keystone-classic
keystone-classic copied to clipboard
keystonejs
Security Issues
https://snyk.io/test/github/keystonejs/keystone
High severity (1) Medium severity (5) Low severity (5)
One can't directly link to test results with snyk apparently.
Go to https://snyk.io, click "Test" at the top and enter "keystonejs/keystone" to see the results! Here's the high and medium severity stuff copy & pasted:
Content & Code Injection (XSS)
High severity
Vulnerable module: marked
Introduced through: [email protected]
Detailed paths and remediation
Introduced through: keystone@keystonejs/keystone › [email protected]
Remediation: No remediation path available.
marked is a markdown parser and compiler used for rendering markdown content to html. It is vulnerable to content injection attack allowing the attacker to bypass its output sanitization (sanitize: true) protection. Using the HTML Coded Character Set, attackers can inject javascript: code snippets into the output. For example, the following input javascript֍ocument;alert(1) will result in alert(1) being executed when the user clicks on the link.
Denial of Service (Event Loop Blocking)
Medium severity
Vulnerable module: qs
Introduced through: [email protected]
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
When parsing a string representing a deeply nested object, qs will block the event loop for long periods of time. Such a delay may hold up the server's resources, keeping it from processing other requests in the meantime, thus enabling a Denial-of-Service attack.
Denial of Service (Memory Exhaustion)
Medium severity
Vulnerable module: qs
Introduced through: [email protected]
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
During parsing, the qs module may create a sparse area (an array where not elements are filled), and grow that array to the necessary size based on the indices used on it. An attacker can specify a high index value in a query string, thus making the server allocate a respectively big array. Truly large values can cause the server to run out of memory and cause it to crash - thus enabling a Denial-of-Service attack.
Improper minification of non-boolean comparisons
Medium severity
Vulnerable module: uglify-js
Introduced through: [email protected]
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Tom MacWright discovered that UglifyJS versions 2.4.23 and earlier are affected by a vulnerability which allows a specially crafted Javascript file to have altered functionality after minification. This bug was demonstrated by Yan to allow potentially malicious code to be hidden within secure code, activated by minification.
Source: Node Security Project
Regular Expression Denial of Service
Medium severity
Vulnerable module: validator
Introduced through: [email protected]
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected]
Remediation: No direct dependency upgrade can address this issue. If possible, manually upgrade to [email protected], or run snyk monitor to get notified when an easier upgrade or a patch becomes available.
The validator module, versions < 3.22.1 are vulnerable to Regular Expression Denial of Service (ReDoS).
Source: Node Security Project
Remote Memory Exposure
Medium severity
Vulnerable module: request
Introduced through: [email protected]
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
Introduced through: keystone@keystonejs/keystone › [email protected] › [email protected] › [email protected] › [email protected]
Remediation: Run snyk wizard to patch @.
A potential remote memory exposure vulnerability exists in request. If a request uses a multipart attachment and the body type option is number with value X, then X bytes of uninitialized memory will be sent in the body of the request.
Note that while the impact of this vulnerability is high (memory exposure), exploiting it is likely difficult, as the attacker needs to somehow control the body type of the request. One potential exploit scenario is when a request is composed based on JSON input, including the body type, allowing a malicious JSON to trigger the memory leak.
Almost all of these are in @Azure, which keystone has at latest. It would make sense to raise those upstream.
So installations that are not using Azure Services would not be impacted. Is there a way to not use/turn off Azure
@VinayaSathyanarayana we're working to separate the file field dependencies out of Keystone itself into optional external packages - this should be done by the time 0.4 is launched properly
I suppose, all the issues was fixed.
On Wed 25 Jul, 2018, 3:54 PM vonEdfa, [email protected] wrote:
Is this still present?
— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/keystonejs/keystone/issues/2936#issuecomment-407708385, or mute the thread https://github.com/notifications/unsubscribe-auth/ABQA_uKagSfx7jtUuAQh_1BRG7AcKG0Dks5uKEdRgaJpZM4Ilsti .
I believe the list has changed, but there are still 1 high and 4 medium severity issues found by snyk. Posting this for visibility.
