Skip to content
This repository has been archived by the owner on Feb 7, 2024. It is now read-only.

[Snyk] Fix for 18 vulnerabilities #37

Merged
merged 2 commits into from
Jul 26, 2021
Merged

[Snyk] Fix for 18 vulnerabilities #37

merged 2 commits into from
Jul 26, 2021

Conversation

snyk-bot
Copy link

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:

    • package.json
    • package-lock.json

  • Adding or updating a Snyk policy (.snyk) file; this file is required in order to apply Snyk vulnerability patches.
    Find out more.

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-AWSSDK-1059424		 No Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-CONVICT-1062508		 Yes No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-DATEANDTIME-1054430		 Yes No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-JSONBIGINT-608659		 Yes Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-MERGE-1040469		 Yes No Known Exploit
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-MERGE-1042987		 Yes Proof of Concept
medium severity 520/1000
Why? Has a fix available, CVSS 5.9		 Denial of Service
SNYK-JS-NODEFETCH-674311		 No No Known Exploit
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 HTTP Header Injection
SNYK-JS-NODEMAILER-1296415		 No Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-REDIS-1255645		 Yes No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-UAPARSERJS-1023599		 No Proof of Concept
medium severity 520/1000
Why? Has a fix available, CVSS 5.9		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-UAPARSERJS-1072471		 No No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-UAPARSERJS-610226		 No Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090599		 Yes No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090600		 Yes No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090601		 Yes No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090602		 Yes No Known Exploit
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-YARGSPARSER-560381		 No Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: aws-sdk The new version differs by 10 commits.
  • 8875a35 Updates SDK to v2.814.0
  • dd83d67 throw at invalid profile name in shared ini file (#3585)
  • ee0c5a3 Updates SDK to v2.813.0
  • 468d15b Updates SDK to v2.812.0
  • c50132f Update README.md with references to JS SDK V3 (#3582)
  • 3e19b08 Updates SDK to v2.811.0
  • f26c00d Updates SDK to v2.810.0
  • b393a6e Adds automatic PreSignedUrl generation to RDS.StartDBInstanceAutomatedBackupsReplication (#3566)
  • fa57967 Updates SDK to v2.809.0
  • 9a52018 Updates SDK to v2.808.0

See the full diff

Package name: convict The new version differs by 57 commits.

See the full diff

Package name: mozlog The new version differs by 16 commits.

See the full diff

Package name: node-fetch The new version differs by 12 commits.

See the full diff

Package name: nodemailer The new version differs by 16 commits.

See the full diff

Package name: redis The new version differs by 142 commits.

See the full diff

Package name: ua-parser-js The new version differs by 88 commits.

See the full diff

With a Snyk patch:
Severity Priority Score (*) Issue Exploit Maturity
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 Prototype Pollution
SNYK-JS-LODASH-567746		 Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

snyk-bot and others added 2 commits July 26, 2021 08:53
@snyk-bot
fix: package.json, package-lock.json & .snyk to reduce vulnerabilities
c204765 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-AWSSDK-1059424
- https://snyk.io/vuln/SNYK-JS-CONVICT-1062508
- https://snyk.io/vuln/SNYK-JS-DATEANDTIME-1054430
- https://snyk.io/vuln/SNYK-JS-JSONBIGINT-608659
- https://snyk.io/vuln/SNYK-JS-MERGE-1040469
- https://snyk.io/vuln/SNYK-JS-MERGE-1042987
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-674311
- https://snyk.io/vuln/SNYK-JS-NODEMAILER-1296415
- https://snyk.io/vuln/SNYK-JS-REDIS-1255645
- https://snyk.io/vuln/SNYK-JS-UAPARSERJS-1023599
- https://snyk.io/vuln/SNYK-JS-UAPARSERJS-1072471
- https://snyk.io/vuln/SNYK-JS-UAPARSERJS-610226
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090599
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090600
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090601
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090602
- https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381


The following vulnerabilities are fixed with a Snyk patch:
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
@danielkhoo
chore: npm audit fix
99acf32
@danielkhoo danielkhoo force-pushed the snyk-fix-fa251b75ceb2c70fe674b73aabd46de0 branch from dcc5fed to 99acf32 Compare July 26, 2021 09:20
@danielkhoo danielkhoo merged commit 7240574 into master Jul 26, 2021
@danielkhoo
Copy link

Problem

Send has a bunch of Snyk vulnerabilities. This PR is focused on mitigating the critical and high ones.

Solution

That addressed most of the outstanding "high" vuln. There were few remaining highs which are 3x-4x nested dependencies with no upgrade path. I've set Snyk to temporarily ignore them until an update is available.

image

How to test

All the changes are live on https://send-staging.vault.gov.sg/

Deploy Notes

Will manually deploy to prod once tested and approved.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@snyk-bot @danielkhoo