react-markdown-heading
react-markdown-heading copied to clipboard
webpack-dev-server-4.7.3.tgz: 11 vulnerabilities (highest severity is: 9.8)
Vulnerable Library - webpack-dev-server-4.7.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/async/package.json
Found in HEAD commit: e103b6386c0031666a1203e2e1dc93586e0cd828
Vulnerabilities
CVE | Severity | CVSS | Dependency | Type | Fixed in (webpack-dev-server version) | Remediation Possible** |
---|---|---|---|---|---|---|
CVE-2023-42282 | Critical | 9.8 | ip-1.1.5.tgz | Transitive | 4.7.4 | ❌ |
CVE-2021-43138 | High | 7.8 | async-2.6.3.tgz | Transitive | 4.7.4 | ❌ |
CVE-2022-24999 | High | 7.5 | qs-6.7.0.tgz | Transitive | 4.7.4 | ❌ |
CVE-2022-24772 | High | 7.5 | node-forge-1.2.1.tgz | Transitive | 4.7.4 | ❌ |
CVE-2022-24771 | High | 7.5 | node-forge-1.2.1.tgz | Transitive | 4.7.4 | ❌ |
CVE-2024-29180 | High | 7.4 | webpack-dev-middleware-5.3.0.tgz | Transitive | 4.7.4 | ❌ |
CVE-2024-28849 | Medium | 6.5 | follow-redirects-1.14.7.tgz | Transitive | N/A* | ❌ |
CVE-2024-29041 | Medium | 6.1 | express-4.17.1.tgz | Transitive | N/A* | ❌ |
CVE-2023-26159 | Medium | 6.1 | follow-redirects-1.14.7.tgz | Transitive | 4.7.4 | ❌ |
CVE-2022-0536 | Medium | 5.9 | follow-redirects-1.14.7.tgz | Transitive | 4.7.4 | ❌ |
CVE-2022-24773 | Medium | 5.3 | node-forge-1.2.1.tgz | Transitive | 4.7.4 | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2023-42282
Vulnerable Library - ip-1.1.5.tgz
[![](https://badge.fury.io/js/ip.svg)](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-1.1.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/ip/package.json
Dependency Hierarchy:
- webpack-dev-server-4.7.3.tgz (Root Library)
- bonjour-3.5.0.tgz
- multicast-dns-6.2.3.tgz
- dns-packet-1.3.4.tgz
- :x: ip-1.1.5.tgz (Vulnerable Library)
- dns-packet-1.3.4.tgz
- multicast-dns-6.2.3.tgz
- bonjour-3.5.0.tgz
Found in HEAD commit: e103b6386c0031666a1203e2e1dc93586e0cd828
Found in base branch: main
Vulnerability Details
The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.
Publish Date: 2024-02-08
URL: CVE-2023-42282
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://github.com/advisories/GHSA-78xj-cgh5-2h22
Release Date: 2024-02-08
Fix Resolution (ip): 1.1.9
Direct dependency fix Resolution (webpack-dev-server): 4.7.4
Step up your Open Source Security Game with Mend here
CVE-2021-43138
Vulnerable Library - async-2.6.3.tgz
Higher-order functions and common patterns for asynchronous code
Library home page: https://registry.npmjs.org/async/-/async-2.6.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/async/package.json
Dependency Hierarchy:
- webpack-dev-server-4.7.3.tgz (Root Library)
- portfinder-1.0.28.tgz
- :x: async-2.6.3.tgz (Vulnerable Library)
- portfinder-1.0.28.tgz
Found in HEAD commit: e103b6386c0031666a1203e2e1dc93586e0cd828
Found in base branch: main
Vulnerability Details
In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.
Publish Date: 2022-04-06
URL: CVE-2021-43138
CVSS 3 Score Details (7.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138
Release Date: 2022-04-06
Fix Resolution (async): 2.6.4
Direct dependency fix Resolution (webpack-dev-server): 4.7.4
Step up your Open Source Security Game with Mend here
CVE-2022-24999
Vulnerable Library - qs-6.7.0.tgz
A querystring parser that supports nesting and arrays, with a depth limit
Library home page: https://registry.npmjs.org/qs/-/qs-6.7.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/qs/package.json
Dependency Hierarchy:
- webpack-dev-server-4.7.3.tgz (Root Library)
- express-4.17.1.tgz
- :x: qs-6.7.0.tgz (Vulnerable Library)
- express-4.17.1.tgz
Found in HEAD commit: e103b6386c0031666a1203e2e1dc93586e0cd828
Found in base branch: main
Vulnerability Details
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).
Publish Date: 2022-11-26
URL: CVE-2022-24999
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999
Release Date: 2022-11-26
Fix Resolution (qs): 6.7.3
Direct dependency fix Resolution (webpack-dev-server): 4.7.4
Step up your Open Source Security Game with Mend here
CVE-2022-24772
Vulnerable Library - node-forge-1.2.1.tgz
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-1.2.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/node-forge/package.json
Dependency Hierarchy:
- webpack-dev-server-4.7.3.tgz (Root Library)
- selfsigned-2.0.0.tgz
- :x: node-forge-1.2.1.tgz (Vulnerable Library)
- selfsigned-2.0.0.tgz
Found in HEAD commit: e103b6386c0031666a1203e2e1dc93586e0cd828
Found in base branch: main
Vulnerability Details
Forge (also called node-forge
) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo
ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge
version 1.3.0. There are currently no known workarounds.
Publish Date: 2022-03-18
URL: CVE-2022-24772
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24772
Release Date: 2022-03-18
Fix Resolution (node-forge): 1.3.0
Direct dependency fix Resolution (webpack-dev-server): 4.7.4
Step up your Open Source Security Game with Mend here
CVE-2022-24771
Vulnerable Library - node-forge-1.2.1.tgz
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-1.2.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/node-forge/package.json
Dependency Hierarchy:
- webpack-dev-server-4.7.3.tgz (Root Library)
- selfsigned-2.0.0.tgz
- :x: node-forge-1.2.1.tgz (Vulnerable Library)
- selfsigned-2.0.0.tgz
Found in HEAD commit: e103b6386c0031666a1203e2e1dc93586e0cd828
Found in base branch: main
Vulnerability Details
Forge (also called node-forge
) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge
version 1.3.0. There are currently no known workarounds.
Publish Date: 2022-03-18
URL: CVE-2022-24771
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24771
Release Date: 2022-03-18
Fix Resolution (node-forge): 1.3.0
Direct dependency fix Resolution (webpack-dev-server): 4.7.4
Step up your Open Source Security Game with Mend here
CVE-2024-29180
Vulnerable Library - webpack-dev-middleware-5.3.0.tgz
A development middleware for webpack
Library home page: https://registry.npmjs.org/webpack-dev-middleware/-/webpack-dev-middleware-5.3.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/webpack-dev-middleware/package.json
Dependency Hierarchy:
- webpack-dev-server-4.7.3.tgz (Root Library)
- :x: webpack-dev-middleware-5.3.0.tgz (Vulnerable Library)
Found in HEAD commit: e103b6386c0031666a1203e2e1dc93586e0cd828
Found in base branch: main
Vulnerability Details
Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. The middleware can either work with the physical filesystem when reading the files or it can use a virtualized in-memory memfs
filesystem. If writeToDisk
configuration option is set to true
, the physical filesystem is used. The getFilenameFromUrl
method is used to parse URL and build the local file path. The public path prefix is stripped from the URL, and the unsecaped
path suffix is appended to the outputPath
. As the URL is not unescaped and normalized automatically before calling the midlleware, it is possible to use %2e
and %2f
sequences to perform path traversal attack.
Developers using webpack-dev-server
or webpack-dev-middleware
are affected by the issue. When the project is started, an attacker might access any file on the developer's machine and exfiltrate the content. If the development server is listening on a public IP address (or 0.0.0.0
), an attacker on the local network can access the local files without any interaction from the victim (direct connection to the port). If the server allows access from third-party domains, an attacker can send a malicious link to the victim. When visited, the client side script can connect to the local server and exfiltrate the local files. Starting with fixed versions 7.1.0, 6.1.2, and 5.3.4, the URL is unescaped and normalized before any further processing.
Publish Date: 2024-03-21
URL: CVE-2024-29180
CVSS 3 Score Details (7.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-wr3j-pwj9-hqq6
Release Date: 2024-03-21
Fix Resolution (webpack-dev-middleware): 5.3.4
Direct dependency fix Resolution (webpack-dev-server): 4.7.4
Step up your Open Source Security Game with Mend here
CVE-2024-28849
Vulnerable Library - follow-redirects-1.14.7.tgz
HTTP and HTTPS modules that follow redirects.
Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.14.7.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/follow-redirects/package.json
Dependency Hierarchy:
- webpack-dev-server-4.7.3.tgz (Root Library)
- http-proxy-middleware-2.0.1.tgz
- http-proxy-1.18.1.tgz
- :x: follow-redirects-1.14.7.tgz (Vulnerable Library)
- http-proxy-1.18.1.tgz
- http-proxy-middleware-2.0.1.tgz
Found in HEAD commit: e103b6386c0031666a1203e2e1dc93586e0cd828
Found in base branch: main
Vulnerability Details
follow-redirects is an open source, drop-in replacement for Node's http
and https
modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Publish Date: 2024-03-14
URL: CVE-2024-28849
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-cxjh-pqwp-8mfp
Release Date: 2024-03-14
Fix Resolution: follow-redirects - 1.15.6
Step up your Open Source Security Game with Mend here
CVE-2024-29041
Vulnerable Library - express-4.17.1.tgz
Fast, unopinionated, minimalist web framework
Library home page: https://registry.npmjs.org/express/-/express-4.17.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/express/package.json
Dependency Hierarchy:
- webpack-dev-server-4.7.3.tgz (Root Library)
- :x: express-4.17.1.tgz (Vulnerable Library)
Found in HEAD commit: e103b6386c0031666a1203e2e1dc93586e0cd828
Found in base branch: main
Vulnerability Details
Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode using encodeurl
on the contents before passing it to the location
header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is res.location()
but this is also called from within res.redirect()
. The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.
Publish Date: 2024-03-25
URL: CVE-2024-29041
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://github.com/expressjs/express/security/advisories/GHSA-rv95-896h-c2vc
Release Date: 2024-03-25
Fix Resolution: express - 4.19.0
Step up your Open Source Security Game with Mend here
CVE-2023-26159
Vulnerable Library - follow-redirects-1.14.7.tgz
HTTP and HTTPS modules that follow redirects.
Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.14.7.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/follow-redirects/package.json
Dependency Hierarchy:
- webpack-dev-server-4.7.3.tgz (Root Library)
- http-proxy-middleware-2.0.1.tgz
- http-proxy-1.18.1.tgz
- :x: follow-redirects-1.14.7.tgz (Vulnerable Library)
- http-proxy-1.18.1.tgz
- http-proxy-middleware-2.0.1.tgz
Found in HEAD commit: e103b6386c0031666a1203e2e1dc93586e0cd828
Found in base branch: main
Vulnerability Details
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.
Publish Date: 2024-01-02
URL: CVE-2023-26159
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-26159
Release Date: 2024-01-02
Fix Resolution (follow-redirects): 1.15.4
Direct dependency fix Resolution (webpack-dev-server): 4.7.4
Step up your Open Source Security Game with Mend here
CVE-2022-0536
Vulnerable Library - follow-redirects-1.14.7.tgz
HTTP and HTTPS modules that follow redirects.
Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.14.7.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/follow-redirects/package.json
Dependency Hierarchy:
- webpack-dev-server-4.7.3.tgz (Root Library)
- http-proxy-middleware-2.0.1.tgz
- http-proxy-1.18.1.tgz
- :x: follow-redirects-1.14.7.tgz (Vulnerable Library)
- http-proxy-1.18.1.tgz
- http-proxy-middleware-2.0.1.tgz
Found in HEAD commit: e103b6386c0031666a1203e2e1dc93586e0cd828
Found in base branch: main
Vulnerability Details
Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.
Publish Date: 2022-02-09
URL: CVE-2022-0536
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0536
Release Date: 2022-02-09
Fix Resolution (follow-redirects): 1.14.8
Direct dependency fix Resolution (webpack-dev-server): 4.7.4
Step up your Open Source Security Game with Mend here
CVE-2022-24773
Vulnerable Library - node-forge-1.2.1.tgz
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-1.2.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/node-forge/package.json
Dependency Hierarchy:
- webpack-dev-server-4.7.3.tgz (Root Library)
- selfsigned-2.0.0.tgz
- :x: node-forge-1.2.1.tgz (Vulnerable Library)
- selfsigned-2.0.0.tgz
Found in HEAD commit: e103b6386c0031666a1203e2e1dc93586e0cd828
Found in base branch: main
Vulnerability Details
Forge (also called node-forge
) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check DigestInfo
for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in node-forge
version 1.3.0. There are currently no known workarounds.
Publish Date: 2022-03-18
URL: CVE-2022-24773
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24773
Release Date: 2022-03-18
Fix Resolution (node-forge): 1.3.0
Direct dependency fix Resolution (webpack-dev-server): 4.7.4
Step up your Open Source Security Game with Mend here