New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deps): update dependency mongoose to v5.13.20 [security] #114

Open

renovate wants to merge 1 commit into master from renovate/npm-mongoose-vulnerability

Contributor

renovate bot commented Mar 17, 2023 •

edited

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
mongoose (source)	`5.12.9` -> `5.13.20`

GitHub Vulnerability Alerts

CVE-2022-2564

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path() function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack.

CVE-2023-3696

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.3, 6.11.3, and 5.13.20.

CVE-2022-24304

Description

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path() function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack.

Proof of Concept

// poc.js
const mongoose = require('mongoose');
const schema = new mongoose.Schema();

malicious_payload = '__proto__.toString'

schema.path(malicious_payload, [String])

x = {}
console.log(x.toString()) // crashed (Denial of service (DoS) attack)

Impact

This vulnerability can be manipulated to exploit other types of attacks, such as Denial of service (DoS), Remote Code Execution, or Property Injection.

Release Notes

Automattic/mongoose (mongoose)

`v5.13.20`

`v5.13.19`

`v5.13.18`

`v5.13.17`

====================

fix: backport fix for array filters handling $or and $and #13195 #13192 #10696 raj-goguardian
fix: update the isIndexEqual function to take into account non-text indexes when checking compound indexes that include both text and non-text indexes #13138 #13136 rdeavila94

`v5.13.16`

====================

fix: make access to process.versions lazy #12584 maciasello
fix(types): add missing type definitions for bulkSave() #12019
docs: backport documentation URL updates #12692 hasezoey

`v5.13.15`

====================

fix: backport fix for CVE-2022-2564 #12281 shubanker
docs: fix broken link from findandmodify method deprecation #11366 laissonsilveira

`v5.13.14`

====================

fix(timestamps): avoid setting createdAt on documents that already exist but dont have createdAt #11024
docs(models): fix up nModified example for 5.x #11055

`v5.13.13`

====================

fix: upgrade to mongodb@3.7.3 #10909 gaurav-sharma-gs
fix: correctly emit end event in before close #10916 iovanom
fix(index.d.ts): improve ts types for query set #10942 jneal-afs

`v5.13.12`

====================

fix(cursor): use stream destroy method on close to prevent emitting duplicate 'close' #10897 iovanom
fix(index.d.ts): backport streamlining of FilterQuery and DocumentDefinition to avoid "excessively deep and possibly infinite" TS errors #10617

`v5.13.11`

====================

fix: upgrade mongodb -> 3.7.2 #10871 winstonralph
fix(connection): call setMaxListeners(0) on MongoClient to avoid event emitter memory leak warnings with useDb() #10732

`v5.13.10`

====================

fix(index.d.ts): allow using type: SchemaDefinitionProperty in schema definitions #10674
fix(index.d.ts): allow AnyObject as param to findOneAndReplace() #10714

`v5.13.9`

===================

fix(populate): avoid setting empty array on lean document when populate result is undefined #10599
fix(document): make depopulate() handle populated paths underneath document arrays #10592
fix: peg @types/bson version to 1.x || 4.0.x to avoid stubbed 4.2.x release #10678
fix(index.d.ts): simplify UpdateQuery to avoid "excessively deep and possibly infinite" errors with extends Document and any #10647
fix(index.d.ts): allow specifying weights as an IndexOption #10586
fix: upgrade to mpath v0.8.4 re: security issue #10683

`v5.13.8`

===================

fix(populate): handle populating subdoc array virtual with sort #10552
fix(model): check for code instead of codeName when checking for existing collections for backwards compat with MongoDB 3.2 #10420
fix(index.d.ts): correct value of this for custom query helper methods #10545
fix(index.d.ts): allow strings for ObjectIds in nested properties #10573
fix(index.d.ts): add match to VirtualTypeOptions.options #8749
fix(index.d.ts): allow QueryOptions populate parameter type PopulateOptions #10587 osmanakol
docs(api): add Document#$where to API docs #10583

`v5.13.7`

===================

perf(index.d.ts): loosen up restrictions on ModelType generic for Schema for a ~50% perf improvement when compiling TypeScript and using intellisense #10536 #10515 #10349
fix(index.d.ts): fix broken Schema#index() types #10562 JaredReisinger
fix(index.d.ts): allow using SchemaTypeOptions with array of raw document interfaces #10537
fix(index.d.ts): define IndexOptions in terms of mongodb.IndexOptions #10563 JaredReisinger
fix(index.d.ts): improve intellisense for DocumentArray push() #10546
fix(index.d.ts): correct type for expires #10529
fix(index.d.ts): add Query#model property to ts bindings #10531
refactor(index.d.ts): make callbacks use the new Callback and CallbackWithoutResult types #10550 thiagokisaki

`v5.13.6`

===================

fix: upgrade mongodb driver -> 3.6.11 #10543 maon-fp
fix(schema): throw more helpful error when defining a document array using a schema from a different copy of the Mongoose module #10453
fix: add explicit check on constructor property to avoid throwing an error when checking objects with null prototypes #10512
fix(cursor): make sure to clear stack every 1000 docs when calling next() to avoid stack overflow with large batch size #10449
fix(index.d.ts): allow calling new Model(...) with generic Model param #10526
fix(index.d.ts): update type declarations of Schema.index method #10538 #10530 Raader
fix(index.d.ts): add useNewUrlParser and useUnifiedTopology to ConnectOptions #10500
fix(index.d.ts): add missing type for diffIndexes #10547 bvgusak
fix(index.d.ts): fixed incorrect type definition for Query's .map function #10544 GCastilho
docs(schema): add more info and examples to Schema#indexes() docs #10446
chore: add types property to package.json #10557 thiagokisaki

`v5.13.5`

===================

perf(index.d.ts): improve typescript type checking performance #10515 andreialecu
fix(index.d.ts): fix debug type in MongooseOptions #10510 thiagokisaki
docs(api): clarify that depopulate() with no args depopulates all #10501 gfrancz

`v5.13.4`

===================

fix: avoid pulling non-schema paths from documents into nested paths #10449
fix(update): support overwriting nested map paths #10485
fix(update): apply timestamps to subdocs that would be newly created by $setOnInsert #10460
fix(map): correctly clone subdocs when calling toObject() on a map #10486
fix(cursor): cap parallel batchSize for populate at 5000 #10449
fix(index.d.ts): improve autocomplete for new Model() by making doc an object with correct keys #10475
fix(index.d.ts): add MongooseOptions interface #10471 thiagokisaki
fix(index.d.ts): make LeanDocument work with PopulatedDoc #10494
docs(mongoose+connection): correct default value for bufferTimeoutMS #10476
chore: remove unnecessary 'eslint-disable' comments #10466 thiagokisaki

`v5.13.3`

===================

fix(model): avoid throwing error when bulkSave() called on a document with no changes #10437
fix(timestamps): apply timestamps when creating new subdocs with $addToSet and with positional operator #10447
fix(schema): allow calling Schema#loadClass() with class that has a static getter with no setter #10436
fix(model): handle re-applying object defaults after explicitly unsetting #10442 semirturgay
fix: bump mongodb driver -> 3.6.10 #10440 AbdelrahmanHafez
fix(index.d.ts): consistently use NativeDate instead of Date for Date validators and timestamps functions #10426
fix(index.d.ts): allow calling discriminator() with non-document #10452 #10421 DouglasGabr
fix(index.d.ts): allow passing ResultType generic to Schema#path() #10435

`v5.13.2`

===================

fix: hardcode @types/node version for now to avoid breaking changes from DefinitelyTyped/DefinitelyTyped#53669 #10415
fix(index.d.ts): allow using type: Date with Date paths in SchemaDefinitionType #10409
fix(index.d.ts): allow extra VirtualTypeOptions for better plugin support #10412
docs(api): add SchemaArray to docs #10397
docs(schema+validation): fix broken links #10396
docs(transactions): add note about creating a connection to transactions docs #10406

`v5.13.1`

====================

fix: backport fix for array filters handling $or and $and #13195 #13192 #10696 raj-goguardian
fix: update the isIndexEqual function to take into account non-text indexes when checking compound indexes that include both text and non-text indexes #13138 #13136 rdeavila94

`v5.13.0`

===================

feat(query): add sanitizeProjection option to opt in to automatically sanitizing untrusted query projections #10243
feat(model): add bulkSave() function that saves multiple docs in 1 bulkWrite() #9727 #9673 AbdelrahmanHafez
feat(document): allow passing a list of virtuals or pathsToSkip to apply in toObject() and toJSON() #10120
fix(model): make Model.validate use object under validation as context by default #10360 AbdelrahmanHafez
feat(document): add support for pathsToSkip in validate and validateSync #10375 AbdelrahmanHafez
feat(model): add diffIndexes() function that calculates what indexes syncIndexes() will create/drop without actually executing any changes #10362 IslandRhythms
feat(document): avoid using sessions that have ended, so you can use documents that were loaded in the session after calling endSession() #10306

`v5.12.15`

====================

fix(index.d.ts): add extra TInstanceMethods generic param to Schema for cases when we can't infer from Model #10358
fix(index.d.ts): added typings for near() in model aggregation #10373 tbhaxor
fix(index.d.ts): correct function signature for Query#cast() #10388 lkho
docs(transactions): add import statement #10365 JimLynchCodes
docs(schema): add missing discriminatorKey schema option #10386 #10376 IslandRhythms
docs(index.d.ts): fix typo #10363 houssemchebeb

`v5.12.14`

====================

fix(schema): check that schema type is an object when setting isUnderneathDocArray #10361 vmo-khanus
fix(document): avoid infinite recursion when setting single nested subdoc to array #10351
fix(populate): allow populating nested path in schema using Model.populate() #10335
fix(drivers): emit operation-start/operation-end events to allow inspecting when operations start and end
fix(index.d.ts): improve typings for virtuals #10350 thiagokisaki
fix(index.d.ts): correct constructor type for Document #10328
fix(index.d.ts): add ValidationError as a possible type for ValidationError#errors #10320 IslandRhythms
fix: remove unnecessary async devDependency that's causing npm audit warnings #10281
docs(typescript): add schemas guide #10308
docs(model): add options parameter description to Model.exists() #10336 Aminoiz

`v5.12.13`

====================

perf(document): avoid creating nested paths when running $getAllSubdocs() #10275
fix: make returnDocument option work with findOneAndUpdate() #10232 #10231 cnwangjie
fix(document): correctly reset subdocument when resetting a map subdocument underneath a single nested subdoc after save #10295
perf(query): avoid setting non-null sessions to avoid overhead from $getAllSubdocs() #10275
perf(document): pre split schematype paths when compiling schema to avoid extra overhead of splitting when hydrating documents #10275
perf(schema): pre-calculate mapPaths to avoid looping over every path for each path when initing doc #10275
fix(index.d.ts): drill down into nested arrays when creating LeanDocument type #10293

`v5.12.12`

====================

fix(documentarray): retain atomics when setting to a new array #10272
fix(query+model): fix deprecation warning for returnOriginal with findOneAndUpdate() #10298 #10297 #10292 #10285 IslandRhythms
fix(index.d.ts): make map() result an array if used over an array #10288 quantumsheep

`v5.12.11`

====================

fix(populate): skip applying setters when casting arrays for populate() to avoid issues with arrays of immutable elements #10264
perf(schematype): avoid cloning setters every time we run setters #9588
perf(get): add benchmarks and extra cases to speed up get() #9588
perf(array): improve array constructor performance on small arrays to improve nested array perf #9588
fix(index.d.ts): allow using type: [String] with string[] when using SchemaDefinition with generic #10261
fix(index.d.ts): support ReadonlyArray as well as regular array where possible in schema definitions #10260
docs(connection): document noListener option to useDb #10278 stuartpb
docs: migrate raw tutorial content from pug / JS to markdown #10271
docs: fix typo #10269 sanjib

`v5.12.10`

====================

fix(query): allow setting defaults option on result documents from query options #7287 IslandRhythms
fix(populate): handle populating embedded discriminator with custom tiedValue #10231
fix(document): allow passing space-delimited string of pathsToValidate to validate() and validateSync() #10258
fix(model+schema): support loadClass() on classes that have collection as a static property #10257 #10254 IslandRhythms
fix(SchemaArrayOptions): correct property name #10236
fix(index.d.ts): add any to all query operators to minimize likelihood of "type instantiation is excessively deep" when querying docs with 4-level deep subdocs #10189
fix(index.d.ts): add $parent() in addition to parent() in TS definitions
fix(index.d.ts): correct async iterator return type for QueryCursor #10253 #10252 #10251 borfig
fix(index.d.ts): add virtualsOnly parameter to loadClass() function signature IslandRhythms
docs(typescript): add typescript populate docs #10212
docs: switch from AWS to Azure Functions for search #10244

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.


          fix(deps): update dependency mongoose to v5.13.20 [security]

202cf08

renovate bot changed the title ~~fix(deps): update dependency mongoose to v5.13.15 [security]~~ fix(deps): update dependency mongoose to v5.13.20 [security]

renovate bot force-pushed the renovate/npm-mongoose-vulnerability branch from 6ea49a4 to 202cf08 Compare

July 18, 2023 22:31

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment