Skip to content
This repository has been archived by the owner on Feb 3, 2023. It is now read-only.

storage-1.2.0.tgz: 8 vulnerabilities (highest severity is: 7.8) #44

Open
mend-for-github-com bot opened this issue Jun 7, 2022 · 0 comments
Open

storage-1.2.0.tgz: 8 vulnerabilities (highest severity is: 7.8) #44

mend-for-github-com bot opened this issue Jun 7, 2022 · 0 comments
Labels
security vulnerability Security vulnerability detected by Mend

Comments

@mend-for-github-com
Copy link

mend-for-github-com bot commented Jun 7, 2022 •
edited
Loading

Vulnerable Library - storage-1.2.0.tgz

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (storage version) Remediation Available
CVE-2021-43138 High 7.8 async-2.6.1.tgz Transitive 3.0.0 ❌
CVE-2022-24772 High 7.5 node-forge-0.7.5.tgz Transitive 5.0.0 ❌
CVE-2022-24771 High 7.5 node-forge-0.7.5.tgz Transitive 5.0.0 ❌
CVE-2020-8116 High 7.3 dot-prop-4.2.0.tgz Transitive 1.2.1 ❌
CVE-2020-7720 High 7.3 node-forge-0.7.5.tgz Transitive 1.6.0 ❌
WS-2022-0008 Medium 6.6 node-forge-0.7.5.tgz Transitive 5.0.0 ❌
CVE-2022-0122 Medium 6.1 node-forge-0.7.5.tgz Transitive 5.0.0 ❌
CVE-2022-24773 Medium 5.3 node-forge-0.7.5.tgz Transitive 5.0.0 ❌

Details

CVE-2021-43138

Vulnerable Library - async-2.6.1.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-2.6.1.tgz

Dependency Hierarchy:

  • storage-1.2.0.tgz (Root Library)
    • ❌ async-2.6.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

Publish Date: 2022-04-06

URL: CVE-2021-43138

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138

Release Date: 2022-04-06

Fix Resolution (async): 2.6.4

Direct dependency fix Resolution (@google-cloud/storage): 3.0.0

CVE-2022-24772

Vulnerable Library - node-forge-0.7.5.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.7.5.tgz

Dependency Hierarchy:

  • storage-1.2.0.tgz (Root Library)
    • common-0.13.6.tgz
      • google-auto-auth-0.7.2.tgz
        • google-auth-library-0.10.0.tgz
          • gtoken-1.2.3.tgz
            • google-p12-pem-0.1.2.tgz
              • ❌ node-forge-0.7.5.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24772

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24772

Release Date: 2022-03-18

Fix Resolution (node-forge): 1.3.0

Direct dependency fix Resolution (@google-cloud/storage): 5.0.0

CVE-2022-24771

Vulnerable Library - node-forge-0.7.5.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.7.5.tgz

Dependency Hierarchy:

  • storage-1.2.0.tgz (Root Library)
    • common-0.13.6.tgz
      • google-auto-auth-0.7.2.tgz
        • google-auth-library-0.10.0.tgz
          • gtoken-1.2.3.tgz
            • google-p12-pem-0.1.2.tgz
              • ❌ node-forge-0.7.5.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24771

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24771

Release Date: 2022-03-18

Fix Resolution (node-forge): 1.3.0

Direct dependency fix Resolution (@google-cloud/storage): 5.0.0

CVE-2020-8116

Vulnerable Library - dot-prop-4.2.0.tgz

Get, set, or delete a property from a nested object using a dot path

Library home page: https://registry.npmjs.org/dot-prop/-/dot-prop-4.2.0.tgz

Dependency Hierarchy:

  • storage-1.2.0.tgz (Root Library)
    • gcs-resumable-upload-0.8.2.tgz
      • configstore-3.1.2.tgz
        • ❌ dot-prop-4.2.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

Publish Date: 2020-02-04

URL: CVE-2020-8116

CVSS 3 Score Details (7.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8116

Release Date: 2020-02-04

Fix Resolution (dot-prop): 4.2.1

Direct dependency fix Resolution (@google-cloud/storage): 1.2.1

CVE-2020-7720

Vulnerable Library - node-forge-0.7.5.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.7.5.tgz

Dependency Hierarchy:

  • storage-1.2.0.tgz (Root Library)
    • common-0.13.6.tgz
      • google-auto-auth-0.7.2.tgz
        • google-auth-library-0.10.0.tgz
          • gtoken-1.2.3.tgz
            • google-p12-pem-0.1.2.tgz
              • ❌ node-forge-0.7.5.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.

Publish Date: 2020-09-01

URL: CVE-2020-7720

CVSS 3 Score Details (7.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-09-01

Fix Resolution (node-forge): 0.10.0

Direct dependency fix Resolution (@google-cloud/storage): 1.6.0

WS-2022-0008

Vulnerable Library - node-forge-0.7.5.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.7.5.tgz

Dependency Hierarchy:

  • storage-1.2.0.tgz (Root Library)
    • common-0.13.6.tgz
      • google-auto-auth-0.7.2.tgz
        • google-auth-library-0.10.0.tgz
          • gtoken-1.2.3.tgz
            • google-p12-pem-0.1.2.tgz
              • ❌ node-forge-0.7.5.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The forge.debug API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.

Publish Date: 2022-01-08

URL: WS-2022-0008

CVSS 3 Score Details (6.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5rrq-pxf6-6jx5

Release Date: 2022-01-08

Fix Resolution (node-forge): 1.0.0

Direct dependency fix Resolution (@google-cloud/storage): 5.0.0

CVE-2022-0122

Vulnerable Library - node-forge-0.7.5.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.7.5.tgz

Dependency Hierarchy:

  • storage-1.2.0.tgz (Root Library)
    • common-0.13.6.tgz
      • google-auto-auth-0.7.2.tgz
        • google-auth-library-0.10.0.tgz
          • gtoken-1.2.3.tgz
            • google-p12-pem-0.1.2.tgz
              • ❌ node-forge-0.7.5.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

forge is vulnerable to URL Redirection to Untrusted Site

Publish Date: 2022-01-06

URL: CVE-2022-0122

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gf8q-jrpm-jvxq

Release Date: 2022-01-06

Fix Resolution (node-forge): 1.0.0

Direct dependency fix Resolution (@google-cloud/storage): 5.0.0

CVE-2022-24773

Vulnerable Library - node-forge-0.7.5.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.7.5.tgz

Dependency Hierarchy:

  • storage-1.2.0.tgz (Root Library)
    • common-0.13.6.tgz
      • google-auto-auth-0.7.2.tgz
        • google-auth-library-0.10.0.tgz
          • gtoken-1.2.3.tgz
            • google-p12-pem-0.1.2.tgz
              • ❌ node-forge-0.7.5.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check DigestInfo for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24773

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24773

Release Date: 2022-03-18

Fix Resolution (node-forge): 1.3.0

Direct dependency fix Resolution (@google-cloud/storage): 5.0.0
@mend-for-github-com mend-for-github-com bot added the security vulnerability Security vulnerability detected by Mend label Jun 7, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
security vulnerability Security vulnerability detected by Mend
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
0 participants