Skip to content

Commit 1391ac7

Browse files
srmish-jfrogsrmish-jfrog
authored
Add severity to JSON feed (#1374)
* vuln/core: fix bad refs * vuln/core: add severity * vuln/core: CR fixes * vuln/core: CR fixes 2
1 parent 4c60f4c commit 1391ac7

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

149 files changed

+901
-307
lines changed

‎__mocks__/mockVuln/pass/core/1.json

+2-1
Original file line numberDiff line numberDiff line change
@@ -7,5 +7,6 @@
77
"patched": "^8.1.4 || ^7.10.1 || ^4.8.4 || ^6.11.1",
88
"description": "mocked core vulnerability overview",
99
"overview": "mocked core vulnerability overview",
10-
"affectedEnvironments": ["all"]
10+
"affectedEnvironments": ["all"],
11+
"severity": "medium"
1112
}

‎tools/vuln_valid/vulnValidate.js

+4
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,10 @@ const coreModel = joi.object().keys({
3737
// See: https://nodejs.org/api/os.html#osplatform
3838
.items(joi.string().valid("all", "aix", "darwin", "freebsd", "linux", "openbsd", "sunos", "win32", "android"))
3939
.min(1)
40+
.required(),
41+
severity: joi
42+
.string()
43+
.regex(/^(unknown)|(low)|(medium)|(high)|(critical)$/)
4044
.required()
4145
});
4246

‎vuln/core/1.json

+4-1
Original file line numberDiff line numberDiff line change
@@ -7,5 +7,8 @@
77
"patched": "^8.1.4 || ^7.10.1 || ^4.8.4 || ^6.11.1",
88
"description": "memory overread when parsing invalid NAPTR responses",
99
"overview": "The c-ares function ares_parse_naptr_reply(), which is used for parsing NAPTR\nresponses, could be triggered to read memory outside of the given input buffer\nif the passed in DNS response packet was crafted in a particular way.\n\n",
10-
"affectedEnvironments": ["all"]
10+
"affectedEnvironments": [
11+
"all"
12+
],
13+
"severity": "unknown"
1114
}

‎vuln/core/10.json

+4-1
Original file line numberDiff line numberDiff line change
@@ -6,5 +6,8 @@
66
"patched": "^6.9.0",
77
"ref": "https://nodejs.org/en/blog/vulnerability/october-2016-security-releases/",
88
"overview": "The V8 parser mishandled scopes, potentially allowing an attacker to obtain\nsensitive information from arbitrary memory locations via crafted JavaScript\ncode. This vulnerability would require an attacker to be able to execute\narbitrary JavaScript code in a Node.js process.\n\n",
9-
"affectedEnvironments": ["all"]
9+
"affectedEnvironments": [
10+
"all"
11+
],
12+
"severity": "unknown"
1013
}

‎vuln/core/100.json

+7-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
{
2-
"cve": ["CVE-2022-35256"],
2+
"cve": [
3+
"CVE-2022-35256"
4+
],
35
"vulnerable": "14.x || 16.x || 18.x",
46
"patched": "^14.20.1 || ^16.17.1 || ^18.9.1",
57
"ref": "https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/",
68
"overview": "The llhttp parser in the http module in Node.js v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.",
7-
"affectedEnvironments": ["all"]
9+
"affectedEnvironments": [
10+
"all"
11+
],
12+
"severity": "medium"
813
}

‎vuln/core/101.json

+7-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
{
2-
"cve": ["CVE-2022-35255"],
2+
"cve": [
3+
"CVE-2022-35255"
4+
],
35
"vulnerable": "18.x",
46
"patched": "^18.9.1",
57
"ref": "https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/",
68
"overview": "Node.js made calls to EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. However, it does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail.",
7-
"affectedEnvironments": ["all"]
9+
"affectedEnvironments": [
10+
"all"
11+
],
12+
"severity": "high"
813
}

‎vuln/core/102.json

+7-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
{
2-
"cve": ["CVE-2022-43548"],
2+
"cve": [
3+
"CVE-2022-43548"
4+
],
35
"vulnerable": "14.x || 16.x || 18.x || 19.x",
46
"patched": "^14.21.1 || ^16.18.1 || ^18.12.1 || ^19.0.1",
57
"ref": "https://nodejs.org/en/blog/vulnerability/november-2022-security-releases/",
68
"overview": "The Node.js rebinding protector for --inspect still allows invalid IP address, specifically, the octal format.",
7-
"affectedEnvironments": ["all"]
9+
"affectedEnvironments": [
10+
"all"
11+
],
12+
"severity": "medium"
813
}

‎vuln/core/103.json

+7-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
{
2-
"cve": ["CVE-2023-23918"],
2+
"cve": [
3+
"CVE-2023-23918"
4+
],
35
"vulnerable": "14.x || 16.x || 18.x || 19.x",
46
"patched": "^14.21.3 || ^16.19.1 || ^18.14.1 || ^19.6.1",
57
"ref": "https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/",
68
"overview": "It was possible to bypass Permissions and access non authorized modules by using process.mainModule.require(). This only affects users who had enabled the experimental permissions option with --experimental-policy.",
7-
"affectedEnvironments": ["all"]
9+
"affectedEnvironments": [
10+
"all"
11+
],
12+
"severity": "high"
813
}

‎vuln/core/104.json

+7-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
{
2-
"cve": ["CVE-2023-23919"],
2+
"cve": [
3+
"CVE-2023-23919"
4+
],
35
"vulnerable": "14.x || 16.x || 18.x || 19.x",
46
"patched": "^14.21.3 || ^16.19.1 || ^18.14.1 || ^19.2.0",
57
"ref": "https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/",
68
"overview": "In some cases Node.js did does not clear the OpenSSL error stack after operations that may set it. This may lead to false positive errors during subsequent cryptographic operations that happen to be on the same thread. This in turn could be used to cause a denial of service.",
7-
"affectedEnvironments": ["all"]
9+
"affectedEnvironments": [
10+
"all"
11+
],
12+
"severity": "medium"
813
}

‎vuln/core/105.json

+7-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
{
2-
"cve": ["CVE-2023-23936"],
2+
"cve": [
3+
"CVE-2023-23936"
4+
],
35
"vulnerable": "14.x || 16.x || 18.x || 19.x",
46
"patched": "^14.21.3 || ^16.19.1 || ^18.14.1 || ^19.6.1",
57
"ref": "https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/",
68
"overview": "The fetch API in Node.js did not prevent CRLF injection in the 'host' header potentially allowing attacks such as HTTP response splitting and HTTP header injection.",
7-
"affectedEnvironments": ["all"]
9+
"affectedEnvironments": [
10+
"all"
11+
],
12+
"severity": "medium"
813
}

‎vuln/core/106.json

+7-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
{
2-
"cve": ["CVE-2023-24807"],
2+
"cve": [
3+
"CVE-2023-24807"
4+
],
35
"vulnerable": "14.x || 16.x || 18.x || 19.x",
46
"patched": "^14.21.3 || ^16.19.1 || ^18.14.1 || ^19.6.1",
57
"ref": "https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/",
68
"overview": "The Headers.set() and Headers.append() methods in the fetch API in Node.js where vulnerable to Regular a Expression Denial of Service (ReDoS) attacks.",
7-
"affectedEnvironments": ["all"]
9+
"affectedEnvironments": [
10+
"all"
11+
],
12+
"severity": "low"
813
}

‎vuln/core/107.json

+7-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
{
2-
"cve": ["CVE-2023-23920"],
2+
"cve": [
3+
"CVE-2023-23920"
4+
],
35
"vulnerable": "14.x || 16.x || 18.x || 19.x",
46
"patched": "^14.21.3 || ^16.19.1 || ^18.14.1 || ^19.6.1",
57
"ref": "https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/",
68
"overview": "Node.js would search and potentially load ICU data when running with elevated priviledges. Node.js was modified to build with ICU_NO_USER_DATA_OVERRIDE to avoid this.",
7-
"affectedEnvironments": ["all"]
9+
"affectedEnvironments": [
10+
"all"
11+
],
12+
"severity": "low"
813
}

‎vuln/core/108.json

+7-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
{
2-
"cve": ["CVE-2023-30581"],
2+
"cve": [
3+
"CVE-2023-30581"
4+
],
35
"vulnerable": "16.x || 18.x || 20.x",
46
"patched": "^16.20.1 || ^18.16.1 || ^20.3.1",
57
"ref": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases/",
68
"overview": "The use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definition",
7-
"affectedEnvironments": ["all"]
9+
"affectedEnvironments": [
10+
"all"
11+
],
12+
"severity": "high"
813
}

‎vuln/core/109.json

+7-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
{
2-
"cve": ["CVE-2023-30582"],
2+
"cve": [
3+
"CVE-2023-30582"
4+
],
35
"vulnerable": "20.x",
46
"patched": "^20.3.1",
57
"ref": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases/",
68
"overview": "A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non-* argument.",
7-
"affectedEnvironments": ["all"]
9+
"affectedEnvironments": [
10+
"all"
11+
],
12+
"severity": "medium"
813
}

‎vuln/core/11.json

+4-1
Original file line numberDiff line numberDiff line change
@@ -6,5 +6,8 @@
66
"author": "Jann Horn",
77
"description": "unauthorized clients can easily access inspector port",
88
"overview": "Generate a UUID for each execution of the inspector. This provides additional\nsecurity to prevent unauthorized clients from connecting to the Node.js process\nvia the v8_inspector port when running with `--inspect`. Since the debugging\nprotocol allows extensive access to the internals of a running process, and the\nexecution of arbitrary code, it is important to limit connections to authorized\ntools only.\n\n",
9-
"affectedEnvironments": ["all"]
9+
"affectedEnvironments": [
10+
"all"
11+
],
12+
"severity": "medium"
1013
}

‎vuln/core/110.json

+7-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
{
2-
"cve": ["CVE-2023-30583"],
2+
"cve": [
3+
"CVE-2023-30583"
4+
],
35
"vulnerable": "20.x",
46
"patched": "^20.3.1",
57
"ref": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases/",
68
"overview": "fs.openAsBlob() can bypass the experimental permission model when using the file system read restriction with the --allow-fs-read flag in Node.js 20",
7-
"affectedEnvironments": ["all"]
9+
"affectedEnvironments": [
10+
"all"
11+
],
12+
"severity": "medium"
813
}

‎vuln/core/111.json

+7-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
{
2-
"cve": ["CVE-2023-30584"],
2+
"cve": [
3+
"CVE-2023-30584"
4+
],
35
"vulnerable": "20.x",
46
"patched": "^20.3.1",
57
"ref": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases/",
68
"overview": "A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. This flaw relates to improper handling of path traversal bypass when verifying file permissions.",
7-
"affectedEnvironments": ["all"]
9+
"affectedEnvironments": [
10+
"all"
11+
],
12+
"severity": "high"
813
}

‎vuln/core/112.json

+7-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
{
2-
"cve": ["CVE-2023-30585"],
2+
"cve": [
3+
"CVE-2023-30585"
4+
],
35
"vulnerable": "16.x || 18.x || 20.x",
46
"patched": "^16.20.1 || ^18.16.1 || ^20.3.1",
57
"ref": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases/",
68
"overview": "Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process",
7-
"affectedEnvironments": ["win32"]
9+
"affectedEnvironments": [
10+
"win32"
11+
],
12+
"severity": "medium"
813
}

‎vuln/core/113.json

+7-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
{
2-
"cve": ["CVE-2023-30586"],
2+
"cve": [
3+
"CVE-2023-30586"
4+
],
35
"vulnerable": "20.x",
46
"patched": "^20.3.1",
57
"ref": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases/",
68
"overview": "Node.js 20 allows loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model.",
7-
"affectedEnvironments": ["all"]
9+
"affectedEnvironments": [
10+
"all"
11+
],
12+
"severity": "medium"
813
}

‎vuln/core/114.json

+7-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
{
2-
"cve": ["CVE-2023-30587"],
2+
"cve": [
3+
"CVE-2023-30587"
4+
],
35
"vulnerable": "20.x",
46
"patched": "^20.3.1",
57
"ref": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases/",
68
"overview": "A vulnerability in Node.js version 20 allows for bypassing restrictions set by the --experimental-permission flag using the built-in inspector module (node:inspector).",
7-
"affectedEnvironments": ["all"]
9+
"affectedEnvironments": [
10+
"all"
11+
],
12+
"severity": "high"
813
}

‎vuln/core/115.json

+7-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
{
2-
"cve": ["CVE-2023-30589"],
2+
"cve": [
3+
"CVE-2023-30589"
4+
],
35
"vulnerable": "16.x || 18.x || 20.x",
46
"patched": "^16.20.1 || ^18.16.1 || ^20.3.1",
57
"ref": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases/",
68
"overview": "The llhttp parser in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests.",
7-
"affectedEnvironments": ["all"]
9+
"affectedEnvironments": [
10+
"all"
11+
],
12+
"severity": "medium"
813
}

‎vuln/core/116.json

+7-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
{
2-
"cve": ["CVE-2023-30588"],
2+
"cve": [
3+
"CVE-2023-30588"
4+
],
35
"vulnerable": "16.x || 18.x || 20.x",
46
"patched": "^16.20.1 || ^18.16.1 || ^20.3.1",
57
"ref": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases/",
68
"overview": "When an invalid public key is used to create an x509 certificate using the crypto.X509Certificate() API a non-expect termination occurs.",
7-
"affectedEnvironments": ["all"]
9+
"affectedEnvironments": [
10+
"all"
11+
],
12+
"severity": "medium"
813
}

‎vuln/core/117.json

+7-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
{
2-
"cve": ["CVE-2023-30590"],
2+
"cve": [
3+
"CVE-2023-30590"
4+
],
35
"vulnerable": "16.x || 18.x || 20.x",
46
"patched": "^16.20.1 || ^18.16.1 || ^20.3.1",
57
"ref": "https://nodejs.org/en/blog/vulnerability/june-2023-security-releases/",
68
"overview": "The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key if none has been set yet.",
7-
"affectedEnvironments": ["all"]
9+
"affectedEnvironments": [
10+
"all"
11+
],
12+
"severity": "medium"
813
}

‎vuln/core/118.json

+7-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
{
2-
"cve": ["CVE-2023-32002"],
2+
"cve": [
3+
"CVE-2023-32002"
4+
],
35
"vulnerable": "16.x || 18.x || 20.x",
46
"patched": "^16.20.2 || ^18.17.1 || ^20.5.1",
57
"ref": "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases/",
68
"overview": "The use of Module._load() can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.",
7-
"affectedEnvironments": ["all"]
9+
"affectedEnvironments": [
10+
"all"
11+
],
12+
"severity": "unknown"
813
}

‎vuln/core/119.json

+7-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
{
2-
"cve": ["CVE-2023-32004"],
2+
"cve": [
3+
"CVE-2023-32004"
4+
],
35
"vulnerable": "20.x",
46
"patched": "^20.5.1",
57
"ref": "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases/",
68
"overview": "Improper handling of Buffers in file system APIs causing a traversal path to bypass when verifying file permissions.",
7-
"affectedEnvironments": ["all"]
9+
"affectedEnvironments": [
10+
"all"
11+
],
12+
"severity": "unknown"
813
}

‎vuln/core/12.json

+4-1
Original file line numberDiff line numberDiff line change
@@ -7,5 +7,8 @@
77
"patched": "^6.7.0 || ^4.6.0",
88
"description": "openssl 1.0.2h vulnerabilities",
99
"overview": "A malicious client can exhaust a server's memory, resulting in a denial of\nservice (DoS) by sending very large OCSP Status Request extensions in a single\nsession.\n\nThis flaw is labelled high severity due to the ease of use for a DoS attack and\nNode.js servers using TLS are vulnerable.\n\n",
10-
"affectedEnvironments": ["all"]
10+
"affectedEnvironments": [
11+
"all"
12+
],
13+
"severity": "unknown"
1114
}

‎vuln/core/120.json

+7-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
{
2-
"cve": ["CVE-2023-32558"],
2+
"cve": [
3+
"CVE-2023-32558"
4+
],
35
"vulnerable": "20.x",
46
"patched": "^20.5.1",
57
"ref": "https://nodejs.org/en/blog/vulnerability/august-2023-security-releases/",
68
"overview": "The use of the deprecated API process.binding() can bypass the permission model through path traversal.",
7-
"affectedEnvironments": ["all"]
9+
"affectedEnvironments": [
10+
"all"
11+
],
12+
"severity": "unknown"
813
}

0 commit comments

Comments
 (0)