Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 26 vulnerabilities #7

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 26 vulnerabilities #7

wants to merge 1 commit into from

Conversation

ntheanh201
Copy link
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • backend/package.json
    • backend/package-lock.json
    • backend/.snyk

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 Yes Proof of Concept
medium severity /1000
Why?		 Server-Side Request Forgery (SSRF)
SNYK-JS-AXIOS-1038255		 Yes Proof of Concept
high severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-AXIOS-1579269		 Yes Proof of Concept
high severity 462/1000
Why? Proof of Concept exploit, CVSS 7.1		 Cross-site Request Forgery (CSRF)
SNYK-JS-AXIOS-6032459		 Yes Proof of Concept
medium severity /1000
Why?		 Prototype Pollution
SNYK-JS-CLASSTRANSFORMER-564431		 No Proof of Concept
low severity /1000
Why?		 Improper Input Validation
SNYK-JS-CLASSVALIDATOR-1730566		 No No Known Exploit
high severity /1000
Why?		 Authorization Bypass
SNYK-JS-EXPRESSJWT-575022		 Yes No Known Exploit
medium severity /1000
Why?		 Information Exposure
SNYK-JS-FOLLOWREDIRECTS-2332181		 Yes Proof of Concept
low severity /1000
Why?		 Information Exposure
SNYK-JS-FOLLOWREDIRECTS-2396346		 Yes No Known Exploit
medium severity /1000
Why?		 Improper Authentication
SNYK-JS-JSONWEBTOKEN-3180022		 Yes No Known Exploit
medium severity /1000
Why?		 Improper Restriction of Security Token Assignment
SNYK-JS-JSONWEBTOKEN-3180024		 Yes No Known Exploit
medium severity /1000
Why?		 Use of a Broken or Risky Cryptographic Algorithm
SNYK-JS-JSONWEBTOKEN-3180026		 Yes No Known Exploit
medium severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905		 Yes Proof of Concept
high severity /1000
Why?		 Command Injection
SNYK-JS-LODASH-1040724		 Yes Proof of Concept
high severity /1000
Why?		 Prototype Pollution
SNYK-JS-LODASH-567746		 Yes Proof of Concept
high severity /1000
Why?		 Prototype Pollution
SNYK-JS-LODASH-608086		 Yes Proof of Concept
low severity /1000
Why?		 Information Exposure
SNYK-JS-NESTJSCORE-2869127		 Yes No Known Exploit
medium severity /1000
Why?		 Session Fixation
SNYK-JS-PASSPORT-2840631		 No No Known Exploit
high severity /1000
Why?		 Prototype Poisoning
SNYK-JS-QS-3153490		 Yes Proof of Concept
high severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795		 Yes Proof of Concept
medium severity /1000
Why?		 Server-side Request Forgery (SSRF)
SNYK-JS-SWAGGERUIDIST-2314884		 No Mature
medium severity /1000
Why?		 Server-side Request Forgery (SSRF)
SNYK-JS-SWAGGERUIDIST-6056393		 No Proof of Concept
medium severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090599		 No Proof of Concept
medium severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090600		 No Proof of Concept
medium severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090601		 No Proof of Concept
medium severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090602		 No Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: @nestjs/jwt The new version differs by 250 commits.
  • 0274acc Merge pull request #1144 from nestjs/renovate/typescript-eslint-monorepo
  • c6bbf14 Merge pull request #1150 from nestjs/renovate/prettier-2.x
  • 414aea3 chore(deps): update typescript-eslint monorepo to v5.47.1
  • 44fd45a chore(deps): update dependency prettier to v2.8.1
  • d8ed56a Merge pull request #1149 from nestjs/renovate/commitlint-monorepo
  • 74a21f9 Merge pull request #1057 from nestjs/renovate/jsonwebtoken-8.x
  • f367329 Merge pull request #1159 from nestjs/renovate/release-it-15.x
  • b3f4fc7 chore(deps): update dependency release-it to v15.5.1
  • 15ad133 chore(deps): update commitlint monorepo to v17.3.0
  • d14521f fix(deps): update dependency @ types/jsonwebtoken to v8.5.9
  • cc04cce Merge pull request #1158 from nestjs/renovate/node-18.x
  • 3ebfaf0 chore(deps): update dependency @ types/node to v18.11.18
  • a14a3be Merge pull request #1146 from nestjs/renovate/typescript-4.x
  • df59940 chore(deps): update dependency typescript to v4.9.4
  • e5661b9 Merge pull request #1157 from nestjs/dependabot/npm_and_yarn/minimatch-3.1.2
  • 8d74976 Merge pull request #1151 from nestjs/renovate/lint-staged-13.x
  • 76b0ee3 Merge pull request #1148 from nestjs/renovate/eslint-8.x
  • f3dd100 chore(deps): bump minimatch from 3.0.4 to 3.1.2
  • 7b3319a chore(deps): update dependency lint-staged to v13.1.0
  • a97c753 Merge pull request #1145 from nestjs/renovate/jest-monorepo
  • 73a7440 Merge pull request #1155 from nestjs/renovate/npm-jsonwebtoken-vulnerability
  • 8a6a459 chore(deps): update dependency eslint to v8.30.0
  • 20c2366 chore(deps): update dependency @ types/jest to v29.2.4
  • 98a4464 chore(deps): update dependency jsonwebtoken to 9.0.0 [security]

See the full diff

Package name: @nestjs/swagger The new version differs by 250 commits.
  • f90cb7b Merge pull request #1205 from nestjs/renovate/class-transformer-0.x
  • bd18c89 chore(deps): update dependency class-transformer to v0.4.0
  • 28127a1 Merge pull request #1251 from nestjs/renovate/nestjs-mapped-types-0.x
  • 61fecaa fix(deps): update dependency @ nestjs/mapped-types to v0.4.0
  • e4f8d2f Merge pull request #1219 from nestjs/renovate/lodash-monorepo
  • 649f666 chore(deps): update typescript-eslint monorepo to v4.17.0
  • 40cbb0f chore(deps): update dependency @ types/node to v11.15.48
  • 17e45c4 chore(deps): update dependency fastify-swagger to v4.4.0
  • 7684efd chore(deps): update dependency typescript to v4.2.3
  • e9863b0 chore(deps): update dependency ts-jest to v26.5.3
  • bef1c0e chore(deps): update dependency fastify-swagger to v4.3.3
  • 4c3059c chore(deps): update dependency fastify-swagger to v4.3.2
  • 97c68df chore(deps): update dependency husky to v5.1.3
  • 48c2555 chore(deps): update typescript-eslint monorepo to v4.16.1
  • 5012037 chore(deps): update typescript-eslint monorepo to v4.16.0
  • 91e997a chore(deps): update dependency husky to v5.1.2
  • 2004131 chore(deps): update dependency eslint to v7.21.0
  • de629e4 chore(deps): update commitlint monorepo to v12.0.1
  • 1408043 chore(deps): update dependency eslint-config-prettier to v8.1.0
  • 9c5bdf1 chore(): release v4.7.15
  • 3e3b78b Merge branch 'master' of https://github.com/nestjs/swagger
  • b417b92 fix(plugin): support typescript 4.2+
  • a54b765 chore(deps): update dependency typescript to v4.2.2
  • 27becc1 chore(): release v4.7.14

See the full diff

Package name: express The new version differs by 117 commits.

See the full diff

Package name: express-jwt The new version differs by 97 commits.

See the full diff

Package name: jsonwebtoken The new version differs by 17 commits.
  • e1fa9dc Merge pull request from GHSA-8cf7-32gw-wr33
  • 5eaedbf chore(ci): remove github test actions job (#861)
  • cd4163e chore(ci): configure Github Actions jobs for Tests & Security Scanning (#856)
  • ecdf6cc fix!: Prevent accidental use of insecure key sizes & misconfiguration of secrets (#852)
  • 8345030 fix(sign&verify)!: Remove default `none` support from `sign` and `verify` methods, and require it to be explicitly configured (#851)
  • 7e6a86b Upload OpsLevel YAML (#849)
  • 74d5719 docs: update references vercel/ms references (#770)
  • d71e383 docs: document "invalid token" error
  • 3765003 docs: fix spelling in README.md: Peak -> Peek (#754)
  • a46097e docs: make decode impossible to discover before verify
  • 15a1bc4 refactor: make decode non-enumerable
  • 5f10bf9 docs: add jwtid to options of jwt.verify (#704)
  • 88cb9df Replace tilde-indexOf with includes (#647)
  • a6235fa Adds not to README on decoded payload validation (#646)
  • 5ed1f06 docs: fix tiny style change in readme (#622)
  • 9fb90ca style: add missing semicolon (#641)
  • a9e38b8 ci: use circleci (#589)

See the full diff

Package name: passport The new version differs by 100 commits.

See the full diff

Package name: passport-jwt The new version differs by 31 commits.
  • fed94fa 4.0.1 release
  • cfb5566 Merge pull request #248 from mikenicholson/update-minmatch
  • 8e4ad5b Address minmatch vulnerability
  • e9cf2ce Merge pull request #247 from mikenicholson/jsonwebtoken-9
  • bfbc6cc Update jsonwebtoken to 9.0.0
  • a49b43e Update minimist due to prototype pollution vulnerability in previous version
  • a5137c6 Merge pull request #192 from markhoney/patch-1
  • ea824cd Update jsonwebtoken and run npm audit fix
  • 8e57eec Remove older node versions shiping npm without support for "ci"
  • 3ab9305 Add CI workflow in GitHub Actions
  • 96a6e55 Merge pull request #218 from Sambego/patch-1
  • 809cdbf Update Auth0 sponsorship link
  • ec35fa4 Add nodejs 13 & 14 to CI
  • 2cab4dd Update mocha to resolve vulnerabilities
  • b196eb8 Use nyc for coverage
  • ddafcd2 Fix typo
  • 6b92631 Merge pull request #176 from epicfaace/patch-1
  • 154af70 Stop building for Node v5 and earlier
  • d311551 Add newer node versions to Travis CI build
  • 0e39a48 Update dependencies to resolve vulnerabilities.
  • d488147 Update URLs to reference new GitHub username
  • 89152d5 Rename extrators-test.js to extractors-test.js
  • 0bb68bf Clarify use of custom extractor function.
  • 499bd4a Add js formatting to extractor example in README.

See the full diff

Package name: pg The new version differs by 250 commits.
  • 7ffe68e Publish
  • 125a268 Update changelog
  • da2bb85 Bump node-fetch from 2.6.0 to 2.6.1
  • 7649890 Update SPONSORS.md
  • c5445f0 Fix metadata for pg-connection-string
  • a02dfac Replace semver with optional peer dependencies
  • 5825843 Public export of DatabaseError
  • e421167 Add ssl=true into the test
  • 9cbea21 Solve issues caused by config.ssl = true
  • 6be3b90 Add support for ?sslmode connection string param
  • f0fc470 Update README.md (#2330)
  • 95b5daa Publish
  • 1f0d3d5 Add test for pgpass check function scope
  • 0758b76 Fix context (this) in _checkPgPass.
  • acfbafa Publish
  • 07ee1ba Bump version
  • 65156e7 Small readme updates & auto-formatting
  • 61e4b7f Merge pull request #2309 from chris--young/ssl-err
  • f4d123b Prevents bad ssl credentials from causing a crash
  • 316bec3 Merge pull request #2294 from charmander/test-fixes
  • 3edcbb7 Fix most SSL negotiation packet tests being ignored
  • 1b022f8 Remove accidentally duplicated methods
  • b8773ce Merge pull request #2289 from brianc/dependabot/npm_and_yarn/lodash-4.17.19
  • 692e418 Fix documenation typo in README (#2291)

See the full diff

Package name: swagger-ui-express The new version differs by 14 commits.
  • aa3d56a Bumped version of swagger-ui-dist and moved js template usage
  • ff10df4 Update README.md
  • fe789d8 Update README.md
  • d07439b Merge pull request #270 from jdgarcia/security-update
  • 9011cdf Merge pull request #269 from artyhedgehog/patch-1
  • e09c35f update swagger-ui-dist dependency to fix security vulnerabilities
  • de8e7eb readme: fix broken link to swagger-jsdoc
  • 5824af0 Merge pull request #236 from H3nSte1n/feature/Add_converage_section_to_readme
  • da7b5ff feat: Remove Coverage headline from README
  • b46e892 feat: Add coverage section to README
  • feb0664 Merge pull request #235 from tingstad/patch-1
  • 1699685 Update README - two swagger documents (typo)
  • 44d5e10 Updated docs for multiple instances example
  • 5071048 Fix issue with swaggerInit

See the full diff

With a Snyk patch:
Severity Priority Score (*) Issue Exploit Maturity
high severity /1000
Why?		 Prototype Pollution
SNYK-JS-LODASH-567746		 Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Server-Side Request Forgery (SSRF)
🦉 Cross-site Request Forgery (CSRF)
🦉 More lessons are available in Snyk Learn

@snyk-bot
fix: backend/package.json, backend/package-lock.json & backend/.snyk …
7c9162f 
…to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-AXIOS-1038255
- https://snyk.io/vuln/SNYK-JS-AXIOS-1579269
- https://snyk.io/vuln/SNYK-JS-AXIOS-6032459
- https://snyk.io/vuln/SNYK-JS-CLASSTRANSFORMER-564431
- https://snyk.io/vuln/SNYK-JS-CLASSVALIDATOR-1730566
- https://snyk.io/vuln/SNYK-JS-EXPRESSJWT-575022
- https://snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-2332181
- https://snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-2396346
- https://snyk.io/vuln/SNYK-JS-JSONWEBTOKEN-3180022
- https://snyk.io/vuln/SNYK-JS-JSONWEBTOKEN-3180024
- https://snyk.io/vuln/SNYK-JS-JSONWEBTOKEN-3180026
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
- https://snyk.io/vuln/SNYK-JS-LODASH-608086
- https://snyk.io/vuln/SNYK-JS-NESTJSCORE-2869127
- https://snyk.io/vuln/SNYK-JS-PASSPORT-2840631
- https://snyk.io/vuln/SNYK-JS-QS-3153490
- https://snyk.io/vuln/SNYK-JS-SEMVER-3247795
- https://snyk.io/vuln/SNYK-JS-SWAGGERUIDIST-2314884
- https://snyk.io/vuln/SNYK-JS-SWAGGERUIDIST-6056393
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090599
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090600
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090601
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090602


The following vulnerabilities are fixed with a Snyk patch:
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@ntheanh201 @snyk-bot