Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVE-2022-0436 (High) detected in grunt-1.4.1.tgz #1450

Closed
mend-for-github-com bot opened this issue Apr 13, 2022 · 0 comments · Fixed by #1451
Closed

CVE-2022-0436 (High) detected in grunt-1.4.1.tgz #1450

mend-for-github-com bot opened this issue Apr 13, 2022 · 0 comments · Fixed by #1451
Labels
cve Security vulnerabilities detected by Dependabot or Mend high severity High severity CVE Mend: dependency security vulnerability Security vulnerability detected by Mend v1.3.2 v2.0.0

Comments

@mend-for-github-com
Copy link

CVE-2022-0436 - High Severity Vulnerability

Vulnerable Library - grunt-1.4.1.tgz

The JavaScript Task Runner

Library home page: https://registry.npmjs.org/grunt/-/grunt-1.4.1.tgz

Dependency Hierarchy:

  • ❌ grunt-1.4.1.tgz (Vulnerable Library)

Found in HEAD commit: 1f013aefac1f138a222cc12ce7c617c2b3407847

Found in base branch: main

Vulnerability Details

Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2.

Publish Date: 2022-04-12

URL: CVE-2022-0436

CVSS 3 Score Details (7.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0436

Release Date: 2022-04-12

Fix Resolution: grunt - 1.5.2
@mend-for-github-com mend-for-github-com bot added the Mend: dependency security vulnerability Security vulnerability detected by Mend label Apr 13, 2022
@tmarkley tmarkley added high severity High severity CVE cve Security vulnerabilities detected by Dependabot or Mend labels Apr 13, 2022
tmarkley pushed a commit to tmarkley/OpenSearch-Dashboards that referenced this issue Apr 13, 2022
Bumps grunt from v1.4.1 to v1.5.2
34920ac 
* Addresses CVE-2022-0436.
* [CHANGELOG](https://github.com/gruntjs/grunt/blob/v1.5.2/CHANGELOG)

Resolves opensearch-project#1450

Signed-off-by: Tommy Markley <markleyt@amazon.com>
@tmarkley tmarkley mentioned this issue Apr 13, 2022
Merged
7 tasks
tmarkley pushed a commit to tmarkley/OpenSearch-Dashboards that referenced this issue Apr 16, 2022
Bumps grunt from v1.4.1 to v1.5.2
2ef3e2d 
* Addresses CVE-2022-0436.
* [CHANGELOG](https://github.com/gruntjs/grunt/blob/v1.5.2/CHANGELOG)

Resolves opensearch-project#1450

Signed-off-by: Tommy Markley <markleyt@amazon.com>
tmarkley pushed a commit that referenced this issue Apr 18, 2022
Bumps grunt from v1.4.1 to v1.5.2 (#1451)
cef9e61 
* Addresses CVE-2022-0436.
* [CHANGELOG](https://github.com/gruntjs/grunt/blob/v1.5.2/CHANGELOG)

Resolves #1450

Signed-off-by: Tommy Markley <markleyt@amazon.com>
tmarkley pushed a commit to tmarkley/OpenSearch-Dashboards that referenced this issue Apr 28, 2022
Bumps grunt from v1.4.1 to v1.5.2 (opensearch-project#1451)
8fec26f 
* Addresses CVE-2022-0436.
* [CHANGELOG](https://github.com/gruntjs/grunt/blob/v1.5.2/CHANGELOG)

Resolves opensearch-project#1450

Signed-off-by: Tommy Markley <markleyt@amazon.com>
@tmarkley tmarkley mentioned this issue Apr 28, 2022
Merged
1 task
tmarkley pushed a commit that referenced this issue Apr 29, 2022
Bumps grunt from v1.4.1 to v1.5.2 (#1451) (#1516)
ee98789 
* Addresses CVE-2022-0436.
* [CHANGELOG](https://github.com/gruntjs/grunt/blob/v1.5.2/CHANGELOG)

Resolves #1450

Signed-off-by: Tommy Markley <markleyt@amazon.com>
ananzh added a commit to ananzh/OpenSearch-Dashboards that referenced this issue Mar 29, 2023
@ananzh
[CVE-2022-1537][CVE-2022-0436][1.x]bump grunt from 1.4.1 to 1.5.3
e2ec89e 
Main bump grunt via this PR:
 opensearch-project#1580

In 1.x, bump grunt is different because v1.5.3 requires node>=8
and no breaking changes. This is the latest version with no node
conflicts.  grunt requires node>=16 sincev1.6.0 . Therefore, we
should be very specific and limit the bump range.

Issue Resolve:
opensearch-project#1579
opensearch-project#1450

Signed-off-by: Anan Zhuang <ananzh@amazon.com>
@ananzh ananzh mentioned this issue Mar 29, 2023
Merged
8 tasks
ananzh added a commit to ananzh/OpenSearch-Dashboards that referenced this issue Mar 29, 2023
@ananzh
[CVE-2022-1537][CVE-2022-0436][1.x]bump grunt from 1.4.1 to 1.5.3
a91accf 
Main bump grunt via this PR:
 opensearch-project#1580

In 1.x, bump grunt is different because v1.5.3 requires node>=8
and no breaking changes. This is the latest version with no node
conflicts.  grunt requires node>=16 sincev1.6.0 . Therefore, we
should be very specific and limit the bump range.

Issue Resolve:
opensearch-project#1579
opensearch-project#1450

Signed-off-by: Anan Zhuang <ananzh@amazon.com>
ananzh added a commit to ananzh/OpenSearch-Dashboards that referenced this issue Mar 29, 2023
@ananzh
[CVE-2022-1537][CVE-2022-0436][1.x]bump grunt from 1.4.1 to 1.5.3
b304de9 
Main bump grunt via this PR:
 opensearch-project#1580

In 1.x, bump grunt is different because v1.5.3 requires node>=8
and no breaking changes. This is the latest version with no node
conflicts.  grunt requires node>=16 sincev1.6.0 . Therefore, we
should be very specific and limit the bump range.

Issue Resolve:
opensearch-project#1579
opensearch-project#1450

Signed-off-by: Anan Zhuang <ananzh@amazon.com>
ananzh added a commit to ananzh/OpenSearch-Dashboards that referenced this issue Mar 30, 2023
@ananzh
[CVE-2022-1537][CVE-2022-0436][1.x]bump grunt from 1.4.1 to 1.5.3
7ba2832 
Main bump grunt via this PR:
 opensearch-project#1580

In 1.x, bump grunt is different because v1.5.3 requires node>=8
and no breaking changes. This is the latest version with no node
conflicts.  grunt requires node>=16 sincev1.6.0 . Therefore, we
should be very specific and limit the bump range.

Issue Resolve:
opensearch-project#1579
opensearch-project#1450

Signed-off-by: Anan Zhuang <ananzh@amazon.com>
joshuarrrr added a commit that referenced this issue Mar 31, 2023
@ananzh @joshuarrrr
[CVE-2022-1537][CVE-2022-0436][1.x]bump grunt from 1.4.1 to 1.5.3 (#3723
65deacb 
)

Main bump grunt via this PR:
 #1580

In 1.x, bump grunt is different because v1.5.3 requires node>=8
and no breaking changes. This is the latest version with no node
conflicts.  grunt requires node>=16 sincev1.6.0 . Therefore, we
should be very specific and limit the bump range.

Issue Resolve:
#1579
#1450

Signed-off-by: Anan Zhuang <ananzh@amazon.com>
Co-authored-by: Josh Romero <rmerqg@amazon.com>
opensearch-trigger-bot bot pushed a commit that referenced this issue Jun 28, 2023
@github-actions
[CVE-2022-1537][CVE-2022-0436][1.x]bump grunt from 1.4.1 to 1.5.3 (#3723
4081cac 
)

Main bump grunt via this PR:
 #1580

In 1.x, bump grunt is different because v1.5.3 requires node>=8
and no breaking changes. This is the latest version with no node
conflicts.  grunt requires node>=16 sincev1.6.0 . Therefore, we
should be very specific and limit the bump range.

Issue Resolve:
#1579
#1450

Signed-off-by: Anan Zhuang <ananzh@amazon.com>
Co-authored-by: Josh Romero <rmerqg@amazon.com>
(cherry picked from commit 65deacb)
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

# Conflicts:
#	CHANGELOG.md
ashwin-pc pushed a commit that referenced this issue Jun 30, 2023
@opensearch-trigger-bot @github-actions
[CVE-2022-1537][CVE-2022-0436][1.x]bump grunt from 1.4.1 to 1.5.3 (#3723
982c83b 
) (#4435)

Main bump grunt via this PR:
 #1580

In 1.x, bump grunt is different because v1.5.3 requires node>=8
and no breaking changes. This is the latest version with no node
conflicts.  grunt requires node>=16 sincev1.6.0 . Therefore, we
should be very specific and limit the bump range.

Issue Resolve:
#1579
#1450

Signed-off-by: Anan Zhuang <ananzh@amazon.com>
Co-authored-by: Josh Romero <rmerqg@amazon.com>
(cherry picked from commit 65deacb)
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

# Conflicts:
#	CHANGELOG.md

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
cve Security vulnerabilities detected by Dependabot or Mend high severity High severity CVE Mend: dependency security vulnerability Security vulnerability detected by Mend v1.3.2 v2.0.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Bumps grunt from v1.4.1 to v1.5.2 tmarkley/OpenSearch-Dashboards
1 participant
@tmarkley