Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(deps): update dependency nodemailer to v6.9.9 [security] #6620

Closed
wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Oct 4, 2024

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
nodemailer (source) 6.9.1 -> 6.9.9 age adoption passing confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

GHSA-9h6g-pr28-7cqp

Summary

A ReDoS vulnerability occurs when nodemailer tries to parse img files with the parameter attachDataUrls set, causing the stuck of event loop.
Another flaw was found when nodemailer tries to parse an attachments with a embedded file, causing the stuck of event loop.

Details

Regex: /^data:((?:[^;];)(?:[^,])),(.)$/

Path: compile -> getAttachments -> _processDataUrl

Regex: /(<img\b[^>]* src\s*=[\s"']*)(data:([^;]+);[^"'>\s]+)/

Path: _convertDataImages

PoC

https://gist.github.com/francoatmega/890dd5053375333e40c6fdbcc8c58df6
https://gist.github.com/francoatmega/9aab042b0b24968d7b7039818e8b2698

Impact

ReDoS causes the event loop to stuck a specially crafted evil email can cause this problem.


Release Notes

nodemailer/nodemailer (nodemailer)

v6.9.9

Compare Source

Bug Fixes
  • security: Fix issues described in GHSA-9h6g-pr28-7cqp. Do not use eternal matching pattern if only a few occurences are expected (dd8f5e8)
  • tests: Use native node test runner, added code coverage support, removed grunt (#​1604) (be45c1b)

v6.9.8

Compare Source

Bug Fixes
  • punycode: do not use native punycode module (b4d0e0c)

v6.9.7

Compare Source

Bug Fixes
  • customAuth: Do not require user and pass to be set for custom authentication schemes (fixes #​1584) (41d482c)

v6.9.6

Compare Source

Bug Fixes
  • inline: Use 'inline' as the default Content Dispostion value for embedded images (db32c93)
  • tests: Removed Node v12 from test matrix as it is not compatible with the test framework anymore (7fe0a60)

v6.9.5

Compare Source

Bug Fixes
  • license: Updated license year (da4744e)

v6.9.4

Compare Source

  • Renamed SendinBlue to Brevo

v6.9.3

Compare Source

  • Specified license identifier (was defined as MIT, actual value MIT-0)
  • If SMTP server disconnects with a message, process it and include as part of the response error

v6.9.2

Compare Source

  • Fix uncaught exception on invalid attachment content payload

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Copy link

github-actions bot commented Oct 4, 2024

Hey there and thank you for opening this pull request! 👋

We require pull request titles to follow the Conventional Commits specification and it looks like your proposed title needs to be adjusted.

Your PR title is: fix(deps): update dependency nodemailer to v6.9.9 [security]
It should be something like: feat(scope): Add fancy new feature

Details:

Unknown scope "deps" found in pull request title "fix(deps): update dependency nodemailer to v6.9.9 [security]". Scope must match one of: root, api, dashboard, inbound-mail, web, webhook, widget, worker, ws, ee-auth, ee-billing, ee-dal, ee-shared-services, ee-translation, application-generic, automation, dal, design-system, embed, notifications, novui, testing, client, framework, headless, js, nest, nextjs, node, notification-center, novu, providers, react, react-native, shared, stateless, nestjs, nextjs.

Copy link

netlify bot commented Oct 4, 2024

Deploy Preview for novu-stg-vite-dashboard-poc ready!

Name Link
🔨 Latest commit 5e672d2
🔍 Latest deploy log https://app.netlify.com/sites/novu-stg-vite-dashboard-poc/deploys/673347e91400ad0008da9497
😎 Deploy Preview https://deploy-preview-6620--novu-stg-vite-dashboard-poc.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

@renovate renovate bot force-pushed the renovate/npm-nodemailer-vulnerability branch from 44faabe to 49f30ba Compare October 4, 2024 14:02
@renovate renovate bot force-pushed the renovate/npm-nodemailer-vulnerability branch from 49f30ba to 90c6f77 Compare October 4, 2024 14:44
@renovate renovate bot force-pushed the renovate/npm-nodemailer-vulnerability branch from 90c6f77 to 17b88a1 Compare October 4, 2024 15:01
@renovate renovate bot force-pushed the renovate/npm-nodemailer-vulnerability branch from 17b88a1 to d40a6d8 Compare October 4, 2024 16:57
@renovate renovate bot force-pushed the renovate/npm-nodemailer-vulnerability branch from d40a6d8 to 5940369 Compare October 4, 2024 18:54
@renovate renovate bot force-pushed the renovate/npm-nodemailer-vulnerability branch from 5940369 to 758b3eb Compare October 4, 2024 19:34
@renovate renovate bot force-pushed the renovate/npm-nodemailer-vulnerability branch from 758b3eb to 04afb20 Compare October 6, 2024 13:01
@renovate renovate bot force-pushed the renovate/npm-nodemailer-vulnerability branch from 92d12b9 to 3b1926e Compare November 12, 2024 08:18
@renovate renovate bot force-pushed the renovate/npm-nodemailer-vulnerability branch from 3b1926e to 3f294e5 Compare November 12, 2024 09:24
@renovate renovate bot force-pushed the renovate/npm-nodemailer-vulnerability branch from 3f294e5 to 0479445 Compare November 12, 2024 09:52
@renovate renovate bot force-pushed the renovate/npm-nodemailer-vulnerability branch from 0479445 to 398a54f Compare November 12, 2024 10:31
@renovate renovate bot force-pushed the renovate/npm-nodemailer-vulnerability branch from 398a54f to 91abfdb Compare November 12, 2024 11:00
@renovate renovate bot force-pushed the renovate/npm-nodemailer-vulnerability branch from 91abfdb to 0daf6cc Compare November 12, 2024 11:54
@renovate renovate bot force-pushed the renovate/npm-nodemailer-vulnerability branch from 0daf6cc to 5e672d2 Compare November 12, 2024 12:19
@merrcury merrcury closed this Nov 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant