diff --git a/__mocks__/mockVuln/pass/core/1.json b/__mocks__/mockVuln/pass/core/1.json index 117436d3..07cf3d2f 100644 --- a/__mocks__/mockVuln/pass/core/1.json +++ b/__mocks__/mockVuln/pass/core/1.json @@ -7,5 +7,6 @@ "patched": "^8.1.4 || ^7.10.1 || ^4.8.4 || ^6.11.1", "description": "mocked core vulnerability overview", "overview": "mocked core vulnerability overview", - "affectedEnvironments": ["all"] + "affectedEnvironments": ["all"], + "severity": "medium" } diff --git a/vuln/core/1.json b/vuln/core/1.json index 92ebbafb..389be01b 100644 --- a/vuln/core/1.json +++ b/vuln/core/1.json @@ -7,5 +7,8 @@ "patched": "^8.1.4 || ^7.10.1 || ^4.8.4 || ^6.11.1", "description": "memory overread when parsing invalid NAPTR responses", "overview": "The c-ares function ares_parse_naptr_reply(), which is used for parsing NAPTR\nresponses, could be triggered to read memory outside of the given input buffer\nif the passed in DNS response packet was crafted in a particular way.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/10.json b/vuln/core/10.json index 8f556e33..8b3c2484 100644 --- a/vuln/core/10.json +++ b/vuln/core/10.json @@ -6,5 +6,8 @@ "patched": "^6.9.0", "ref": "https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/", "overview": "The V8 parser mishandled scopes, potentially allowing an attacker to obtain\nsensitive information from arbitrary memory locations via crafted JavaScript\ncode. This vulnerability would require an attacker to be able to execute\narbitrary JavaScript code in a Node.js process.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/100.json b/vuln/core/100.json index 3523a988..67e47443 100644 --- a/vuln/core/100.json +++ b/vuln/core/100.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2022-35256"], + "cve": [ + "CVE-2022-35256" + ], "vulnerable": "14.x || 16.x || 18.x", "patched": "^14.20.1 || ^16.17.1 || ^18.9.1", "ref": "https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/", "overview": "The llhttp parser in the http module in Node.js v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "medium" } diff --git a/vuln/core/101.json b/vuln/core/101.json index 180914cb..43485f93 100644 --- a/vuln/core/101.json +++ b/vuln/core/101.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2022-35255"], + "cve": [ + "CVE-2022-35255" + ], "vulnerable": "18.x", "patched": "^18.9.1", "ref": "https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/", "overview": "Node.js made calls to EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. However, it does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "high" } diff --git a/vuln/core/102.json b/vuln/core/102.json index 8a8e3b46..8b76a7ec 100644 --- a/vuln/core/102.json +++ b/vuln/core/102.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2022-43548"], + "cve": [ + "CVE-2022-43548" + ], "vulnerable": "14.x || 16.x || 18.x || 19.x", "patched": "^14.21.1 || ^16.18.1 || ^18.12.1 || ^19.0.1", "ref": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/", "overview": "The Node.js rebinding protector for --inspect still allows invalid IP address, specifically, the octal format.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "medium" } diff --git a/vuln/core/103.json b/vuln/core/103.json index 2b3816ad..2a3dab7a 100644 --- a/vuln/core/103.json +++ b/vuln/core/103.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-23918"], + "cve": [ + "CVE-2023-23918" + ], "vulnerable": "14.x || 16.x || 18.x || 19.x", "patched": "^14.21.3 || ^16.19.1 || ^18.14.1 || ^19.6.1", "ref": "https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/", "overview": "It was possible to bypass Permissions and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "high" } diff --git a/vuln/core/104.json b/vuln/core/104.json index 67095886..c3e374f5 100644 --- a/vuln/core/104.json +++ b/vuln/core/104.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-23919"], + "cve": [ + "CVE-2023-23919" + ], "vulnerable": "14.x || 16.x || 18.x || 19.x", "patched": "^14.21.3 || ^16.19.1 || ^18.14.1 || ^19.2.0", "ref": "https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/", "overview": "In some cases Node.js did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "medium" } diff --git a/vuln/core/105.json b/vuln/core/105.json index 023289b1..3d56d29c 100644 --- a/vuln/core/105.json +++ b/vuln/core/105.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-23936"], + "cve": [ + "CVE-2023-23936" + ], "vulnerable": "14.x || 16.x || 18.x || 19.x", "patched": "^14.21.3 || ^16.19.1 || ^18.14.1 || ^19.6.1", "ref": "https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/", "overview": "The fetch API in Node.js did not prevent CRLF injection in the 'host' header potentially allowing attacks such as HTTP response splitting and HTTP header injection.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "medium" } diff --git a/vuln/core/106.json b/vuln/core/106.json index 4d69bfd1..df55bb96 100644 --- a/vuln/core/106.json +++ b/vuln/core/106.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-24807"], + "cve": [ + "CVE-2023-24807" + ], "vulnerable": "14.x || 16.x || 18.x || 19.x", "patched": "^14.21.3 || ^16.19.1 || ^18.14.1 || ^19.6.1", "ref": "https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/", "overview": "The Headers.set() and Headers.append() methods in the fetch API in Node.js where vulnerable to Regular a Expression Denial of Service (ReDoS) attacks.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "low" } diff --git a/vuln/core/107.json b/vuln/core/107.json index a14fc58e..8706c1de 100644 --- a/vuln/core/107.json +++ b/vuln/core/107.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-23920"], + "cve": [ + "CVE-2023-23920" + ], "vulnerable": "14.x || 16.x || 18.x || 19.x", "patched": "^14.21.3 || ^16.19.1 || ^18.14.1 || ^19.6.1", "ref": "https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/", "overview": "Node.js would search and potentially load ICU data when running with elevated priviledges. Node.js was modified to build with ICU_NO_USER_DATA_OVERRIDE to avoid this.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "low" } diff --git a/vuln/core/108.json b/vuln/core/108.json index 5c24f806..031b675b 100644 --- a/vuln/core/108.json +++ b/vuln/core/108.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-30581"], + "cve": [ + "CVE-2023-30581" + ], "vulnerable": "16.x || 18.x || 20.x", "patched": "^16.20.1 || ^18.16.1 || ^20.3.1", "ref": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases/", "overview": "The use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "high" } diff --git a/vuln/core/109.json b/vuln/core/109.json index a9e6e718..8c05945f 100644 --- a/vuln/core/109.json +++ b/vuln/core/109.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-30582"], + "cve": [ + "CVE-2023-30582" + ], "vulnerable": "20.x", "patched": "^20.3.1", "ref": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases/", "overview": "A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "medium" } diff --git a/vuln/core/11.json b/vuln/core/11.json index a6d4b8dd..7abe9612 100644 --- a/vuln/core/11.json +++ b/vuln/core/11.json @@ -6,5 +6,8 @@ "author": "Jann Horn", "description": "unauthorized clients can easily access inspector port", "overview": "Generate a UUID for each execution of the inspector. This provides additional\nsecurity to prevent unauthorized clients from connecting to the Node.js process\nvia the v8_inspector port when running with `--inspect`. Since the debugging\nprotocol allows extensive access to the internals of a running process, and the\nexecution of arbitrary code, it is important to limit connections to authorized\ntools only.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "medium" } diff --git a/vuln/core/110.json b/vuln/core/110.json index d0845af0..371622be 100644 --- a/vuln/core/110.json +++ b/vuln/core/110.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-30583"], + "cve": [ + "CVE-2023-30583" + ], "vulnerable": "20.x", "patched": "^20.3.1", "ref": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases/", "overview": "fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag in Node.js 20", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "medium" } diff --git a/vuln/core/111.json b/vuln/core/111.json index efdd2d06..4cd6fccb 100644 --- a/vuln/core/111.json +++ b/vuln/core/111.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-30584"], + "cve": [ + "CVE-2023-30584" + ], "vulnerable": "20.x", "patched": "^20.3.1", "ref": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases/", "overview": "A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "high" } diff --git a/vuln/core/112.json b/vuln/core/112.json index e5f5ff40..315e3f63 100644 --- a/vuln/core/112.json +++ b/vuln/core/112.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-30585"], + "cve": [ + "CVE-2023-30585" + ], "vulnerable": "16.x || 18.x || 20.x", "patched": "^16.20.1 || ^18.16.1 || ^20.3.1", "ref": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases/", "overview": "Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process", - "affectedEnvironments": ["win32"] + "affectedEnvironments": [ + "win32" + ], + "severity": "medium" } diff --git a/vuln/core/113.json b/vuln/core/113.json index 04ee6539..5a973c0e 100644 --- a/vuln/core/113.json +++ b/vuln/core/113.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-30586"], + "cve": [ + "CVE-2023-30586" + ], "vulnerable": "20.x", "patched": "^20.3.1", "ref": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases/", "overview": "Node.js 20 allows loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "medium" } diff --git a/vuln/core/114.json b/vuln/core/114.json index 67723ff1..4c7c687e 100644 --- a/vuln/core/114.json +++ b/vuln/core/114.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-30587"], + "cve": [ + "CVE-2023-30587" + ], "vulnerable": "20.x", "patched": "^20.3.1", "ref": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases/", "overview": "A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:inspector).", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "high" } diff --git a/vuln/core/115.json b/vuln/core/115.json index f7c40d51..ffe7e7df 100644 --- a/vuln/core/115.json +++ b/vuln/core/115.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-30589"], + "cve": [ + "CVE-2023-30589" + ], "vulnerable": "16.x || 18.x || 20.x", "patched": "^16.20.1 || ^18.16.1 || ^20.3.1", "ref": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases/", "overview": "The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "medium" } diff --git a/vuln/core/116.json b/vuln/core/116.json index 5e00397a..07aefad3 100644 --- a/vuln/core/116.json +++ b/vuln/core/116.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-30588"], + "cve": [ + "CVE-2023-30588" + ], "vulnerable": "16.x || 18.x || 20.x", "patched": "^16.20.1 || ^18.16.1 || ^20.3.1", "ref": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases/", "overview": "When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "medium" } diff --git a/vuln/core/117.json b/vuln/core/117.json index c504b7c9..8a4534a1 100644 --- a/vuln/core/117.json +++ b/vuln/core/117.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-30590"], + "cve": [ + "CVE-2023-30590" + ], "vulnerable": "16.x || 18.x || 20.x", "patched": "^16.20.1 || ^18.16.1 || ^20.3.1", "ref": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases/", "overview": "The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "medium" } diff --git a/vuln/core/118.json b/vuln/core/118.json index 2b0c0004..11608d71 100644 --- a/vuln/core/118.json +++ b/vuln/core/118.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-32002"], + "cve": [ + "CVE-2023-32002" + ], "vulnerable": "16.x || 18.x || 20.x", "patched": "^16.20.2 || ^18.17.1 || ^20.5.1", "ref": "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases/", "overview": "The use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/119.json b/vuln/core/119.json index efbf4c41..aea83a35 100644 --- a/vuln/core/119.json +++ b/vuln/core/119.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-32004"], + "cve": [ + "CVE-2023-32004" + ], "vulnerable": "20.x", "patched": "^20.5.1", "ref": "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases/", "overview": "Improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/12.json b/vuln/core/12.json index 5bec1666..f4589a95 100644 --- a/vuln/core/12.json +++ b/vuln/core/12.json @@ -7,5 +7,8 @@ "patched": "^6.7.0 || ^4.6.0", "description": "openssl 1.0.2h vulnerabilities", "overview": "A malicious client can exhaust a server's memory, resulting in a denial of\nservice (DoS) by sending very large OCSP Status Request extensions in a single\nsession.\n\nThis flaw is labelled high severity due to the ease of use for a DoS attack and\nNode.js servers using TLS are vulnerable.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/120.json b/vuln/core/120.json index be4f4d44..193d9d02 100644 --- a/vuln/core/120.json +++ b/vuln/core/120.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-32558"], + "cve": [ + "CVE-2023-32558" + ], "vulnerable": "20.x", "patched": "^20.5.1", "ref": "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases/", "overview": "The use of the deprecated API process.binding() can bypass the permission model through path traversal.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/121.json b/vuln/core/121.json index 5219fb2e..9475c6f3 100644 --- a/vuln/core/121.json +++ b/vuln/core/121.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-32006"], + "cve": [ + "CVE-2023-32006" + ], "vulnerable": "16.x || 18.x || 20.x", "patched": "^16.20.2 || ^18.17.1 || ^20.5.1", "ref": "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases/", "overview": "The use of module.constructor.createRequire() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/122.json b/vuln/core/122.json index 89c29424..00858fa7 100644 --- a/vuln/core/122.json +++ b/vuln/core/122.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-32559"], + "cve": [ + "CVE-2023-32559" + ], "vulnerable": "16.x || 18.x || 20.x", "patched": "^16.20.2 || ^18.17.1 || ^20.5.1", "ref": "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases/", "overview": "The use of the deprecated API process.binding() can bypass the policy mechanism by requiring internal modules and eventually take advantage of process.binding('spawn_sync') run arbitrary code, outside of the limits defined in a policy.json file.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/123.json b/vuln/core/123.json index 6764fc7c..4537104b 100644 --- a/vuln/core/123.json +++ b/vuln/core/123.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-32005"], + "cve": [ + "CVE-2023-32005" + ], "vulnerable": "20.x", "patched": "^20.5.1", "ref": "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases/", "overview": "A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/124.json b/vuln/core/124.json index 4291d229..40d50d5d 100644 --- a/vuln/core/124.json +++ b/vuln/core/124.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-32003"], + "cve": [ + "CVE-2023-32003" + ], "vulnerable": "20.x", "patched": "^20.5.1", "ref": "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases/", "overview": "fs.mkdtemp() and fs.mkdtempSync() can be used to bypass the permission model check using a path traversal attack.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/125.json b/vuln/core/125.json index 8b8cbecb..c013d0a4 100644 --- a/vuln/core/125.json +++ b/vuln/core/125.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-45143"], + "cve": [ + "CVE-2023-45143" + ], "vulnerable": "18.x || 20.x", "patched": "^18.18.2 || ^20.8.1", "ref": "https://nodejs.org/en/blog/vulnerability/october-2023-security-releases/", "overview": "Cookie headers are not cleared in cross-domain redirect in undici-fetch (High)", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "low" } diff --git a/vuln/core/126.json b/vuln/core/126.json index 327aec86..a393a648 100644 --- a/vuln/core/126.json +++ b/vuln/core/126.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-44487"], + "cve": [ + "CVE-2023-44487" + ], "vulnerable": "18.x || 20.x", "patched": "^18.18.2 || ^20.8.1", "ref": "https://nodejs.org/en/blog/vulnerability/october-2023-security-releases/", "overview": "Rapidly creating and cancelling streams (HEADERS frame immediately followed by RST_STREAM) without bound causes denial of service (High)", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "high" } diff --git a/vuln/core/127.json b/vuln/core/127.json index 82951518..9502e168 100644 --- a/vuln/core/127.json +++ b/vuln/core/127.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-39331"], + "cve": [ + "CVE-2023-39331" + ], "vulnerable": "20.x", "patched": "^20.8.1", "ref": "https://nodejs.org/en/blog/vulnerability/october-2023-security-releases/", "overview": "A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently. The implementation does not protect itself against the application overwriting built-in utility functions with user-defined implementations (High)", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "high" } diff --git a/vuln/core/128.json b/vuln/core/128.json index 9d09ebde..d408ed2a 100644 --- a/vuln/core/128.json +++ b/vuln/core/128.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-39332"], + "cve": [ + "CVE-2023-39332" + ], "vulnerable": "20.x", "patched": "^20.8.1", "ref": "https://nodejs.org/en/blog/vulnerability/october-2023-security-releases/", "overview": "Path traversal through path stored in Uint8Array (High)", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "high" } diff --git a/vuln/core/129.json b/vuln/core/129.json index c7e84c6b..f02991c5 100644 --- a/vuln/core/129.json +++ b/vuln/core/129.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-38552"], + "cve": [ + "CVE-2023-38552" + ], "vulnerable": "18.x || 20.x", "patched": "^18.18.2 || ^20.8.1", "ref": "https://nodejs.org/en/blog/vulnerability/october-2023-security-releases/", "overview": "Integrity checks according to experimental policies can be circumvented (Medium)", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "medium" } diff --git a/vuln/core/13.json b/vuln/core/13.json index 572eb05e..c1276fbd 100644 --- a/vuln/core/13.json +++ b/vuln/core/13.json @@ -7,5 +7,8 @@ "patched": "^6.7.0 || ^4.6.0", "description": "openssl 1.0.2h vulnerabilities", "overview": "SWEET32 is a new attack on older block cipher algorithms that use a block size\nof 64 bits.\n\nAs mitigation, OpenSSL has moved DES-based ciphers from the HIGH to MEDIUM\ngroup. As Node.js includes HIGH, but not MEDIUM, in its default suite, affected\nciphers are no longer included unless the default suite is not used. Node's\ndefault TLS cipher suite can be found in the API documentation.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/130.json b/vuln/core/130.json index 98099d8d..840253ec 100644 --- a/vuln/core/130.json +++ b/vuln/core/130.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-39333"], + "cve": [ + "CVE-2023-39333" + ], "vulnerable": "18.x || 20.x", "patched": "^18.18.2 || ^20.8.1", "ref": "https://nodejs.org/en/blog/vulnerability/october-2023-security-releases/", "overview": "Code injection via WebAssembly export names (Low)", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "low" } diff --git a/vuln/core/131.json b/vuln/core/131.json index 69e9c896..fc98d308 100644 --- a/vuln/core/131.json +++ b/vuln/core/131.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2023-46809"], + "cve": [ + "CVE-2023-46809" + ], "vulnerable": "18.x || 20.x || 21.x", "patched": "^18.19.1 || ^20.11.1 || ^21.6.2", "ref": "https://nodejs.org/en/blog/vulnerability/february-2024-security-releases/", "overview": "A vulnerability in the privateDecrypt() API of the crypto library, allowed a covert timing side-channel during PKCS#1 v1.5 padding error handling.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "medium" } diff --git a/vuln/core/132.json b/vuln/core/132.json index 876c4929..5350fb49 100644 --- a/vuln/core/132.json +++ b/vuln/core/132.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2024-21891"], + "cve": [ + "CVE-2024-21891" + ], "vulnerable": "20.x || 21.x", "patched": "^20.11.1 || ^21.6.2", "ref": "https://nodejs.org/en/blog/vulnerability/february-2024-security-releases/", "overview": "Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "medium" } diff --git a/vuln/core/133.json b/vuln/core/133.json index 577633d8..1e3c2226 100644 --- a/vuln/core/133.json +++ b/vuln/core/133.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2024-21890"], + "cve": [ + "CVE-2024-21890" + ], "vulnerable": "20.x || 21.x", "patched": "^20.11.1 || ^21.6.2", "ref": "https://nodejs.org/en/blog/vulnerability/february-2024-security-releases/", "overview": "Improper handling of wildcards in --allow-fs-read and --allow-fs-write", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "medium" } diff --git a/vuln/core/134.json b/vuln/core/134.json index 77db40ce..0fce5931 100644 --- a/vuln/core/134.json +++ b/vuln/core/134.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2024-21892"], + "cve": [ + "CVE-2024-21892" + ], "vulnerable": "18.x || 20.x || 21.x", "patched": "^18.19.1 || ^20.11.1 || ^21.6.2", "ref": "https://nodejs.org/en/blog/vulnerability/february-2024-security-releases/", "overview": "Code injection and privilege escalation through Linux capabilities", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "high" } diff --git a/vuln/core/135.json b/vuln/core/135.json index b96311df..e5b6c733 100644 --- a/vuln/core/135.json +++ b/vuln/core/135.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2024-22019"], + "cve": [ + "CVE-2024-22019" + ], "vulnerable": "18.x || 20.x || 21.x", "patched": "^18.19.1 || ^20.11.1 || ^21.6.2", "ref": "https://nodejs.org/en/blog/vulnerability/february-2024-security-releases/", "overview": "A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and denial of service (DoS).", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "high" } diff --git a/vuln/core/136.json b/vuln/core/136.json index c294da7c..e8181ce5 100644 --- a/vuln/core/136.json +++ b/vuln/core/136.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2024-21896"], + "cve": [ + "CVE-2024-21896" + ], "vulnerable": "20.x || 21.x", "patched": "^20.11.1 || ^21.6.2", "ref": "https://nodejs.org/en/blog/vulnerability/february-2024-security-releases/", "overview": "The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve().", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "high" } diff --git a/vuln/core/137.json b/vuln/core/137.json index 23119168..aa2b55a8 100644 --- a/vuln/core/137.json +++ b/vuln/core/137.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2024-22017"], + "cve": [ + "CVE-2024-22017" + ], "vulnerable": "20.x || 21.x", "patched": "^20.11.1 || ^21.6.2", "ref": "https://nodejs.org/en/blog/vulnerability/february-2024-security-releases/", "overview": "setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid()", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "high" } diff --git a/vuln/core/138.json b/vuln/core/138.json index 733d8ed7..a3e451bb 100644 --- a/vuln/core/138.json +++ b/vuln/core/138.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2024-22025"], + "cve": [ + "CVE-2024-22025" + ], "vulnerable": "18.x || 20.x || 21.x", "patched": "^18.19.1 || ^20.11.1 || ^21.6.2", "ref": "https://nodejs.org/en/blog/vulnerability/february-2024-security-releases/", "overview": "A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetch() function to retrieve content from an untrusted URL.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/139.json b/vuln/core/139.json index 1d1525b0..df758ae7 100644 --- a/vuln/core/139.json +++ b/vuln/core/139.json @@ -1,12 +1,13 @@ { - "cve": [ - "CVE-2024-27983" - ], - "vulnerable": "18.x || 20.x || 21.x", - "patched": "^18.20.1 || ^20.12.1 || ^21.7.2", - "ref": "https://nodejs.org/en/blog/vulnerability/april-2024-security-releases/", - "overview": "An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.", - "affectedEnvironments": [ - "all" - ] -} \ No newline at end of file + "cve": [ + "CVE-2024-27983" + ], + "vulnerable": "18.x || 20.x || 21.x", + "patched": "^18.20.1 || ^20.12.1 || ^21.7.2", + "ref": "https://nodejs.org/en/blog/vulnerability/april-2024-security-releases/", + "overview": "An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.", + "affectedEnvironments": [ + "all" + ], + "severity": "high" +} diff --git a/vuln/core/14.json b/vuln/core/14.json index ab9822f8..8aa8859c 100644 --- a/vuln/core/14.json +++ b/vuln/core/14.json @@ -7,5 +7,8 @@ "patched": "^6.7.0 || ^4.6.0", "description": "openssl 1.0.2h vulnerabilities", "overview": "An overflow can occur in MDC2_Update() under certain circumstances resulting in\nan out of bounds (OOB) error. This attack is impractical on most platforms due\nto the size of data required to trigger the OOB error.\n\nNode.js is impacted by this flaw but due to the impracticalities of exploiting\nit and the very low usage of of MDC-2, it is very low severity for Node.js\nusers.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/140.json b/vuln/core/140.json index ab6b9eb2..34fe4428 100644 --- a/vuln/core/140.json +++ b/vuln/core/140.json @@ -1,12 +1,13 @@ { - "cve": [ - "CVE-2024-27982" - ], - "vulnerable": "18.x || 20.x || 21.x", - "patched": "^18.20.1 || ^20.12.1 || ^21.7.2", - "ref": "https://nodejs.org/en/blog/vulnerability/april-2024-security-releases/", - "overview": "The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.", - "affectedEnvironments": [ - "all" - ] -} \ No newline at end of file + "cve": [ + "CVE-2024-27982" + ], + "vulnerable": "18.x || 20.x || 21.x", + "patched": "^18.20.1 || ^20.12.1 || ^21.7.2", + "ref": "https://nodejs.org/en/blog/vulnerability/april-2024-security-releases/", + "overview": "The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" +} diff --git a/vuln/core/141.json b/vuln/core/141.json index 270d3de6..fff6e926 100644 --- a/vuln/core/141.json +++ b/vuln/core/141.json @@ -1,12 +1,13 @@ { - "cve": [ - "CVE-2024-27982" - ], - "vulnerable": "18.x || 20.x || 21.x", - "patched": "^18.20.2 || ^20.12.2 || ^21.7.3", - "ref": "https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2/", - "overview": "Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.", - "affectedEnvironments": [ - "win32" - ] + "cve": [ + "CVE-2024-27982" + ], + "vulnerable": "18.x || 20.x || 21.x", + "patched": "^18.20.2 || ^20.12.2 || ^21.7.3", + "ref": "https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2/", + "overview": "Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.", + "affectedEnvironments": [ + "win32" + ], + "severity": "medium" } diff --git a/vuln/core/142.json b/vuln/core/142.json index 0d07f43d..a1708df4 100644 --- a/vuln/core/142.json +++ b/vuln/core/142.json @@ -1,10 +1,13 @@ { - "cve": [ - "CVE-2024-36137" - ], - "vulnerable": "20.x || 22.x", - "patched": "^20.15.1 || ^22.4.1", - "ref": "https://nodejs.org/en/blog/vulnerability/july-2024-security-releases/", - "overview": "A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.\n\nNode.js Permission Model do not operate on file descriptors, however, operations such as `fs.fchown` or `fs.fchmod` can use a \"read-only\" file descriptor to change the owner and permissions of a file.\n\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.", - "affectedEnvironments": ["all"] + "cve": [ + "CVE-2024-36137" + ], + "vulnerable": "20.x || 22.x", + "patched": "^20.15.1 || ^22.4.1", + "ref": "https://nodejs.org/en/blog/vulnerability/july-2024-security-releases/", + "overview": "A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.\n\nNode.js Permission Model do not operate on file descriptors, however, operations such as `fs.fchown` or `fs.fchmod` can use a \"read-only\" file descriptor to change the owner and permissions of a file.\n\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.", + "affectedEnvironments": [ + "all" + ], + "severity": "low" } diff --git a/vuln/core/143.json b/vuln/core/143.json index 2d4bf7d5..a475204f 100644 --- a/vuln/core/143.json +++ b/vuln/core/143.json @@ -1,10 +1,13 @@ { - "cve": [ - "CVE-2024-36138" - ], - "vulnerable": "18.x || 20.x || 22.x", - "patched": "^18.20.4 || ^20.15.1 || ^22.4.1", - "ref": "https://nodejs.org/en/blog/vulnerability/july-2024-security-releases/", - "overview": "The CVE-2024-27980 was identified as an incomplete fix for the BatBadBut vulnerability. This vulnerability arises from improper handling of batch files with all possible extensions on Windows via `child_process.spawn` / `child_process.spawnSync`. A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.\n\nThis vulnerability affects all users of `child_process.spawn` and `child_process.spawnSync` on Windows in all active release lines.", - "affectedEnvironments": ["win32"] + "cve": [ + "CVE-2024-36138" + ], + "vulnerable": "18.x || 20.x || 22.x", + "patched": "^18.20.4 || ^20.15.1 || ^22.4.1", + "ref": "https://nodejs.org/en/blog/vulnerability/july-2024-security-releases/", + "overview": "The CVE-2024-27980 was identified as an incomplete fix for the BatBadBut vulnerability. This vulnerability arises from improper handling of batch files with all possible extensions on Windows via `child_process.spawn` / `child_process.spawnSync`. A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.\n\nThis vulnerability affects all users of `child_process.spawn` and `child_process.spawnSync` on Windows in all active release lines.", + "affectedEnvironments": [ + "win32" + ], + "severity": "high" } diff --git a/vuln/core/144.json b/vuln/core/144.json index a8bf9ea5..8a94fb3f 100644 --- a/vuln/core/144.json +++ b/vuln/core/144.json @@ -1,10 +1,13 @@ { - "cve": [ - "CVE-2024-22018" - ], - "vulnerable": "20.x || 22.x", - "patched": "^20.15.1 || ^22.4.1", - "ref": "https://nodejs.org/en/blog/vulnerability/july-2024-security-releases/", - "overview": "A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the `fs.lstat` API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\n\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 22.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.", - "affectedEnvironments": ["all"] + "cve": [ + "CVE-2024-22018" + ], + "vulnerable": "20.x || 22.x", + "patched": "^20.15.1 || ^22.4.1", + "ref": "https://nodejs.org/en/blog/vulnerability/july-2024-security-releases/", + "overview": "A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used.\nThis flaw arises from an inadequate permission model that fails to restrict file stats through the `fs.lstat` API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to.\n\nThis vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 22.\n\nPlease note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.", + "affectedEnvironments": [ + "all" + ], + "severity": "low" } diff --git a/vuln/core/145.json b/vuln/core/145.json index f62d96b3..89a26bbe 100644 --- a/vuln/core/145.json +++ b/vuln/core/145.json @@ -1,10 +1,13 @@ { - "cve": [ - "CVE-2024-22020" - ], - "vulnerable": "18.x || 20.x || 22.x", - "patched": "^18.20.4 || ^20.15.1 || ^22.4.1", - "ref": "https://nodejs.org/en/blog/vulnerability/july-2024-security-releases/", - "overview": "A security flaw in Node.js allows a bypass of network import restrictions.\nBy embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.\n\nVerified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.\n\nExploiting this flaw can violate network import security, posing a risk to developers and servers.", - "affectedEnvironments": ["all"] + "cve": [ + "CVE-2024-22020" + ], + "vulnerable": "18.x || 20.x || 22.x", + "patched": "^18.20.4 || ^20.15.1 || ^22.4.1", + "ref": "https://nodejs.org/en/blog/vulnerability/july-2024-security-releases/", + "overview": "A security flaw in Node.js allows a bypass of network import restrictions.\nBy embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security.\n\nVerified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.\n\nExploiting this flaw can violate network import security, posing a risk to developers and servers.", + "affectedEnvironments": [ + "all" + ], + "severity": "medium" } diff --git a/vuln/core/146.json b/vuln/core/146.json index f03e1915..613cb43e 100644 --- a/vuln/core/146.json +++ b/vuln/core/146.json @@ -1,10 +1,13 @@ { - "cve": [ - "CVE-2024-37372" - ], - "vulnerable": "20.x || 22.x", - "patched": "^20.15.1 || ^22.4.1", - "ref": "https://nodejs.org/en/blog/vulnerability/july-2024-security-releases/", - "overview": "The Permission Model assumes that any path starting with two backslashes \\\\ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.\n\nThis vulnerability affects Windows users of the Node.js Permission Model in version v20.x and v22.x", - "affectedEnvironments": ["all"] + "cve": [ + "CVE-2024-37372" + ], + "vulnerable": "20.x || 22.x", + "patched": "^20.15.1 || ^22.4.1", + "ref": "https://nodejs.org/en/blog/vulnerability/july-2024-security-releases/", + "overview": "The Permission Model assumes that any path starting with two backslashes \\\\ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases.\n\nThis vulnerability affects Windows users of the Node.js Permission Model in version v20.x and v22.x", + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/15.json b/vuln/core/15.json index e48002cd..c06a23bf 100644 --- a/vuln/core/15.json +++ b/vuln/core/15.json @@ -7,5 +7,8 @@ "patched": "^6.7.0 || ^4.6.0", "description": "openssl 1.0.2h vulnerabilities", "overview": "A flaw in the OpenSSL DSA implementation means that a non-constant time codepath\nis followed for certain operations. This has been demonstrated through a\ncache-timing attack to be sufficient for an attacker to recover the private DSA\nkey.\n\nThis is very low severity for Node.js users due to the difficulty in taking\nadvantage of this attack and because DSA is very rarely used.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/16.json b/vuln/core/16.json index a0f3d6e7..d34b8e59 100644 --- a/vuln/core/16.json +++ b/vuln/core/16.json @@ -7,5 +7,8 @@ "patched": "^6.7.0 || ^4.6.0", "description": "openssl 1.0.2h vulnerabilities", "overview": "Some missing message length checks can result in out of bounds (OOB) reads of up\nto 2 bytes beyond an allocated buffer. There is a theoretical denial of service\n(DoS) risk. This only impacts a client or a server which enables client\nauthentication.\n\nNode.js is impacted by this low severity flaw.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/17.json b/vuln/core/17.json index d6ade587..03987412 100644 --- a/vuln/core/17.json +++ b/vuln/core/17.json @@ -5,5 +5,8 @@ "patched": "^6.7.0", "author": "Ahmed Zaki", "overview": "Remove support for loading dynamic third-party engine modules. An attacker\nmay be able to hide malicious code to be inserted into Node.js at runtime by\nmasquerading as one of the dynamic engine modules. Originally reported by\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/18.json b/vuln/core/18.json index 0cae8d7e..cf6a1c2e 100644 --- a/vuln/core/18.json +++ b/vuln/core/18.json @@ -10,5 +10,8 @@ "cvss": "3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "cvss_score": 4.8, "overview": "**http**: Properly validate for allowable characters in the `reason` argument in\n`ServerResponse#writeHead()`. Fixes a possible response splitting attack vector.\nThis introduces a new case where `throw` may occur when configuring HTTP\nresponses, users should already be adopting try/catch here.\n\nThis is a low severity security defect that that may make HTTP response\nsplitting possible under certain circumstances. If user-input is passed to the\nreason argument to writeHead() on an HTTP response, a new-line character may be\nused to inject additional responses.\n\nThe fix for this defect introduces a new case where throw may occur when\nconfiguring HTTP responses. Users should already be adopting try/catch here.\n\nCommon Vulnerability Scoring System (CVSS) v3 Base Score:\n\n\tMetric\tScore\n\tBase Score:\t4.8 (Medium)\n\tBase Vector:\tCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\n\tAttack Vector:\tNetwork (AV:N)\n\tAttack Complexity:\tHigh (AC:H)\n\tPrivileges Required:\tNone (PR:N)\n\tUser Interaction:\tNone (UI:N)\n\tScope of Impact:\tUnchanged (S:U)\n\tConfidentiality Impact:\tLow (C:L)\n\tIntegrity Impact:\tLow (I:L)\n\tAvailability Impact:\tNone (A:N)\n\nRefer to the\n[CVSS v3 Specification](https://www.first.org/cvss/specification-document)\nfor details on the meanings and application of the vector components.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/19.json b/vuln/core/19.json index d169039e..fdd96571 100644 --- a/vuln/core/19.json +++ b/vuln/core/19.json @@ -8,5 +8,8 @@ "author": "Alexander Minozhenko and James Bunton (Atlassian)", "description": "invalid wildcard certificate validation check", "overview": "Fix invalid wildcard certificate validation check whereby a TLS server may be\nable to serve an invalid wildcard certificate for its hostname due to improper\nvalidation of `*.` in the wildcard string. \n\nThis is a high severity defect that would allow a malicious TLS server to serve\nan invalid wildcard certificate for its hostname and be improperly validated by\na Node.js client. This is due to a flaw in the validation of *. in the wildcard\nname string.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/2.json b/vuln/core/2.json index f6c37d34..0b72fc5d 100644 --- a/vuln/core/2.json +++ b/vuln/core/2.json @@ -4,5 +4,8 @@ "patched": "^4.8.4 || ^6.11.1 || ^7.10.1 || ^8.1.4", "description": "DoS possible in V8 object lookup", "overview": "Disable V8 snapshots - The hashseed embedded in the snapshot is\ncurrently the same for all runs of the binary. This opens node up to\ncollision attacks which could result in a Denial of Service. We have\ntemporarily disabled snapshots until a more robust solution is found\nFixed: Ali Ijaz Sheikh\nReported: Fedor Indutny\nref: https://nodejs.org/en/blog/vulnerability/july-2017-security-releases/\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/20.json b/vuln/core/20.json index 2f3f9976..a98147d5 100644 --- a/vuln/core/20.json +++ b/vuln/core/20.json @@ -5,5 +5,8 @@ "patched": "^6.7.0 || ^4.6.0", "description": "**crypto**: don't build hardware engines (Ben Noordhuis)", "overview": "This is a low severity security defect. By default, OpenSSL will load a list of\nthird-party engine modules when the ENGINE_load_builtin_engines() function is\nused. These are normally not present on a user's system. An attacker may be able\nto make Node.js load malicious code by masquerading it as one of the dynamic\nengine modules.\n\nThis defect primarily impacts Windows due to the standard DLL search paths.\nHowever, UNIX users may also be at risk with a poorly configured LD_LIBRARY_PATH\nenvironment variable or /etc/ld.so.conf path list.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/21.json b/vuln/core/21.json index e1b40218..e99d5647 100644 --- a/vuln/core/21.json +++ b/vuln/core/21.json @@ -5,5 +5,8 @@ "description": "Ignore negative lengths in calls to `Buffer()` and `Buffer.allocUnsafe()`.", "ref": "https://github.com/nodejs/node/issues/7047#issuecomment-222393982", "overview": "This fixes a possible security concern (reported by Feross Aboukhadijeh) where\nuser input is passed unchecked to the Buffer constructor or `allocUnsafe()` as\nit can expose parts of the memory slab used by other Buffers in the application.\nNote that negative lengths are not supported by the Buffer API and user input to\nthe constructor should always be sanitised and type-checked.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/22.json b/vuln/core/22.json index 2bdfca3f..ec1317e4 100644 --- a/vuln/core/22.json +++ b/vuln/core/22.json @@ -7,5 +7,8 @@ "ref": "https://nodejs.org/en/blog/vulnerability/openssl-may-2016/#cve-2016-2107-padding-oracle-in-aes-ni-cbc-mac-check", "description": "Padding oracle in AES-NI CBC MAC check", "overview": "A man-in-the-middle (MITM) attacker may be able to execute a padding oracle\nattack to decrypt traffic when a connection uses an AES-CBC cipher and the\nserver runs on an Intel CPU supporting AES-NI. This is a common configuration\nfor TLS servers.\n\nThe OpenSSL project has labelled this vulnerability high severity.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/23.json b/vuln/core/23.json index a17430d1..beb01403 100644 --- a/vuln/core/23.json +++ b/vuln/core/23.json @@ -7,5 +7,8 @@ "ref": "https://nodejs.org/en/blog/vulnerability/openssl-may-2016/#cve-2016-2107-padding-oracle-in-aes-ni-cbc-mac-check", "description": "EVP_EncodeUpdate overflow", "overview": "An overflow can occur in the OpenSSL EVP_EncodeUpdate() function which is used\nfor Base64 encoding of binary data. An attacker must be able to supply large\namounts of input data in order to cause an overflow.\n\nNode.js uses the EVP_EncodeUpdate() internally during calls to\ncrypto.Certificate#exportPublicKey() for SPKAC Certificate Signing\nRequests. User-supplied data must be passed to this method for\napplications to be vulnerable. This method has been available since\nNode.js v0.12.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/24.json b/vuln/core/24.json index 7064ceb5..da648066 100644 --- a/vuln/core/24.json +++ b/vuln/core/24.json @@ -7,5 +7,8 @@ "ref": "https://nodejs.org/en/blog/vulnerability/june-2016-security-releases", "description": "Buffer overflow in V8", "overview": "Under certain conditions, V8 may improperly expand memory allocations in the\nZone::New function. This could potentially be used to cause a Denial of Service\nvia buffer overflow or as a trigger for a remote code execution.\n\nAlthough this bug is marked as high severity in the corresponding Chromium\nrelease (50.0.2661.102), our assessment is that this is low severity for\nNode.js users due to the level of difficulty in making use of this\nvulnerability. However, users are encouraged to upgrade their Node.js\ninstallation to ensure they are properly protected.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/25.json b/vuln/core/25.json index fa3237a1..a06e643b 100644 --- a/vuln/core/25.json +++ b/vuln/core/25.json @@ -4,5 +4,8 @@ "patched": "^5.12.0 || ^4.5.0 || ^6.2.1", "ref": "https://github.com/nodejs/node/pull/7562", "description": "ignore negative allocation lengths", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/26.json b/vuln/core/26.json index 0c380b33..efcb4cfd 100644 --- a/vuln/core/26.json +++ b/vuln/core/26.json @@ -5,5 +5,8 @@ "patched": "^5.10.0 || 4.4.2", "ref": "https://github.com/npm/node/pull/6", "overview": "Upgrade npm to fixes a security flaw in the use of\nauthentication tokens in HTTP requests that would allow an attacker to set up a\nserver that could collect tokens from users of the command-line interface.\nAuthentication tokens have previously been sent with every request made by the\nCLI for logged-in users, regardless of the destination of the request. This\nupdate fixes this by only including those tokens for requests made against the\nregistry or registries used for the current install.\n\nThis is a flaw in the version of npm included with node.\n\nnpm is updated to 3.8.3 in node 5.10.1, and to 2.15.1 in node 4.4.2.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/27.json b/vuln/core/27.json index e7c3eec8..66ab659b 100644 --- a/vuln/core/27.json +++ b/vuln/core/27.json @@ -5,5 +5,8 @@ "vulnerable": "5.x || 4.x", "patched": "^5.6.0 || ^4.3.0", "overview": "Fix defects in HTTP header parsing for requests and responses that\ncan allow request smuggling (CVE-2016-2086).\n\nHTTP header parsing now aligns more closely with the HTTP spec\nincluding restricting the acceptable characters.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/28.json b/vuln/core/28.json index 18876553..626d9671 100644 --- a/vuln/core/28.json +++ b/vuln/core/28.json @@ -5,5 +5,8 @@ "vulnerable": "5.x || 4.x", "patched": "^5.6.0 || ^4.3.0", "overview": "Fix defects in HTTP header parsing for requests and responses that\ncan allow response splitting (CVE-2016-2216).\n\nHTTP header parsing now aligns more closely with the HTTP spec\nincluding restricting the acceptable characters.\n\nIntroduce new `--security-revert={cvenum}` command line flag for selective\nreversion of specific CVE fixes allow the fix for CVE-2016-2216 to be\nselectively reverted using `--security-revert=CVE-2016-2216`.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/29.json b/vuln/core/29.json index afb65e8a..f8857c94 100644 --- a/vuln/core/29.json +++ b/vuln/core/29.json @@ -4,5 +4,8 @@ "patched": "^5.11.1 || ^4.4.4", "description": "buffer safeguard against accidental kNoZeroFill", "overview": "To reproduce: try { Buffer(1e10); } catch (e) {} new Uint8Array(100);.\n\nTo be affected, one would need to:\n\nHave any way how the user could make the API pass huge numbers to\nBuffer/SlowBuffer/Buffer.allocUnsafe, e.g. by sending invalid input\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/3.json b/vuln/core/3.json index 94638c84..bc1ae455 100644 --- a/vuln/core/3.json +++ b/vuln/core/3.json @@ -7,5 +7,8 @@ "patched": "^4.7.3 || ^6.9.5 || ^7.5.0", "ref": "https://nodejs.org/en/blog/vulnerability/openssl-january-2017/", "overview": "This is a moderate severity flaw in OpenSSL. By default, Node.js disables RC4 so\nmost users are not affected. As RC4 can be enabled programmatically, it is\npossible for a Node.js developer to craft code that may be vulnerable to this\nflaw. Any user activating RC4 in their codebase should prioritise this update.\n\nAll active versions of Node.js are affected, but the severity is very low for\nmost users.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/30.json b/vuln/core/30.json index b0b320fd..966c745a 100644 --- a/vuln/core/30.json +++ b/vuln/core/30.json @@ -4,5 +4,8 @@ "patched": "^4.3.2 || ^5.7.1", "ref": "https://github.com/nodejs/node/pull/5507", "overview": "Fix a double-free defect in parsing malformed DSA keys that may potentially be\nused for DoS or memory corruption attacks. It is likely to be very difficult to\nuse this defect for a practical attack and is therefore considered low severity\nfor Node.js users. More info is available at\ncve: CVE-2016-0705\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/31.json b/vuln/core/31.json index 39611370..204c8e41 100644 --- a/vuln/core/31.json +++ b/vuln/core/31.json @@ -6,5 +6,8 @@ "patched": "^4.3.2 || ^5.7.1", "ref": "https://github.com/nodejs/node/pull/5507", "overview": "Fix a defect that can cause memory corruption in certain very rare cases\nrelating to the internal `BN_hex2bn()` and `BN_dec2bn()` functions. It is\nbelieved that Node.js is not invoking the code paths that use these functions so\npractical attacks via Node.js using this defect are _unlikely_ to be possible.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/32.json b/vuln/core/32.json index 6e278ff8..eb99cede 100644 --- a/vuln/core/32.json +++ b/vuln/core/32.json @@ -6,5 +6,8 @@ "patched": "^4.3.2 || ^5.7.1", "ref": "https://ssrg.nicta.com.au/projects/TS/cachebleed", "overview": "Fix a defect that makes the _[CacheBleed\nAttack](https://ssrg.nicta.com.au/projects/TS/cachebleed/)_ possible. This\ndefect enables attackers to execute side-channel attacks leading to the\npotential recovery of entire RSA private keys. It only affects the Intel Sandy\nBridge (and possibly older) microarchitecture when using hyper-threading. Newer\nmicroarchitectures, including Haswell, are unaffected.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/33.json b/vuln/core/33.json index d22a05ed..03e8db21 100644 --- a/vuln/core/33.json +++ b/vuln/core/33.json @@ -4,5 +4,8 @@ "patched": "^5.6.0 || ^4.3.0", "description": "mitigate against the Logjam attack", "overview": "To mitigate against the Logjam attack, TLS clients now reject Diffie-Hellman\nhandshakes with parameters shorter than 1024-bits, up from the previous limit of\n768-bits.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/34.json b/vuln/core/34.json index 53931e24..0dc9927a 100644 --- a/vuln/core/34.json +++ b/vuln/core/34.json @@ -5,5 +5,8 @@ "vulnerable": "5.x || 4.x", "patched": "^5.1.1 || ^4.2.3", "overview": "A bug whereby an HTTP socket may no longer have a parser associated with it but\na pipelined request attempts to trigger a pause or resume on the non-existent\nparser, a potential denial-of-service vulnerability.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/35.json b/vuln/core/35.json index 0214844c..323c226c 100644 --- a/vuln/core/35.json +++ b/vuln/core/35.json @@ -5,5 +5,8 @@ "vulnerable": "5.x || 4.x", "patched": "^5.1.1 || ^4.2.3", "overview": "Backport fix for CVE-2015-6764, a bug in v8's `JSON.stringify()` that can result\nin out-of-bounds reads for arrays.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/36.json b/vuln/core/36.json index 305f5723..bfd483be 100644 --- a/vuln/core/36.json +++ b/vuln/core/36.json @@ -7,5 +7,8 @@ "ref": "http://openssl.org/news/secadv/20151203.txt", "description": "BN_mod_exp may produce incorrect results on x86_64", "overview": "An attack may be possible against a Node.js TLS server using DHE key exchange.\nDetails are available at .\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/37.json b/vuln/core/37.json index 538f28f7..e400347b 100644 --- a/vuln/core/37.json +++ b/vuln/core/37.json @@ -7,5 +7,8 @@ "ref": "https://github.com/nodejs/node/pull/4134", "description": "Certificate verify crash with missing PSS parameter", "overview": "A potential denial-of-service vector for Node.js TLS servers using client\ncertificate authentication; TLS clients are also impacted. Details are available\nat .\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/38.json b/vuln/core/38.json index bb24ed26..c7d46e84 100644 --- a/vuln/core/38.json +++ b/vuln/core/38.json @@ -4,5 +4,8 @@ "patched": "^4.7.2 || ^6.9.4", "description": "no shasum exists to verify downloads", "overview": "While promoting additional platforms for v4.7.1 and v6.9.3 after the release,\nthe tarballs on the release server were overwritten and now have different\nshasums.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/39.json b/vuln/core/39.json index d26e1cea..f8a3508d 100644 --- a/vuln/core/39.json +++ b/vuln/core/39.json @@ -5,5 +5,8 @@ "description": "data leakage via reuse of memory space in TypedArrays", "ref": "https://github.com/nodejs/node/pull/2931", "overview": "A bug was introduced in v4.1.0 where allocating a new zero-length buffer can\nresult in the _next_ allocation of a TypedArray in JavaScript not being\nzero-filled. In certain circumstances this could result in data leakage via\nreuse of memory space in TypedArrays, breaking the normally safe assumption that\nTypedArrays should be always zero-filled.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/4.json b/vuln/core/4.json index c90c1a40..da0f164d 100644 --- a/vuln/core/4.json +++ b/vuln/core/4.json @@ -7,5 +7,8 @@ "ref": "https://nodejs.org/en/blog/vulnerability/openssl-january-2017/", "description": "BN_mod_exp may produce incorrect results on x86_64", "overview": "As noted by the OpenSSL team, the likelihood of being able to craft a practical\nattack that uses this flaw is very low. In addition, Node.js enables\nSSL_OP_SINGLE_DH_USE, further decreasing the chance of a successful exploit of\nthis vulnerability in a Node.js service.\n\nAll active versions of Node.js are affected, but the severity is very low for\nNode.js users.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/40.json b/vuln/core/40.json index 849c5681..61c57898 100644 --- a/vuln/core/40.json +++ b/vuln/core/40.json @@ -8,5 +8,8 @@ "cvss_score": 5.9, "ref": "https://github.com/nodejs/node/pull/3128", "description": "out-of-order 'finish' event bug in pipelining can abort execution", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/41.json b/vuln/core/41.json index 5a4cb022..32011ccf 100644 --- a/vuln/core/41.json +++ b/vuln/core/41.json @@ -4,5 +4,8 @@ "patched": "^4.1.1", "ref": "https://github.com/nodejs/node/pull/2945", "overview": "Guard against response-splitting of HTTP trailing headers added via\n[`response.addTrailers()`](https://nodejs.org/api/http.html#http_response_addtrailers_headers)\nby removing new-line (`[\\r\\n]`) characters from values. Note that standard\nheader values are already stripped of new-line characters. The expected security\nimpact is low because trailing headers are rarely used.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/42.json b/vuln/core/42.json index 4584eb76..5d334d16 100644 --- a/vuln/core/42.json +++ b/vuln/core/42.json @@ -6,5 +6,8 @@ "patched": "^8.6.0", "ref": "https://nodejs.org/en/blog/vulnerability/september-2017-path-validation/", "overview": "Node.js version 8.5.0 included a change which caused a security vulnerability in the checks on paths made by some community modules. As a result, an attacker may be able to access file system paths other than those intended.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/43.json b/vuln/core/43.json index 08cc3877..00df2fa3 100644 --- a/vuln/core/43.json +++ b/vuln/core/43.json @@ -6,5 +6,8 @@ "patched": "^4.8.5 || ^6.11.5 || ^8.8.0", "ref": "https://nodejs.org/en/blog/vulnerability/oct-2017-dos/", "overview": "Node.js was susceptible to a remote DoS attack due to a change that came in as part of zlib v1.2.9. In zlib v1.2.9 8 became an invalid value for the windowBits parameter and Node's zlib module will crash or throw an exception (depending on the version) if you call zlib.createDeflateRaw({windowBits: 8}).", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/44.json b/vuln/core/44.json index fd543fdf..c5b71ead 100644 --- a/vuln/core/44.json +++ b/vuln/core/44.json @@ -3,8 +3,11 @@ "CVE-2017-15896" ], "vulnerable": "4.x || 6.x || 8.x || 9.x", - "patched": "^4.8.7 || ^6.12.2 || ^8.9.3 || ^9.2.1" , + "patched": "^4.8.7 || ^6.12.2 || ^8.9.3 || ^9.2.1", "ref": "https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/", "overview": "Node.js was affected by OpenSSL vulnerability CVE-2017-3737 in regards to the use of SSL_read() due to TLS handshake failure. The result was that an active network attacker could send application data to Node.js using the TLS or HTTP2 modules in a way that bypassed TLS authentication and encryption.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/45.json b/vuln/core/45.json index da36646b..489f8f66 100644 --- a/vuln/core/45.json +++ b/vuln/core/45.json @@ -3,8 +3,11 @@ "CVE-2017-15897" ], "vulnerable": "8.x || 9.x", - "patched": "^8.9.3 || ^9.2.1" , + "patched": "^8.9.3 || ^9.2.1", "ref": "https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/", "overview": "Node.js had a bug in versions 8.X and 9.X which caused buffers to not be initialized when the encoding for the fill value did not match the encoding specified. For example, 'Buffer.alloc(0x100, \"This is not correctly encoded\", \"hex\");' The buffer implementation was updated such that the buffer will be initialized to all zeros in these cases.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/46.json b/vuln/core/46.json index e3689774..6a34962a 100644 --- a/vuln/core/46.json +++ b/vuln/core/46.json @@ -6,5 +6,8 @@ "patched": "^4.9.0", "ref": "https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/", "overview": "The `'path'` module in the Node.js 4.x release line contains a potential regular expression denial of service (ReDoS) vector. The code in question was replaced in Node.js 6.x and later so this vulnerability only impacts all versions of Node.js 4.x. The regular expression, `splitPathRe`, used within the `'path'` module for the various path parsing functions, including `path.dirname()`, `path.extname()` and `path.parse()` was structured in such a way as to allow an attacker to craft a string, that when passed through one of these functions, could take a significant amount of time to evaluate, potentially leading to a full denial of service.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/47.json b/vuln/core/47.json index e1713f08..cdd1f0b1 100644 --- a/vuln/core/47.json +++ b/vuln/core/47.json @@ -6,5 +6,8 @@ "patched": "^4.9.0 || ^6.14.0 || ^8.11.0 || ^9.10.0", "ref": "https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/", "overview": "The HTTP parser in all current versions of Node.js ignores spaces in the `Content-Length` header, allowing input such as `Content-Length: 1 2` to be interpreted as having a value of `12`. The HTTP specification does not allow for spaces in the `Content-Length` value and the Node.js HTTP parser has been brought into line on this particular difference. The security risk of this flaw to Node.js users is considered to be VERY LOW as it is difficult, and may be impossible, to craft an attack that makes use of this flaw in a way that could not already be achieved by supplying an incorrect value for `Content-Length`. Vulnerabilities may exist in user-code that make incorrect assumptions about the potential accuracy of this value compared to the actual length of the data supplied. Node.js users crafting lower-level HTTP utilities are advised to re-check the length of any input supplied after parsing is complete.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/48.json b/vuln/core/48.json index 687e591c..c1b1f9dd 100644 --- a/vuln/core/48.json +++ b/vuln/core/48.json @@ -6,5 +6,8 @@ "patched": "^6.14.0 || ^8.11.0 || ^9.10.0", "ref": "https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/", "overview": "The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/49.json b/vuln/core/49.json index d91dbd62..02657f24 100644 --- a/vuln/core/49.json +++ b/vuln/core/49.json @@ -3,8 +3,11 @@ "CVE-2018-7161" ], "vulnerable": "8.x || 9.x || 10.x", - "patched": "^8.11.3 || ^9.11.2 || ^10.4.1" , + "patched": "^8.11.3 || ^9.11.2 || ^10.4.1", "ref": "https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/", "overview": "All versions of 8.x and later are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node server providing an http2 server to crash. This can be accomplished by interacting with the http2 server in a manner that triggers a cleanup bug where objects are used in native code after they are no longer available. This has been addressed by updating the http2 implementation. Thanks to Jordan Zebor at F5 Networks for reporting this issue.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/5.json b/vuln/core/5.json index 7bc84791..64551422 100644 --- a/vuln/core/5.json +++ b/vuln/core/5.json @@ -7,5 +7,8 @@ "patched": "^4.7.3 || ^6.9.5 || ^7.5.0", "ref": "https://nodejs.org/en/blog/vulnerability/openssl-january-2017/", "overview": "Some calculations, when run on an Intel Broadwell or later CPU, can produce in\nerroneous results. This flaw has been previously discussed by the Node.js team\non GitHub. It is not believed that practical attacks can be crafted to exploit\nthis vulnerability except in very specific circumstances. Therefore this is a\nlow severity flaw.\n\nAll active versions of Node.js are affected, but the severity is very low for\nNode.js users.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/50.json b/vuln/core/50.json index 50612b07..c792f088 100644 --- a/vuln/core/50.json +++ b/vuln/core/50.json @@ -3,8 +3,11 @@ "CVE-2018-7162" ], "vulnerable": "9.x || 10.x", - "patched": "^9.11.2 || ^10.4.1" , + "patched": "^9.11.2 || ^10.4.1", "ref": "https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/", "overview": "All versions of 9.x and later are vulnerable and the severity is HIGH. An attacker can cause a denial of service (DoS) by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending duplicate/unexpected messages during the handshake. This vulnerability has been addressed by updating the TLS implementation. Thanks to Jordan Zebor at F5 Networks all of his help investigating this issue with the Node.js team.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/51.json b/vuln/core/51.json index 0860f330..4c7483e2 100644 --- a/vuln/core/51.json +++ b/vuln/core/51.json @@ -3,8 +3,11 @@ "CVE-2018-7164" ], "vulnerable": "9.7.x || 10.x", - "patched": "^9.11.2 || ^10.4.1" , + "patched": "^9.11.2 || ^10.4.1", "ref": "https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/", "overview": "Versions 9.7.0 and later are vulnerable and the severity is MEDIUM. A bug introduced in 9.7.0 increases the memory consumed when reading from the network into JavaScript using the net.Socket object directly as a stream. An attacker could use this cause a denial of service by sending tiny chunks of data in short succession. This vulnerability was restored by reverting to the prior behaviour.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/52.json b/vuln/core/52.json index d1abfdbf..07c3090a 100644 --- a/vuln/core/52.json +++ b/vuln/core/52.json @@ -3,8 +3,11 @@ "CVE-2018-7167" ], "vulnerable": "6.x || 8.x || 9.x", - "patched": "^6.14.3 || ^8.11.3 || ^9.11.2" , + "patched": "^6.14.3 || ^8.11.3 || ^9.11.2", "ref": "https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/", "overview": "Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/53.json b/vuln/core/53.json index 82a5ef4c..6963f91a 100644 --- a/vuln/core/53.json +++ b/vuln/core/53.json @@ -5,9 +5,12 @@ "vulnerable": "10.x", "patched": ">= 10.9.0", "publish_date": "2018-08-16", - "author": "Сковорода Никита Андреевич (Nikita Skovoroda / @ChALkeR)", + "author": "\u0421\u043a\u043e\u0432\u043e\u0440\u043e\u0434\u0430 \u041d\u0438\u043a\u0438\u0442\u0430 \u0410\u043d\u0434\u0440\u0435\u0435\u0432\u0438\u0447 (Nikita Skovoroda / @ChALkeR)", "ref": "https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/", "type": "CWE-226: Sensitive Information Uncleared Before Release", "overview": "An argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying `encoding` can be passed as a number, this is misinterpreted by `Buffer's` internal \"fill\" method as the `start` to a fill operation. This flaw may be abused where `Buffer.alloc()` arguments are derived from user input to return uncleared memory blocks that may contain sensitive information.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/54.json b/vuln/core/54.json index e46b8f20..20c70764 100644 --- a/vuln/core/54.json +++ b/vuln/core/54.json @@ -5,9 +5,12 @@ "vulnerable": "<= 10", "patched": "^6.14.4 || ^8.11.4 || >= 10.9.0", "publish_date": "2018-08-16", - "author": "Сковорода Никита Андреевич (Nikita Skovoroda / @ChALkeR)", + "author": "\u0421\u043a\u043e\u0432\u043e\u0440\u043e\u0434\u0430 \u041d\u0438\u043a\u0438\u0442\u0430 \u0410\u043d\u0434\u0440\u0435\u0435\u0432\u0438\u0447 (Nikita Skovoroda / @ChALkeR)", "ref": "https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/", "type": "CWE-787: Out-of-bounds Write", "overview": "When used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bounds of a single `Buffer`. Writes that start from the second-to-last position of a buffer cause a miscalculation of the maximum length of the input bytes to be written.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/55.json b/vuln/core/55.json index c204cd30..a67130d1 100644 --- a/vuln/core/55.json +++ b/vuln/core/55.json @@ -10,5 +10,8 @@ "ref": "https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/", "type": "CWE-115: Misinterpretation of Input", "overview": "HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/56.json b/vuln/core/56.json index 007d4b74..f120d7fa 100644 --- a/vuln/core/56.json +++ b/vuln/core/56.json @@ -10,5 +10,8 @@ "ref": "https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/", "type": "CWE-419: Unprotected Primary Channel", "overview": "Debugger port 5858 listens on any interface by default: When the debugger is enabled with `node --debug` or `node debug`, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate arbitrary JavaScript. The default interface is now localhost. It has always been possible to start the debugger on a specific interface, such as `node --debug=localhost`. The debugger was removed in Node.js 8 and replaced with the inspector, so no versions from 8 and later are vulnerable.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/57.json b/vuln/core/57.json index 6fc34749..711fbad5 100644 --- a/vuln/core/57.json +++ b/vuln/core/57.json @@ -10,5 +10,8 @@ "ref": "https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/", "type": "CWE-400: Uncontrolled Resource Consumption / Denial of Service", "overview": "Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized headers (almost 80 KB per connection), and carefully timed completion of the headers, it is possible to cause the HTTP server to abort from heap allocation failure. Attack potential is mitigated by the use of a load balancer or other proxy layer.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/58.json b/vuln/core/58.json index 78c7b48c..5d579ff8 100644 --- a/vuln/core/58.json +++ b/vuln/core/58.json @@ -10,5 +10,8 @@ "ref": "https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/", "type": "CWE-400: Uncontrolled Resource Consumption / Denial of Service", "overview": "Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers very slowly keeping HTTP or HTTPS connections and associated resources alive for a long period of time.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/59.json b/vuln/core/59.json index 00ca7d4b..924e8170 100644 --- a/vuln/core/59.json +++ b/vuln/core/59.json @@ -10,5 +10,8 @@ "ref": "https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/", "type": "CWE-115: Misinterpretation of Input", "overview": "Hostname spoofing in URL parser for javascript protocol: If a Node.js application is using url.parse() to determine the URL hostname, that hostname can be spoofed by using a mixed case \"javascript:\" (e.g. \"javAscript:\") protocol (other protocols are not affected). If security decisions are made about the URL based on the hostname, they may be incorrect.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/6.json b/vuln/core/6.json index 6e20e42e..5c98baf5 100644 --- a/vuln/core/6.json +++ b/vuln/core/6.json @@ -7,5 +7,8 @@ "patched": "^7.2.0", "ref": "https://github.com/nodejs/node/pull/9647", "overview": "Please be aware that Node.js v7.2.0 was released today and includes a small\nsecurity update arising from libuv: https://nodejs.org/en/blog/release/v7.2.0/\n\nlibuv v1.10.1 reverts a change that was introduced in v1.10.0, included in\nNode.js v7.1.0. The reverted code was found to contain a potential buffer\noverflow in output written to the console. We are not aware of any exploit of\nthis flaw and it only impacts Windows 10 (November update and later). This flaw\nhas been assigned the identifier CVE-2016-9551 and was originally discovered and\nreported by Hitesh Kanwathirtha of Microsoft.\n\nUsers of the v7 release line running on Windows 10 should upgrade to Node.js\nv7.2.0 at their earliest convenience.\n\nNo other version of Node.js is known to be impacted by this flaw.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/60.json b/vuln/core/60.json index fb723635..ae220fab 100644 --- a/vuln/core/60.json +++ b/vuln/core/60.json @@ -10,5 +10,8 @@ "ref": "https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/", "type": "CWE-400: Uncontrolled Resource Consumption / Denial of Service", "overview": "An attacker can cause a Denial of Service (DoS) by establishing an HTTP or HTTPS connection in keep-alive mode and by sending headers very slowly thereby keeping the connection and associated resources alive for a long period of time. Attack potential is mitigated by the use of a load balancer or other proxy layer. This vulnerability is an extension of CVE-2018-12121, addressed in November and impacts all active release lines including 6, 8, 10 and 11.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/61.json b/vuln/core/61.json index e09c4e57..82b99c94 100644 --- a/vuln/core/61.json +++ b/vuln/core/61.json @@ -10,5 +10,8 @@ "ref": "https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/", "type": "CWE-400: Uncontrolled Resource Consumption / Denial of Service", "overview": "Keep-alive HTTP and HTTPS connections can remain open and inactive for up to 2 minutes in Node.js 6.16.0 and earlier. Node.js 8.0.0 introduced a dedicated server.keepAliveTimeout which defaults to 5 seconds. The behavior in Node.js 6.16.0 and earlier is a potential Denial of Service (DoS) attack vector. Node.js 6.17.0 introduces server.keepAliveTimeout and the 5-second default.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/62.json b/vuln/core/62.json index fa2c2eac..209e9093 100644 --- a/vuln/core/62.json +++ b/vuln/core/62.json @@ -17,5 +17,8 @@ "ref": "https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/", "type": "CWE-400: Uncontrolled Resource Consumption / Denial of Service", "overview": "Netflix has discovered several resource exhaustion vectors affecting a variety of third-party HTTP/2 implementations. These attack vectors can be used to launch DoS attacks against servers that support HTTP/2 communication. Netflix worked with Google and CERT/CC to coordinate disclosure to the Internet community.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/63.json b/vuln/core/63.json index 251f6546..e4e40816 100644 --- a/vuln/core/63.json +++ b/vuln/core/63.json @@ -1,9 +1,14 @@ { - "cve": ["CVE-2019-15604"], + "cve": [ + "CVE-2019-15604" + ], "vulnerable": "10.x || 12.x || 13.x", "patched": "^10.19.0 || ^12.15.0 || ^13.8.0", "reported_by": "Rogier Schouten", "ref": "https://hackerone.com/reports/746733", "overview": "Remotely trigger an assertion on a TLS server with a malformed certificate string", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/64.json b/vuln/core/64.json index 4c846a79..5082afa8 100644 --- a/vuln/core/64.json +++ b/vuln/core/64.json @@ -1,9 +1,14 @@ { - "cve": ["CVE-2019-15605"], + "cve": [ + "CVE-2019-15605" + ], "vulnerable": "10.x || 12.x || 13.x", "patched": "^10.19.0 || ^12.15.0 || ^13.8.0", "reported_by": "Ethan Rubinson", "ref": "https://hackerone.com/reports/735748", "overview": "HTTP request smuggling using malformed Transfer-Encoding header", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/65.json b/vuln/core/65.json index 09542c81..90bf145d 100644 --- a/vuln/core/65.json +++ b/vuln/core/65.json @@ -1,9 +1,14 @@ { - "cve": ["CVE-2019-15606"], + "cve": [ + "CVE-2019-15606" + ], "vulnerable": "10.x || 12.x || 13.x", "patched": "^10.19.0 || ^12.15.0 || ^13.8.0", "reported_by": "Alyssa Wilk", "ref": "https://hackerone.com/reports/730779", "overview": "HTTP header values do not have trailing OWS trimmed", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/66.json b/vuln/core/66.json index a4e811e4..aae0943c 100644 --- a/vuln/core/66.json +++ b/vuln/core/66.json @@ -1,9 +1,14 @@ { - "cve": ["CVE-2020-8201"], + "cve": [ + "CVE-2020-8201" + ], "vulnerable": "12.x || 14.x", "patched": "^12.18.4 || ^14.11.0", "reported_by": "Amit Klein", "ref": "https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/", "overview": "HTTP Request Smuggling due to CR-to-Hyphen conversion", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "high" } diff --git a/vuln/core/67.json b/vuln/core/67.json index 67031913..a6840a41 100644 --- a/vuln/core/67.json +++ b/vuln/core/67.json @@ -1,9 +1,14 @@ { - "cve": ["CVE-2020-8251"], + "cve": [ + "CVE-2020-8251" + ], "vulnerable": "14.x", "patched": "^14.11.0", "reported_by": "Paolo Insogna and Matteo Collina", "ref": "https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/", "overview": "Denial of Service by resource exhaustion CWE-400 due to unfinished HTTP/1.1 requests", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "critical" } diff --git a/vuln/core/68.json b/vuln/core/68.json index d9bd3c80..f6bbb809 100644 --- a/vuln/core/68.json +++ b/vuln/core/68.json @@ -1,9 +1,14 @@ { - "cve": ["CVE-2020-8252"], + "cve": [ + "CVE-2020-8252" + ], "vulnerable": "10.x || 12.x || 14.x", "patched": "^10.22.1 || ^12.18.4 || ^14.9.0", "reported_by": "Xiaoyi Shi", "ref": "https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/", "overview": "fs.realpath.native on may cause buffer overflow", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "medium" } diff --git a/vuln/core/69.json b/vuln/core/69.json index 64ee23fa..e5b24908 100644 --- a/vuln/core/69.json +++ b/vuln/core/69.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2020-8277"], + "cve": [ + "CVE-2020-8277" + ], "vulnerable": " 12.x || 14.x || 15.x", "patched": " ^12.19.1 || ^14.15.1 || 15.2.1", "ref": "https://nodejs.org/en/blog/vulnerability/november-2020-security-releases/", "overview": "Denial of Service through DNS request", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/7.json b/vuln/core/7.json index 0ce926ee..cf018ce5 100644 --- a/vuln/core/7.json +++ b/vuln/core/7.json @@ -1,14 +1,17 @@ { "cve": [ - "CVE-2016-9840.", - "CVE-2016-9841.", - "CVE-2016-9842.", - "CVE-2016-9843." + "CVE-2016-9840", + "CVE-2016-9841", + "CVE-2016-9842", + "CVE-2016-9843" ], "ref": "https://github.com/madler/zlib/commit/d1d577490c15a0c6862473d7576352a9f18ef811", "description": "undefined language constructs that may have security impact", "vulnerable": "4.x || 5.x || 6.x || 7.x", "patched": "^4.8.2 || ^6.10.2 || ^7.6.0", "overview": "An upgrade to zlib 1.2.11 to fix a number of low severity CVEs\nthat were present in zlib 1.2.8.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/70.json b/vuln/core/70.json index d71ea722..9983a86c 100644 --- a/vuln/core/70.json +++ b/vuln/core/70.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2020-8265"], + "cve": [ + "CVE-2020-8265" + ], "vulnerable": "10.x || 12.x || 14.x || 15.x", "patched": "^10.23.1 || ^12.20.1 || ^14.15.4 || ^15.5.1", "ref": "https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/", "overview": "use-after-free in TLSWrap - affected Node.js versions are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method does not return an error, this object is passed back to the caller as part of a StreamWriteResult structure. This may be exploited to corrupt memory leading to a Denial of Service or potentially other exploits.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "high" } diff --git a/vuln/core/71.json b/vuln/core/71.json index fbdfb916..b1b4a334 100644 --- a/vuln/core/71.json +++ b/vuln/core/71.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2020-8287"], + "cve": [ + "CVE-2020-8287" + ], "vulnerable": "10.x || 12.x || 14.x || 15.x", "patched": "^10.23.1 || ^12.20.1 || ^14.15.4 || ^15.5.1", "ref": "https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/", "overview": "HTTP Request Smuggling in nodejs - Affected versions of Node.js allow two copies of a header field in a http request. For example, two Transfer-Encoding header fields. In this case Node.js identifies the first header field and ignores the second. This can lead to HTTP Request Smuggling (https://cwe.mitre.org/data/definitions/444.html)", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "low" } diff --git a/vuln/core/72.json b/vuln/core/72.json index f247c193..bbe093d8 100644 --- a/vuln/core/72.json +++ b/vuln/core/72.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2020-1971"], + "cve": [ + "CVE-2020-1971" + ], "vulnerable": "10.x || 12.x || 14.x || 15.x", "patched": "^10.23.1 || ^12.20.1 || ^14.15.4 || ^15.5.0", "ref": "https://nodejs.org/en/blog/vulnerability/january-2021-security-releases/", "overview": "OpenSSL - EDIPARTYNAME NULL pointer de-reference - This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20201208.txt", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/73.json b/vuln/core/73.json index 1aa278b7..2907a0a1 100644 --- a/vuln/core/73.json +++ b/vuln/core/73.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2021-22883"], + "cve": [ + "CVE-2021-22883" + ], "vulnerable": " 10.x || 12.x || 14.x || 15.x", "patched": " ^10.24.0 || ^12.21.0 || ^14.16.0 || ^15.10.0", "ref": "https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/", "overview": "HTTP2 'unknownProtocol' cause Denial of Service by resource exhaustion - Affected Node.js versions are vulnerable to denial of service attacks when too many connection attempts with an 'unknownProtocol' are established. This leads to a leak of file descriptors. If a file descriptor limit is configured on the system, then the server is unable to accept new connections and prevent the process also from opening, e.g. a file. If no file descriptor limit is configured, then this lead to an excessive memory usage and cause the system to run out of memory.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "critical" } diff --git a/vuln/core/74.json b/vuln/core/74.json index 3841f79e..aec5f46c 100644 --- a/vuln/core/74.json +++ b/vuln/core/74.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2021-22884"], + "cve": [ + "CVE-2021-22884" + ], "vulnerable": " 10.x || 12.x || 14.x || 15.x", "patched": " ^10.24.0 || ^12.21.0 || ^14.16.0 || ^15.10.0", "ref": "https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/", - "overview": "DNS rebinding in --inspect - Affected Node.js versions are vulnerable to denial of service attacks when the whitelist includes “localhost6”. When “localhost6” is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the “localhost6” domain. As long as the attacker uses the “localhost6” domain, they can still apply the attack described in CVE-2018-7160.", - "affectedEnvironments": ["all"] + "overview": "DNS rebinding in --inspect - Affected Node.js versions are vulnerable to denial of service attacks when the whitelist includes \u201clocalhost6\u201d. When \u201clocalhost6\u201d is not present in /etc/hosts, it is just an ordinary domain that is resolved via DNS, i.e., over network. If the attacker controls the victim's DNS server or can spoof its responses, the DNS rebinding protection can be bypassed by using the \u201clocalhost6\u201d domain. As long as the attacker uses the \u201clocalhost6\u201d domain, they can still apply the attack described in CVE-2018-7160.", + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/75.json b/vuln/core/75.json index eece242a..246e87fe 100644 --- a/vuln/core/75.json +++ b/vuln/core/75.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2021-23840"], + "cve": [ + "CVE-2021-23840" + ], "vulnerable": " 10.x || 12.x || 14.x || 15.x", "patched": " ^10.24.0 || ^12.21.0 || ^14.16.0 || ^15.10.0", "ref": "https://nodejs.org/en/blog/vulnerability/february-2021-security-releases/", "overview": "OpenSSL - Integer overflow in CipherUpdate - This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210216.txt", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/76.json b/vuln/core/76.json index 12efdfff..576fc0d7 100644 --- a/vuln/core/76.json +++ b/vuln/core/76.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2021-3450"], + "cve": [ + "CVE-2021-3450" + ], "vulnerable": " 10.x || 12.x || 14.x || 15.x", "patched": " ^10.24.1 || ^12.22.1 || ^14.16.1 || ^15.14.0", "ref": "https://nodejs.org/en/blog/vulnerability/april-2021-security-releases/", "overview": "This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "high" } diff --git a/vuln/core/77.json b/vuln/core/77.json index 209dd738..8d2bb724 100644 --- a/vuln/core/77.json +++ b/vuln/core/77.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2021-3449"], + "cve": [ + "CVE-2021-3449" + ], "vulnerable": " 10.x || 12.x || 14.x || 15.x", "patched": " ^10.24.1 || ^12.22.1 || ^14.16.1 || ^15.14.0", "ref": "https://nodejs.org/en/blog/vulnerability/april-2021-security-releases/", "overview": "This is a vulnerability in OpenSSL which may be exploited through Node.js. You can read more about it in https://www.openssl.org/news/secadv/20210325.txt", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "high" } diff --git a/vuln/core/78.json b/vuln/core/78.json index 4e278d05..d9255b6b 100644 --- a/vuln/core/78.json +++ b/vuln/core/78.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2020-7774"], + "cve": [ + "CVE-2020-7774" + ], "vulnerable": " 10.x || 12.x || 14.x", "patched": " ^10.24.1 || ^12.22.1 || ^14.16.1", "ref": "https://nodejs.org/en/blog/vulnerability/april-2021-security-releases/", "overview": "This is a vulnerability in the y18n npm module which may be exploited by prototype pollution. You can read more about it in https://github.com/advisories/GHSA-c4w7-xm78-47vh", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "high" } diff --git a/vuln/core/79.json b/vuln/core/79.json index 301f65d0..8d008a21 100644 --- a/vuln/core/79.json +++ b/vuln/core/79.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2021-22930"], + "cve": [ + "CVE-2021-22930" + ], "vulnerable": " 12.x || 14.x || 16.x", "patched": " ^12.22.4 || ^14.17.4 || ^16.6.0", "ref": "https://nodejs.org/en/blog/vulnerability/july-2021-security-releases-2/", "overview": "Node.js before is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22930", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "high" } diff --git a/vuln/core/8.json b/vuln/core/8.json index 7d26894c..db4b198f 100644 --- a/vuln/core/8.json +++ b/vuln/core/8.json @@ -7,5 +7,8 @@ "description": "ares_create_query single byte out of buffer write", "ref": "https://c-ares.haxx.se/adv_20160929.html", "overview": "A security vulnerability has been discovered in the c-ares library that is\nbundled with all versions of Node.js. Due to the difficulty of triggering and\nmaking use of this vulnerability we currently consider this a low-severity\nsecurity flaw for Node.js users.\n\nMore information at https://c-ares.haxx.se/adv_20160929.html\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/80.json b/vuln/core/80.json index e0e37fd5..d2e5cccc 100644 --- a/vuln/core/80.json +++ b/vuln/core/80.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2021-22921"], + "cve": [ + "CVE-2021-22921" + ], "vulnerable": " 12.x || 14.x || 16.x", "patched": " ^12.22.2 || ^14.17.2 || ^16.4.1", "ref": "https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/", "overview": "Node.js is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22921", - "affectedEnvironments": ["win32"] + "affectedEnvironments": [ + "win32" + ], + "severity": "medium" } diff --git a/vuln/core/81.json b/vuln/core/81.json index 3288d72d..050f91dd 100644 --- a/vuln/core/81.json +++ b/vuln/core/81.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2021-27290"], + "cve": [ + "CVE-2021-27290" + ], "vulnerable": " 12.x", "patched": " ^12.22.2", "ref": "https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/", "overview": "This is a vulnerability in the ssri npm module which may be vulnerable to denial of service attacks. You can read more about it in https://github.com/advisories/GHSA-vx3p-948g-6vhq", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "high" } diff --git a/vuln/core/82.json b/vuln/core/82.json index bcdfed9b..0f409eeb 100644 --- a/vuln/core/82.json +++ b/vuln/core/82.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2021-23362"], + "cve": [ + "CVE-2021-23362" + ], "vulnerable": " 12.x", "patched": " ^12.22.2", "ref": "https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/", "overview": "This is a vulnerability in the hosted-git-info npm module which may be vulnerable to denial of service attacks. You can read more about it in https://nvd.nist.gov/vuln/detail/CVE-2021-23362", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "medium" } diff --git a/vuln/core/83.json b/vuln/core/83.json index 41def92e..4886246c 100644 --- a/vuln/core/83.json +++ b/vuln/core/83.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2021-22918"], + "cve": [ + "CVE-2021-22918" + ], "vulnerable": " 12.x || 14.x || 16.x", "patched": " ^12.22.2 || ^14.17.2 || ^16.4.1", "ref": "https://nodejs.org/en/blog/vulnerability/july-2021-security-releases/", "overview": "Node.js is vulnerable to out-of-bounds read in libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22918", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "medium" } diff --git a/vuln/core/84.json b/vuln/core/84.json index 306c2f67..30049090 100644 --- a/vuln/core/84.json +++ b/vuln/core/84.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2021-22931"], + "cve": [ + "CVE-2021-22931" + ], "vulnerable": "12.x || 14.x || 16.x", "patched": "^12.22.5 || ^14.17.5 || ^16.6.2", "ref": "https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/", "overview": "Node.js was vulnerable to Remote Code Execution, XSS, application crashes due to missing input validation of host names returned by Domain Name Servers in the Node.js DNS library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library. You can read more about it in: https://nvd.nist.gov/vuln/detail/CVE-2021-22931", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "high" } diff --git a/vuln/core/85.json b/vuln/core/85.json index dd582bfc..4c761490 100644 --- a/vuln/core/85.json +++ b/vuln/core/85.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2021-22940"], + "cve": [ + "CVE-2021-22940" + ], "vulnerable": "12.x || 14.x || 16.x", "patched": "^12.22.5 || ^14.17.5 || ^16.6.2", "ref": "https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/", "overview": "Node.js was vulnerable to a use after free attack where an attacker might be able to exploit memory corruption to change process behavior. The issue is a follow on to CVE-2021-22930 as the issue was not completely resolved in the fix for CVE-2021-22930. You can read more about it in: https://nvd.nist.gov/vuln/detail/CVE-2021-22940", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "high" } diff --git a/vuln/core/86.json b/vuln/core/86.json index a11aaeed..d29e6a9d 100644 --- a/vuln/core/86.json +++ b/vuln/core/86.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2021-22939"], + "cve": [ + "CVE-2021-22939" + ], "vulnerable": "12.x || 14.x || 16.x", "patched": "^12.22.5 || ^14.17.5 || ^16.6.2", "ref": "https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases/", "overview": "If the Node.js https API was used incorrectly and \"undefined\" was in passed for the \"rejectUnauthorized\" parameter, no error was returned and connections to servers with an expired certificate would have been accepted. You can read more about it in: https://nvd.nist.gov/vuln/detail/CVE-2021-22939", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "low" } diff --git a/vuln/core/87.json b/vuln/core/87.json index 8c9d09f9..f14b1ea2 100644 --- a/vuln/core/87.json +++ b/vuln/core/87.json @@ -1,8 +1,17 @@ { - "cve": ["CVE-2021-37701", "CVE-2021-37712", "CVE-2021-37713", "CVE-2021-39134", "CVE-2021-39135"], + "cve": [ + "CVE-2021-37701", + "CVE-2021-37712", + "CVE-2021-37713", + "CVE-2021-39134", + "CVE-2021-39135" + ], "vulnerable": " 12.x || 14.x", "patched": " ^12.22.6 || ^14.17.6", "ref": "https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases2/", "overview": "npm 6 update - node-tar, aborist, npm client modules. These are vulnerabilities in the node-tar, arborist, and npm cli modules which are related to the initial reports and subsequent remediation of node-tar vulnerabilities CVE-2021-32803 and CVE-2021-32804. Subsequent internal security review of node-tar and additional external bounty reports have resulted in another 5 CVE being remediated in core npm CLI dependencies including node-tar, and npm arborist. You can read more about it in: https://github.com/npm/node-tar/security/advisories/GHSA-9r2w-394v-53qc, https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p, https://github.com/npm/node-tar/security/advisories/GHSA-5955-9wpr-37jh, https://github.com/npm/arborist/security/advisories/GHSA-2h3h-q99f-3fhc), https://github.com/npm/arborist/security/advisories/GHSA-gmw6-94gg-2rc2", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "unknown" } diff --git a/vuln/core/88.json b/vuln/core/88.json index 58720ef8..6cfbc78e 100644 --- a/vuln/core/88.json +++ b/vuln/core/88.json @@ -1,8 +1,14 @@ { - "cve": ["CVE-2021-22959", "CVE-2021-22960"], + "cve": [ + "CVE-2021-22959", + "CVE-2021-22960" + ], "vulnerable": "12.x || 14.x || 16.x", "patched": " ^12.22.7 || ^14.18.1 || ^16.11.1", "ref": "https://nodejs.org/en/blog/vulnerability/oct-2021-security-releases/", "overview": "The http parser accepts requests with a space (SP) right after the header name before the colon. The http parser ignores chunk extensions when parsing the body of chunked requests. These can lead to HTTP Request Smuggling (HRS). See https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22959 and https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22960 for more details.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "medium" } diff --git a/vuln/core/89.json b/vuln/core/89.json index 9a5f979b..15c89065 100644 --- a/vuln/core/89.json +++ b/vuln/core/89.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2021-44531"], + "cve": [ + "CVE-2021-44531" + ], "vulnerable": "12.x || 14.x || 16.x || 17.x", "patched": "^12.22.9 || ^14.18.3 || ^16.13.2 || ^17.3.1", "ref": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "overview": "Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates. Node.js was accepting URI SAN types, which PKIs are often not defined to use. Additionally, when a protocol allows URI SANs, Node.js did not match the URI correctly. See https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44531 for more details.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "medium" } diff --git a/vuln/core/9.json b/vuln/core/9.json index 7c62a531..fe9fd51a 100644 --- a/vuln/core/9.json +++ b/vuln/core/9.json @@ -5,5 +5,8 @@ "ref": "https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/", "description": "automatically loading OPENSSL_CONF is unsafe", "overview": "Always triggering a configuration file load attempt from `OPENSSL_CONF` or the\ndefault location for the current platform may allow an attacker to load\ncompromised OpenSSL configuration into a Node.js process if they are able to\nplace a file in a default location.\n\n", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "medium" } diff --git a/vuln/core/90.json b/vuln/core/90.json index 0a2c4469..247bbe66 100644 --- a/vuln/core/90.json +++ b/vuln/core/90.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2021-44532"], + "cve": [ + "CVE-2021-44532" + ], "vulnerable": "12.x || 14.x || 16.x || 17.x", "patched": "^12.22.9 || ^14.18.3 || ^16.13.2 || ^17.3.1", "ref": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "overview": "Node.js converts SANs (Subject Alternative Names) to a string format. It uses this string to check peer certificates against hostnames when validating connections. The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints. See https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44532 for more details.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "medium" } diff --git a/vuln/core/91.json b/vuln/core/91.json index 7bf4aaa8..01faba11 100644 --- a/vuln/core/91.json +++ b/vuln/core/91.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2021-44533"], + "cve": [ + "CVE-2021-44533" + ], "vulnerable": "12.x || 14.x || 16.x || 17.x", "patched": "^12.22.9 || ^14.18.3 || ^16.13.2 || ^17.3.1", "ref": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "overview": "Node.js did not handle multi-value Relative Distinguished Names correctly. Attackers could craft certificate subjects containing a single-value Relative Distinguished Name that would be interpreted as a multi-value Relative Distinguished Name, for example, in order to inject a Common Name that would allow bypassing the certificate subject verification. See https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44533 for more details.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "medium" } diff --git a/vuln/core/92.json b/vuln/core/92.json index c6e647c2..985ae016 100644 --- a/vuln/core/92.json +++ b/vuln/core/92.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2022-21824"], + "cve": [ + "CVE-2022-21824" + ], "vulnerable": "12.x || 14.x || 16.x || 17.x", "patched": "^12.22.9 || ^14.18.3 || ^16.13.2 || ^17.3.1", "ref": "https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/", "overview": "Due to the formatting logic of the console.table() function it was not safe to allow user controlled input to be passed to the properties parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be __proto__. The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype. See https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21824 for more details.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "low" } diff --git a/vuln/core/93.json b/vuln/core/93.json index 86cdbf29..dbf0f570 100644 --- a/vuln/core/93.json +++ b/vuln/core/93.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2022-0778"], + "cve": [ + "CVE-2022-0778" + ], "vulnerable": "12.x || 14.x || 16.x || 17.x", "patched": "^12.22.11 || ^14.19.1 || ^16.14.2 || ^17.7.2", "ref": "https://nodejs.org/en/blog/vulnerability/mar-2022-security-releases/", "overview": "This is a vulnerability in OpenSSL: Infinite loop in BN_mod_sqrt() reachable when parsing certificates. More details are available at https://www.openssl.org/news/secadv/20220315.txt.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "high" } diff --git a/vuln/core/94.json b/vuln/core/94.json index dd5870d1..3c9254db 100644 --- a/vuln/core/94.json +++ b/vuln/core/94.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2022-32215"], + "cve": [ + "CVE-2022-32215" + ], "vulnerable": "14.x || 16.x || 18.x", "patched": "^14.20.1 || ^16.17.1 || ^18.9.1", "ref": "https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/", "overview": "The llhttp parser in the http module in Node does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "medium" } diff --git a/vuln/core/95.json b/vuln/core/95.json index ecaf874b..da4b47a1 100644 --- a/vuln/core/95.json +++ b/vuln/core/95.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2022-32214"], + "cve": [ + "CVE-2022-32214" + ], "vulnerable": "14.x || 16.x || 18.x", "patched": "^14.20.0 || ^16.20.0 || ^18.5.0", "ref": "https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/", "overview": "The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "medium" } diff --git a/vuln/core/96.json b/vuln/core/96.json index 26507d83..a5a1a2ea 100644 --- a/vuln/core/96.json +++ b/vuln/core/96.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2022-32212"], + "cve": [ + "CVE-2022-32212" + ], "vulnerable": "14.x || 16.x || 18.x", "patched": "^14.20.1 || ^16.17.1 || ^18.9.1", "ref": "https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/", "overview": "The IsAllowedHost check in https://github.com/nodejs/node/blob/fdf0a84e826d3a9ec0ce6f5a3f5adc967fe99408/src/inspector_socket.cc#L580 can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid or not. When an invalid IPv4 address is provided (for instance 10.0.2.555 is provided), the browser will make a DNS requests to the DNS server, providing a vector for an attacker-controlled DNS server to perform a rebinding attack and hence access the JSON file containing the WebSocket file.\n The fix we introduced in https://hackerone.com/reports/1069487 was not complete.", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "high" } diff --git a/vuln/core/97.json b/vuln/core/97.json index 6ae3ae96..0c44af2f 100644 --- a/vuln/core/97.json +++ b/vuln/core/97.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2022-32213"], + "cve": [ + "CVE-2022-32213" + ], "vulnerable": "14.x || 16.x || 18.x", "patched": "^14.20.1 || ^16.17.1 || ^18.9.1", "ref": "https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/", "overview": "The llhttp parser in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).", - "affectedEnvironments": ["all"] + "affectedEnvironments": [ + "all" + ], + "severity": "medium" } diff --git a/vuln/core/98.json b/vuln/core/98.json index 8128aff8..640554fe 100644 --- a/vuln/core/98.json +++ b/vuln/core/98.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2022-32223"], + "cve": [ + "CVE-2022-32223" + ], "vulnerable": "14.x || 16.x || 18.x", "patched": "^14.20.0 || ^16.20.0 || ^18.5.0", "ref": "https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/", - "overview": "Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.\nThis vulnerability can be exploited if the victim has the following dependencies on a Windows machine:\n* OpenSSL has been installed and “C:\\Program Files\\Common Files\\SSL\\openssl.cnf” exists.\n\nWhenever the above conditions are present, `node.exe` will search for `providers.dll` in the current user directory.\nAfter that, `node.exe` will try to search for `providers.dll` by the DLL Search Order in Windows.\n\nIt is possible for an attacker to place the malicious file `providers.dll` under a variety of paths and exploit this vulnerability.", - "affectedEnvironments": ["win32"] + "overview": "Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.\nThis vulnerability can be exploited if the victim has the following dependencies on a Windows machine:\n* OpenSSL has been installed and \u201cC:\\Program Files\\Common Files\\SSL\\openssl.cnf\u201d exists.\n\nWhenever the above conditions are present, `node.exe` will search for `providers.dll` in the current user directory.\nAfter that, `node.exe` will try to search for `providers.dll` by the DLL Search Order in Windows.\n\nIt is possible for an attacker to place the malicious file `providers.dll` under a variety of paths and exploit this vulnerability.", + "affectedEnvironments": [ + "win32" + ], + "severity": "high" } diff --git a/vuln/core/99.json b/vuln/core/99.json index 8559ebcb..1e9211ad 100644 --- a/vuln/core/99.json +++ b/vuln/core/99.json @@ -1,8 +1,13 @@ { - "cve": ["CVE-2022-32222"], + "cve": [ + "CVE-2022-32222" + ], "vulnerable": "14.x || 16.x || 18.x", "patched": "^14.20.0 || ^16.20.0 || ^18.9.1", "ref": "https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/", "overview": "On linux, versions of 18.x prior to Y used a default path for openssl.cnf that was within a path that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.", - "affectedEnvironments": ["linux"] + "affectedEnvironments": [ + "linux" + ], + "severity": "medium" }