Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

jest-cli-24.9.0.tgz: 1 vulnerabilities (highest severity is: 6.1) #630

Open
mend-for-github-com bot opened this issue Mar 23, 2023 · 2 comments · May be fixed by #1102 or #1094
Open

jest-cli-24.9.0.tgz: 1 vulnerabilities (highest severity is: 6.1) #630

mend-for-github-com bot opened this issue Mar 23, 2023 · 2 comments · May be fixed by #1102 or #1094
Assignees
@joshuarrrr
Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend

Comments

@mend-for-github-com
Copy link
Contributor

mend-for-github-com bot commented Mar 23, 2023 •
edited

Vulnerable Library - jest-cli-24.9.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Found in HEAD commit: da8987297d043a87176cf037aa9b64d781bc29c5

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (jest-cli version) Remediation Possible**
CVE-2023-28155 Medium 6.1 request-2.88.0.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-28155

Vulnerable Library - request-2.88.0.tgz

Simplified HTTP request client.

Library home page: https://registry.npmjs.org/request/-/request-2.88.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

  • jest-cli-24.9.0.tgz (Root Library)
    • jest-config-24.9.0.tgz
      • jest-environment-jsdom-24.9.0.tgz
        • jsdom-11.12.0.tgz
          • ❌ request-2.88.0.tgz (Vulnerable Library)

Found in HEAD commit: da8987297d043a87176cf037aa9b64d781bc29c5

Found in base branch: main

Vulnerability Details

The request package through 2.88.2 for Node.js and the @cypress/request package prior to 3.0.0 allow a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP).NOTE: The request package is no longer supported by the maintainer.

Publish Date: 2023-03-16

URL: CVE-2023-28155

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-p8p7-x288-28g6

Release Date: 2023-03-16

Fix Resolution: @cypress/request - 3.0.0
@mend-for-github-com mend-for-github-com bot added the Mend: dependency security vulnerability Security vulnerability detected by Mend label Mar 23, 2023
@mend-for-github-com mend-for-github-com bot mentioned this issue Mar 23, 2023
Closed
@abbyhu2000
Copy link
Member

abbyhu2000 commented Mar 23, 2023 •
edited

The Request package (https://github.com/request/request) is deprecated, and there is a fix PR to this issue but it has not been merged: request/request#3444.

However, i think we can request an exemption for this OUI CVE since the affected package that depends on request are all dev dependencies (jest-cli--testing, nodegit--asynchronous native bindings, yo--CLI tool for running Yeoman generators and node-sass), so i do not think it can be exposed by the SSRF vulnerability. @ananzh @joshuarrrr

yarn why request
yarn why v1.22.19
[1/4] Why do we have the module "request"...?
[2/4] Initialising dependency graph...
warning Resolution field "trim@0.0.3" is incompatible with requested version "trim@0.0.1"
[3/4] Finding dependency...
[4/4] Calculating file sizes...
=> Found "request@2.88.0"
info Reasons this module exists
   - "node-sass" depends on it
   - Hoisted from "node-sass#request"
   - Hoisted from "nodegit#node-gyp#request"
   - Hoisted from "yo#insight#request"
   - Hoisted from "jest-cli#jest-config#jest-environment-jsdom#jsdom#request"
info Disk size without dependencies: "496KB"
info Disk size with unique dependencies: "2.3MB"
info Disk size with transitive dependencies: "10.57MB"
info Number of shared dependencies: 43
Done in 0.86s.

@ananzh
Copy link
Member

ananzh commented Mar 23, 2023

agree. we could keep the issue open and wait for the fix to merge. we could pass to next on-call and keep monitor it until there is a new release.

This was referenced Mar 24, 2023
Open
Closed
Open
Open
@mend-for-github-com mend-for-github-com bot changed the title jest-cli-24.9.0.tgz: 1 vulnerabilities (highest severity is: 6.1) jest-cli-24.9.0.tgz: 2 vulnerabilities (highest severity is: 6.1) Jun 28, 2023
@mend-for-github-com mend-for-github-com bot changed the title jest-cli-24.9.0.tgz: 2 vulnerabilities (highest severity is: 6.1) jest-cli-24.9.0.tgz: 1 vulnerabilities (highest severity is: 6.1) Jul 20, 2023
@joshuarrrr joshuarrrr self-assigned this Oct 10, 2023
@mend-for-github-com mend-for-github-com bot changed the title jest-cli-24.9.0.tgz: 1 vulnerabilities (highest severity is: 6.1) jest-cli-24.9.0.tgz: 2 vulnerabilities (highest severity is: 9.3) Oct 14, 2023
@mend-for-github-com mend-for-github-com bot mentioned this issue Oct 14, 2023
Closed
1 task
This was referenced Oct 16, 2023
Draft
Open
@mend-for-github-com mend-for-github-com bot changed the title jest-cli-24.9.0.tgz: 2 vulnerabilities (highest severity is: 9.3) jest-cli-24.9.0.tgz: 2 vulnerabilities (highest severity is: 8.8) Oct 27, 2023
@mend-for-github-com mend-for-github-com bot changed the title jest-cli-24.9.0.tgz: 2 vulnerabilities (highest severity is: 8.8) jest-cli-24.9.0.tgz: 1 vulnerabilities (highest severity is: 6.1) Dec 12, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@joshuarrrr joshuarrrr

Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Bump jest to v26 and update focus tests joshuarrrr/oui
Update jest-cli to 29.7.0 joshuarrrr/oui
3 participants
@joshuarrrr @abbyhu2000 @ananzh