mause / proxy-up

Hi there 👋

• 🔭 I’m currently working on duckdb_engine, DuckDB, and a couple of related projects

• ☕ If you appreciate my work on these projects, feel free to buy me a coffee:

• 🌱 I’m currently learning Rust

• 📫 How to reach me:

  • [email protected]
  • @Mause on Discord
  • @Mause_me on Twitter
  • or @[email protected] on mastodon

• 😄 Pronouns: she/her

• ⚡ Fun fact: I live in Western Australia!

proxy-up's Issues

vercel-jwt-auth-1.1.9.tgz: 1 vulnerabilities (highest severity is: 7.8)

Vulnerable Library - vercel-jwt-auth-1.1.9.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/async/package.json

Found in HEAD commit: 4e2e2ec384788352ee3c937839c355ab19f3a5fc

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2021-43138	High	7.8	async-1.5.2.tgz	Transitive	1.1.10	❌

Details

CVE-2021-43138

Vulnerable Library - async-1.5.2.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-1.5.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/async/package.json

Dependency Hierarchy:

• vercel-jwt-auth-1.1.9.tgz (Root Library)
  • express-jwt-6.1.0.tgz
    • ❌ async-1.5.2.tgz (Vulnerable Library)

Found in HEAD commit: 4e2e2ec384788352ee3c937839c355ab19f3a5fc

Found in base branch: main

Vulnerability Details

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

Publish Date: 2022-04-06

URL: CVE-2021-43138

CVSS 3 Score Details (7.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138

Release Date: 2022-04-06

Fix Resolution (async): 2.6.4

Direct dependency fix Resolution (vercel-jwt-auth): 1.1.10

Step up your Open Source Security Game with Mend here

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• Update dependency class-validator to ^0.14.0 [SECURITY]
• Update dependency jsonwebtoken to v9 [SECURITY]
• Update actions/setup-node action to v3.8.0
• Update dependency @logtail/bunyan to ^0.4.0
• Update dependency @logtail/node to ^0.4.0
• Update dependency @types/jsonwebtoken to v9
• Update dependency @types/node to v18
• Update dependency axios to v1
• Update dependency typescript to v5
• Update jest monorepo to v29 (major) (@types/jest, jest, ts-jest)
• Click on this checkbox to rebase all open PRs at once

Detected dependencies

github-actions

.github/workflows/build.yaml

• actions/checkout v3
• actions/setup-node v3.3.0
• actions/upload-artifact v3

.github/workflows/generate-client.yaml

• actions/setup-node v3.3.0
• technote-space/create-pr-action v2

npm

package.json

• @logtail/bunyan ^0.1.10
• @logtail/node ^0.1.10
• @types/bunyan ^1.8.8
• @types/lodash ^4.14.178
• @types/node ^16.11.41
• @vercel/node ^2.0.0
• axios ^0.27.2
• bunyan >=2.0.0
• class-transformer ^0.5.1
• class-validator ^0.13.2
• reflect-metadata ^0.1.13
• typescript ^4.5.4
• vercel-jwt-auth ^1.1.9
• @types/jest ^28.0.0
• @types/jsonwebtoken ^8.5.8
• @types/moxios ^0.4.14
• @types/test-listen ^1.1.0
• jest ^28.0.0
• jsonwebtoken ^8.5.1
• moxios ^0.4.0
• test-listen ^1.1.0
• ts-jest ^28.0.0
• vercel-node-server ^2.2.1
• vercel-openapi ^0.1.13

---

• Check this box to trigger a request for Renovate to run again on this repository

node-0.1.10.tgz: 1 vulnerabilities (highest severity is: 6.1)

Vulnerable Library - node-0.1.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-fetch/package.json

Found in HEAD commit: 4e2e2ec384788352ee3c937839c355ab19f3a5fc

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2022-0235	Medium	6.1	node-fetch-2.6.1.tgz	Transitive	0.1.12	❌

Details

CVE-2022-0235

Vulnerable Library - node-fetch-2.6.1.tgz

A light-weight module that brings window.fetch to node.js

Library home page: https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-fetch/package.json

Dependency Hierarchy:

• node-0.1.10.tgz (Root Library)
  • cross-fetch-3.1.4.tgz
    • ❌ node-fetch-2.6.1.tgz (Vulnerable Library)

Found in HEAD commit: 4e2e2ec384788352ee3c937839c355ab19f3a5fc

Found in base branch: main

Vulnerability Details

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Publish Date: 2022-01-16

URL: CVE-2022-0235

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r683-j2x4-v87g

Release Date: 2022-01-16

Fix Resolution (node-fetch): 2.6.7

Direct dependency fix Resolution (@logtail/node): 0.1.12

Step up your Open Source Security Game with Mend here

bunyan-2.0.5.tgz: 3 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - bunyan-2.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/moment/package.json

Found in HEAD commit: 4e2e2ec384788352ee3c937839c355ab19f3a5fc

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2022-31129	High	7.5	moment-2.29.1.tgz	Transitive	N/A	❌
CVE-2022-24785	High	7.5	moment-2.29.1.tgz	Transitive	N/A	❌
CVE-2021-44906	Medium	5.0	minimist-1.2.5.tgz	Transitive	N/A	❌

Details

CVE-2022-31129

Vulnerable Library - moment-2.29.1.tgz

Parse, validate, manipulate, and display dates

Library home page: https://registry.npmjs.org/moment/-/moment-2.29.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/moment/package.json

Dependency Hierarchy:

• bunyan-2.0.5.tgz (Root Library)
  • ❌ moment-2.29.1.tgz (Vulnerable Library)

Found in HEAD commit: 4e2e2ec384788352ee3c937839c355ab19f3a5fc

Found in base branch: main

Vulnerability Details

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.

Publish Date: 2022-07-06

URL: CVE-2022-31129

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wc69-rhjr-hc9g

Release Date: 2022-07-06

Fix Resolution: moment - 2.29.4

Step up your Open Source Security Game with Mend here

CVE-2022-24785

Vulnerable Library - moment-2.29.1.tgz

Parse, validate, manipulate, and display dates

Library home page: https://registry.npmjs.org/moment/-/moment-2.29.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/moment/package.json

Dependency Hierarchy:

• bunyan-2.0.5.tgz (Root Library)
  • ❌ moment-2.29.1.tgz (Vulnerable Library)

Found in HEAD commit: 4e2e2ec384788352ee3c937839c355ab19f3a5fc

Found in base branch: main

Vulnerability Details

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

Publish Date: 2022-04-04

URL: CVE-2022-24785

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8hfj-j24r-96c4

Release Date: 2022-04-04

Fix Resolution: moment - 2.29.2,Moment.js - 2.29.2

Step up your Open Source Security Game with Mend here

CVE-2021-44906

Vulnerable Library - minimist-1.2.5.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/minimist/package.json

Dependency Hierarchy:

• bunyan-2.0.5.tgz (Root Library)
  • mv-2.1.1.tgz
    • mkdirp-0.5.5.tgz
      • ❌ minimist-1.2.5.tgz (Vulnerable Library)

Found in HEAD commit: 4e2e2ec384788352ee3c937839c355ab19f3a5fc

Found in base branch: main

Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: 2022-03-17

URL: CVE-2021-44906

CVSS 3 Score Details (5.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-03-17

Fix Resolution: minimist - 1.2.6

Step up your Open Source Security Game with Mend here

axios-0.24.0.tgz: 1 vulnerabilities (highest severity is: 5.9) - autoclosed

Vulnerable Library - axios-0.24.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Found in HEAD commit: 4e2e2ec384788352ee3c937839c355ab19f3a5fc

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2022-0536	Medium	5.9	follow-redirects-1.14.7.tgz	Transitive	0.25.0	❌

Details

CVE-2022-0536

Vulnerable Library - follow-redirects-1.14.7.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.14.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy:

• axios-0.24.0.tgz (Root Library)
  • ❌ follow-redirects-1.14.7.tgz (Vulnerable Library)

Found in HEAD commit: 4e2e2ec384788352ee3c937839c355ab19f3a5fc

Found in base branch: main

Vulnerability Details

Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.

Publish Date: 2022-02-09

URL: CVE-2022-0536

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0536

Release Date: 2022-02-09

Fix Resolution (follow-redirects): 1.14.8

Direct dependency fix Resolution (axios): 0.25.0

Step up your Open Source Security Game with Mend here