0
Compare Source
Features
v6.19.2
Compare Source
Bug Fixes
ARRAY[]
& followed by;
(#14518) (e37c572)v6.19.1
Compare Source
Bug Fixes
:replacements
inside of strings (#14472) (ccaa399)v6.19.0
Compare Source
Bug Fixes
WhereOptions
more accurate (#14368) (0d0aade)Features
Model.init
aware of pre-configured foreign keys (#14370) (5954d2c)v6.18.0
Compare Source
Features
v6.17.0
Compare Source
Bug Fixes
GroupedCountResultItem
interface (#14154) (a81b7ab)Model.update
(#14155) (b80aeed)Features
Model.getAttributes
stricter (#14017) (e974e20)v6.16.3
Compare Source
Bug Fixes
v6.16.2
Compare Source
Bug Fixes
v6.16.1
Compare Source
Bug Fixes
package.json
in Sequelize.version (#14073) (b95c213)v6.16.0
Compare Source
Features
v6.15.1
Compare Source
Bug Fixes
$nested.syntax$
in WhereAttributeHash (#13983) (4a513cf)Sequelize.where
(#14018) (99c612b)v6.15.0
Compare Source
Bug Fixes
Features
Sequelize#query
method (#13881) (7c58851)v6.14.1
Compare Source
Bug Fixes
v6.14.0
Compare Source
Bug Fixes
count
andfindAndCountAll
(#13786) (b06c1fc)Features
InferAttributes
utility type (#13909) (fd42687)v6.13.0
Compare Source
Bug Fixes
Features
v6.12.5
Compare Source
Bug Fixes
v6.12.4
Compare Source
Bug Fixes
v6.12.3
Compare Source
Bug Fixes
v6.12.2
Compare Source
Bug Fixes
v6.12.1
Compare Source
Bug Fixes
v6.12.0
Compare Source
Bug Fixes
Features
v6.11.0
Compare Source
Features
v6.10.0
Compare Source
Bug Fixes
Features
v6.9.0
Compare Source
Bug Fixes
Features
v6.8.0
Compare Source
Bug Fixes
isIn
validator (#12962) (d511d91)findCreateFind
to work with postgres transactions (#13482) (84421d7)subQuery
tofalse
(#13490) (0943339)Features
query_timeout
dialect option (#13258) (3ca085d)v6.7.0
Compare Source
Bug Fixes
Features
v6.6.5
Compare Source
Bug Fixes
v6.6.4
Compare Source
Bug Fixes
Transactionable
compatible withTransactionOptions
(#13334) (cd2de40)ARRAY(ENUM)
(#13210) (1cfbd33)ignoreDuplicates
option (#13220) (b33d78e)schema
for queryInterface methods (#13223) (6b0b532)returning
can specify column names (#13215) (143cc84)ON CONFLICT
with unique index (#13345) (6dcb565)v6.6.2
Compare Source
Bug Fixes
Model.prototype.previous()
(#13042) (5b16b32)v6.6.1
Compare Source
Bug Fixes
AND
in sql fornot
/between
(#13043) (a663c54)(keyof TAttributes)[]
inUpdateOptions.returning
(#13130) (97ba242)string
fromOrder
type (#13057) (ac39f8a)v6.6.0
Compare Source
Bug Fixes
sequelize.col
inattributes
(#13105) (3fd64cb)WhereValue
(#13028) (8892507)queryGenerator
property (#13126) (9cb4d7f)Model#previous
type (#13106) (466e361)ValidationErrorItem
types (#13108) (e35a9bf)Features
deferrable
option (#13096) (f98bd7e)v6.5.1
Compare Source
Bug Fixes
null
(#13093) (ced4dc7)v6.5.0
Compare Source
Second release in 2021! 🎉
Bug Fixes
Features
@@​
operator (#12955) (e45df29)v6.4.0
Compare Source
First release in 2021! 🎉
Bug Fixes
Features
v6.3.5
Compare Source
Bug Fixes
await
in truncate all models with cascade (#12664) (933b3f6)v6.3.4
Compare Source
Bug Fixes
true
timestamp fields correctly (#12580) (#12581) (490db41)v6.3.3
Compare Source
Bug Fixes
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.