Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk-local] Fix for 42 vulnerabilities #5268

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

snyk-bot
Copy link

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • goof/package.json
    • goof/package-lock.json
    • goof/.snyk

Vulnerabilities that will be fixed

With an upgrade:
Severity Issue Breaking Change Exploit Maturity
high severity Denial of Service (DoS)
SNYK-JS-EXPRESSFILEUPLOAD-473997
Yes No Known Exploit
medium severity Prototype Pollution
SNYK-JS-JQUERY-174006
Yes No Known Exploit
medium severity Denial of Service (DoS)
SNYK-JS-JSYAML-173999
Yes No Known Exploit
high severity Arbitrary Code Execution
SNYK-JS-JSYAML-174129
Yes No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MARKED-174116
No No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MARKED-451540
No No Known Exploit
high severity Denial of Service (DoS)
SNYK-JS-MONGODB-473855
Yes No Known Exploit
medium severity Information Exposure
SNYK-JS-MONGOOSE-472486
Yes No Known Exploit
medium severity Arbitrary Code Injection
SNYK-JS-MORGAN-72579
No Proof of Concept
high severity Arbitrary File Write via Archive Extraction (Zip Slip)
npm:adm-zip:20180415
No Mature
low severity Regular Expression Denial of Service (ReDoS)
npm:braces:20180219
Yes Proof of Concept
low severity Regular Expression Denial of Service (ReDoS)
npm:debug:20170905
No No Known Exploit
high severity Code Injection
npm:dustjs-linkedin:20160819
No No Known Exploit
high severity Arbitrary Code Execution
npm:ejs:20161128
Yes No Known Exploit
medium severity Cross-site Scripting (XSS)
npm:ejs:20161130
Yes No Known Exploit
medium severity Denial of Service (DoS)
npm:ejs:20161130-1
Yes No Known Exploit
high severity Regular Expression Denial of Service (ReDoS)
npm:fresh:20170908
No No Known Exploit
medium severity Prototype Pollution
npm:hoek:20180212
Yes No Known Exploit
medium severity Cross-site Scripting (XSS)
npm:jquery:20150627
Yes No Known Exploit
high severity Content & Code Injection (XSS)
npm:marked:20150520
No No Known Exploit
high severity Cross-site Scripting (XSS) via Data URIs
npm:marked:20170112
No No Known Exploit
high severity Cross-site Scripting (XSS)
npm:marked:20170815
No No Known Exploit
medium severity Cross-site Scripting (XSS)
npm:marked:20170815-1
No No Known Exploit
high severity Regular Expression Denial of Service (ReDoS)
npm:marked:20170907
No No Known Exploit
high severity Regular Expression Denial of Service (ReDoS)
npm:marked:20180225
No Proof of Concept
low severity Regular Expression Denial of Service (ReDoS)
npm:mime:20170907
Yes No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
npm:moment:20161019
No No Known Exploit
low severity Regular Expression Denial of Service (ReDoS)
npm:moment:20170905
No No Known Exploit
medium severity Remote Memory Exposure
npm:mongoose:20160116
No Mature
medium severity Regular Expression Denial of Service (ReDoS)
npm:ms:20151024
No No Known Exploit
low severity Regular Expression Denial of Service (ReDoS)
npm:ms:20170412
Yes No Known Exploit
high severity Regular Expression Denial of Service (DoS)
npm:negotiator:20160616
Yes No Known Exploit
high severity Uninitialized Memory Exposure
npm:npmconf:20180512
Yes Mature
high severity Prototype Override Protection Bypass
npm:qs:20170213
No No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
npm:semver:20150403
Yes No Known Exploit
medium severity Directory Traversal
npm:st:20140206
No No Known Exploit
medium severity Open Redirect
npm:st:20171013
Yes Mature
medium severity Uninitialized Memory Exposure
npm:tunnel-agent:20170305
Yes Proof of Concept
Commit messages
Package name: adm-zip The new version differs by 50 commits.

See the full diff

Package name: body-parser The new version differs by 221 commits.

See the full diff

Package name: cfenv The new version differs by 7 commits.
  • 6927628 version 1.2.1
  • 3f19f12 Upgrade js-yaml to avoid Denial of Service
  • a5dbceb version 1.2.0
  • 1a730e3 Stop using outdated manifest stanza; use random-route instead
  • f8b0392 Upgrade underscore version 1.9.x
  • b60ef7c add test for local vcapFile port usage
  • c6262a6 Locally use the options to read the port

See the full diff

Package name: errorhandler The new version differs by 85 commits.

See the full diff

Package name: express The new version differs by 250 commits.
  • f974d22 4.16.0
  • 8d4ceb6 docs: add more information to installation
  • c0136d8 Add express.json and express.urlencoded to parse bodies
  • 86f5df0 deps: serve-static@1.13.0
  • 4196458 deps: send@0.16.0
  • ddeb713 tests: add maxAge option tests for res.sendFile
  • 7154014 Add "escape json" setting for res.json and res.jsonp
  • 628438d deps: update example dependencies
  • a24fd0c Add options to res.download
  • 95fb5cc perf: remove dead .charset set in res.jsonp
  • 44591fe deps: vary@~1.1.2
  • 2df1ad2 Improve error messages when non-function provided as middleware
  • 12c3712 Use safe-buffer for improved Buffer API
  • fa272ed docs: fix typo in jsdoc comment
  • d9d09b8 perf: re-use options object when generating ETags
  • 02a9d5f deps: proxy-addr@~2.0.2
  • c2f4fb5 deps: finalhandler@1.1.0
  • 673d51f deps: utils-merge@1.0.1
  • 5cc761c deps: parseurl@~1.3.2
  • ad7d96d deps: qs@6.5.1
  • e62bb8b deps: etag@~1.8.1
  • 70589c3 deps: content-type@~1.0.4
  • 9a99c15 deps: accepts@~1.3.4
  • 550043c deps: setprototypeof@1.1.0

See the full diff

Package name: humanize-ms The new version differs by 3 commits.

See the full diff

Package name: marked The new version differs by 250 commits.

See the full diff

Package name: mongoose The new version differs by 250 commits.
  • 40a879b chore: release 5.7.5
  • 159457d chore: add vpn black friday as sponsor
  • e6285ea Merge pull request #8244 from AbdelrahmanHafez/master
  • d9163f5 fix: correct order for declaration
  • cec9dda Minor refactor to ValidationError
  • 13ae085 docs(index): add favicon to home page
  • 96ce0eb style: fix lint
  • 973b1e0 docs: add schema options to API docs
  • cdfb507 chore: add useUnifiedTopology for tests re: #8212
  • 936ddfb fix(update): handle subdocument pre('validate') errors in update validation
  • 98b3b09 test(update): repro #7187
  • b9c1012 docs(middleware): add note about accessing the document being updated in pre('findOneAndUpdate')
  • 327b47a fix(subdocument): make subdocument#isModified use parent document's isModified
  • 54db026 test(subdocument): repro #8223
  • 89eb449 chore: now working on 5.7.5
  • ffbff22 chore: change version for recompiling website
  • 0562ca7 chore: add opencollective sponsors: top web design companies, casino top
  • ee22c09 chore: now working on 5.7.5
  • f3eca5b fix(query): delete top-level `_bsontype` property in queries to prevent silent empty queries
  • cc10e0d test(query): repro #8222
  • ede5aef chore: release 5.7.4
  • 402db1a fix(model): support passing `options` to `Model.remove()`
  • 7a20276 fix(schema): handle `required: null` and `required: undefined` as `required: false`
  • 9b4a323 test(schema): repro #8219

See the full diff

Package name: morgan The new version differs by 27 commits.

See the full diff

Package name: ms The new version differs by 19 commits.

See the full diff

Package name: tap The new version differs by 250 commits.
  • fe8158e 11.1.3
  • b17542d Upgrade deps (changing semver requirements)
  • bc3ba17 update deps
  • bd4de92 Clean up nyc output so Travis passes on node 6
  • 2292432 Add hexagonal-lambda to the tap 100 list
  • fed62c9 Merge remote-tracking branch 'origin/master'
  • 3cdf1c7 11.1.2
  • ddf938b Only ship files we want to ship
  • 5b5e2ee docs: add unique page titles
  • 2323c3b Merge tag 'v11.1.1'
  • 95faf6c 11.1.1
  • 283c8e6 Handle EPIPE better in exceptional edge cases
  • b727234 Fix obscure edge case when this.results is not set
  • 1699eb9 process: update docs on the master branch
  • ac366a0 docs: fix typo ('heirarchical' -> 'hierarchical')
  • 13073a7 docs: correct 100 PR link
  • b95ee22 v11.1.0
  • fcf70aa Add support for disabling autoend
  • 94be0a7 v11.0.1
  • 6c3f019 remove badges that are no longer accurate or in use
  • ae562a7 don't ignore coverage doc
  • 9fcfd52 Migrate docs into main repository
  • f189c50 v11.0.0
  • 5cde128 Merge branch 'v11'

See the full diff

With a Snyk patch:
Severity Issue Exploit Maturity
low severity Regular Expression Denial of Service (ReDoS)
npm:debug:20170905
No Known Exploit
low severity Regular Expression Denial of Service (DoS)
npm:hawk:20160119
No Known Exploit
medium severity Timing Attack
npm:http-signature:20150122
No Known Exploit
low severity Regular Expression Denial of Service (ReDoS)
npm:mime:20170907
No Known Exploit
high severity Regular Expression Denial of Service (DoS)
npm:minimatch:20160620
No Known Exploit
low severity Regular Expression Denial of Service (ReDoS)
npm:ms:20170412
No Known Exploit
medium severity Remote Memory Exposure
npm:request:20160119
No Known Exploit
medium severity Uninitialized Memory Exposure
npm:tunnel-agent:20170305
Proof of Concept

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:

🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

… vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- http://localhost:8000/vuln/SNYK-JS-EXPRESSFILEUPLOAD-473997
- http://localhost:8000/vuln/SNYK-JS-JQUERY-174006
- http://localhost:8000/vuln/SNYK-JS-JSYAML-173999
- http://localhost:8000/vuln/SNYK-JS-JSYAML-174129
- http://localhost:8000/vuln/SNYK-JS-MARKED-174116
- http://localhost:8000/vuln/SNYK-JS-MARKED-451540
- http://localhost:8000/vuln/SNYK-JS-MONGODB-473855
- http://localhost:8000/vuln/SNYK-JS-MONGOOSE-472486
- http://localhost:8000/vuln/SNYK-JS-MORGAN-72579
- http://localhost:8000/vuln/npm:adm-zip:20180415
- http://localhost:8000/vuln/npm:braces:20180219
- http://localhost:8000/vuln/npm:debug:20170905
- http://localhost:8000/vuln/npm:dustjs-linkedin:20160819
- http://localhost:8000/vuln/npm:ejs:20161128
- http://localhost:8000/vuln/npm:ejs:20161130
- http://localhost:8000/vuln/npm:ejs:20161130-1
- http://localhost:8000/vuln/npm:fresh:20170908
- http://localhost:8000/vuln/npm:hoek:20180212
- http://localhost:8000/vuln/npm:jquery:20150627
- http://localhost:8000/vuln/npm:marked:20150520
- http://localhost:8000/vuln/npm:marked:20170112
- http://localhost:8000/vuln/npm:marked:20170815
- http://localhost:8000/vuln/npm:marked:20170815-1
- http://localhost:8000/vuln/npm:marked:20170907
- http://localhost:8000/vuln/npm:marked:20180225
- http://localhost:8000/vuln/npm:mime:20170907
- http://localhost:8000/vuln/npm:moment:20161019
- http://localhost:8000/vuln/npm:moment:20170905
- http://localhost:8000/vuln/npm:mongoose:20160116
- http://localhost:8000/vuln/npm:ms:20151024
- http://localhost:8000/vuln/npm:ms:20170412
- http://localhost:8000/vuln/npm:negotiator:20160616
- http://localhost:8000/vuln/npm:npmconf:20180512
- http://localhost:8000/vuln/npm:qs:20170213
- http://localhost:8000/vuln/npm:semver:20150403
- http://localhost:8000/vuln/npm:st:20140206
- http://localhost:8000/vuln/npm:st:20171013
- http://localhost:8000/vuln/npm:tunnel-agent:20170305


The following vulnerabilities are fixed with a Snyk patch:
- http://localhost:8000/vuln/npm:debug:20170905
- http://localhost:8000/vuln/npm:hawk:20160119
- http://localhost:8000/vuln/npm:http-signature:20150122
- http://localhost:8000/vuln/npm:mime:20170907
- http://localhost:8000/vuln/npm:minimatch:20160620
- http://localhost:8000/vuln/npm:ms:20170412
- http://localhost:8000/vuln/npm:request:20160119
- http://localhost:8000/vuln/npm:tunnel-agent:20170305
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant