Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk-dev] Fix for 82 vulnerabilities #6048

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk-dev] Fix for 82 vulnerabilities #6048

wants to merge 1 commit into from

Conversation

lili2311
Copy link
Contributor

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • large-file/package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 Yes Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-ASYNC-2441827		 Yes Proof of Concept
critical severity 786/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 9.3		 Incomplete List of Disallowed Inputs
SNYK-JS-BABELTRAVERSE-5962462		 Yes Proof of Concept
high severity 696/1000
Why? Recently disclosed, Has a fix available, CVSS 8.2		 Asymmetric Resource Consumption (Amplification)
SNYK-JS-BODYPARSER-7926860		 No No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Uncontrolled resource consumption
SNYK-JS-BRACES-6838727		 Yes Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Improper Verification of Cryptographic Signature
SNYK-JS-BROWSERIFYSIGN-6037026		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-BROWSERSLIST-1090194		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-COLORSTRING-1082939		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-CSSWHAT-3035488		 Yes Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Denial of Service (DoS)
SNYK-JS-DECODEURICOMPONENT-3149970		 Yes Proof of Concept
medium severity 554/1000
Why? Has a fix available, CVSS 6.8		 Cryptographic Issues
SNYK-JS-ELLIPTIC-1064899		 Yes No Known Exploit
critical severity 776/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 9.1		 Improper Verification of Cryptographic Signature
SNYK-JS-ELLIPTIC-7577916		 Yes Proof of Concept
critical severity 776/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 9.1		 Improper Verification of Cryptographic Signature
SNYK-JS-ELLIPTIC-7577917		 Yes Proof of Concept
critical severity 776/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 9.1		 Improper Verification of Cryptographic Signature
SNYK-JS-ELLIPTIC-7577918		 Yes Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ES5EXT-6095076		 Yes Proof of Concept
medium severity 541/1000
Why? Recently disclosed, Has a fix available, CVSS 5.1		 Cross-site Scripting
SNYK-JS-EXPRESS-7926867		 No No Known Exploit
high severity 751/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.6		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-GETFUNCNAME-5923417		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-GLOBPARENT-1016905		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-HOSTEDGITINFO-1088355		 Yes Proof of Concept
medium severity 631/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.2		 Missing Release of Resource after Effective Lifetime
SNYK-JS-INFLIGHT-6095116		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-INI-1048974		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ISSVG-1085627		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ISSVG-1243891		 No Proof of Concept
medium severity 641/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.4		 Prototype Pollution
SNYK-JS-JSON5-3182856		 Yes Proof of Concept
high severity 644/1000
Why? Has a fix available, CVSS 8.6		 Prototype Pollution
SNYK-JS-JSONSCHEMA-1920922		 Yes No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LOADERUTILS-3042992		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-LOADERUTILS-3043105		 Yes No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LOADERUTILS-3105943		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905		 Yes Proof of Concept
high severity 681/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.2		 Code Injection
SNYK-JS-LODASH-1040724		 Yes Proof of Concept
high severity 731/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.2		 Prototype Pollution
SNYK-JS-LODASHES-2434283		 Yes Proof of Concept
high severity 681/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.2		 Code Injection
SNYK-JS-LODASHES-2434284		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASHES-2434285		 Yes Proof of Concept
medium severity 541/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 4.4		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASHES-2434286		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASHES-2434287		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASHES-2434289		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASHES-2434290		 Yes Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Inefficient Regular Expression Complexity
SNYK-JS-MICROMATCH-6838728		 No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-3050818		 Yes No Known Exploit
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Prototype Pollution
SNYK-JS-MINIMIST-2429795		 Yes Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Directory Traversal
SNYK-JS-MOMENT-2440688		 Yes No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MOMENT-2944238		 Yes Proof of Concept
medium severity 539/1000
Why? Has a fix available, CVSS 6.5		 Information Exposure
SNYK-JS-NODEFETCH-2342118		 Yes No Known Exploit
medium severity 520/1000
Why? Has a fix available, CVSS 5.9		 Denial of Service
SNYK-JS-NODEFETCH-674311		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-PATHPARSE-1077067		 Yes Proof of Concept
medium severity 738/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 6.9		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-PATHTOREGEXP-7925106		 Yes Proof of Concept
medium severity 621/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6		 Prototype Pollution
SNYK-JS-PATHVAL-596926		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-POSTCSS-1090595		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-POSTCSS-1255640		 Yes Proof of Concept
medium severity /1000
Why?		 Improper Input Validation
SNYK-JS-POSTCSS-5926692		 Yes No Known Exploit
high severity /1000
Why?		 Prototype Poisoning
SNYK-JS-QS-3153490		 Yes Proof of Concept
medium severity /1000
Why?		 Validation Bypass
SNYK-JS-SANITIZEHTML-1070780		 Yes Proof of Concept
medium severity /1000
Why?		 Access Restriction Bypass
SNYK-JS-SANITIZEHTML-1070786		 Yes No Known Exploit
medium severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-SANITIZEHTML-2957526		 Yes No Known Exploit
critical severity /1000
Why?		 Arbitrary Code Execution
SNYK-JS-SANITIZEHTML-585892		 Yes No Known Exploit
medium severity /1000
Why?		 Information Exposure
SNYK-JS-SANITIZEHTML-6256334		 Yes Proof of Concept
high severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795		 Yes Proof of Concept
low severity /1000
Why?		 Cross-site Scripting
SNYK-JS-SEND-7926862		 No No Known Exploit
low severity /1000
Why?		 Cross-site Scripting
SNYK-JS-SERVESTATIC-7926865		 No No Known Exploit
high severity /1000
Why?		 Prototype Pollution
SNYK-JS-SETVALUE-1540541		 Yes Proof of Concept
high severity /1000
Why?		 Prototype Pollution
SNYK-JS-SETVALUE-450213		 Yes Proof of Concept
high severity /1000
Why?		 Improper Privilege Management
SNYK-JS-SHELLJS-2332187		 Yes Proof of Concept
high severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-SSRI-1246392		 Yes Proof of Concept
high severity /1000
Why?		 Arbitrary File Overwrite
SNYK-JS-TAR-1536528		 Yes No Known Exploit
high severity /1000
Why?		 Arbitrary File Overwrite
SNYK-JS-TAR-1536531		 Yes No Known Exploit
low severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-TAR-1536758		 Yes No Known Exploit
high severity /1000
Why?		 Arbitrary File Write
SNYK-JS-TAR-1579147		 Yes No Known Exploit
high severity /1000
Why?		 Arbitrary File Write
SNYK-JS-TAR-1579152		 Yes No Known Exploit
high severity /1000
Why?		 Arbitrary File Write
SNYK-JS-TAR-1579155		 Yes No Known Exploit
medium severity /1000
Why?		 Uncontrolled Resource Consumption ('Resource Exhaustion')
SNYK-JS-TAR-6476909		 Yes Proof of Concept
medium severity /1000
Why?		 Prototype Pollution
SNYK-JS-TOUGHCOOKIE-5672873		 Yes Proof of Concept
high severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-UAPARSERJS-1023599		 Yes Proof of Concept
medium severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-UAPARSERJS-1072471		 Yes Proof of Concept
high severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-UAPARSERJS-610226		 Yes Proof of Concept
high severity /1000
Why?		 Prototype Pollution
SNYK-JS-UNSETVALUE-2400660		 No No Known Exploit
medium severity /1000
Why?		 Cross-site Scripting (XSS)
SNYK-JS-WEBPACK-7840298		 Yes Proof of Concept
medium severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-WS-1296835		 Yes Proof of Concept
high severity /1000
Why?		 Denial of Service (DoS)
SNYK-JS-WS-7266574		 Yes Proof of Concept
high severity /1000
Why?		 Prototype Pollution
SNYK-JS-Y18N-1021887		 Yes Proof of Concept
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:debug:20170905		 Yes Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
npm:parsejson:20170908		 Yes No Known Exploit
high severity 761/1000
Why? Mature exploit, Has a fix available, CVSS 7.5		 Denial of Service (DoS)
npm:ws:20171108		 Yes Mature

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: @cypress/browserify-preprocessor The new version differs by 59 commits.

See the full diff

Package name: add-asset-html-webpack-plugin The new version differs by 53 commits.

See the full diff

Package name: adjust-sourcemap-loader The new version differs by 27 commits.

See the full diff

Package name: anymatch The new version differs by 18 commits.

See the full diff

Package name: babel-loader The new version differs by 89 commits.

See the full diff

Package name: body-parser The new version differs by 241 commits.

See the full diff

Package name: braces The new version differs by 16 commits.

See the full diff

Package name: browserify The new version differs by 30 commits.

See the full diff

Package name: browserify-sign The new version differs by 25 commits.
  • 4af5a90 v4.2.2
  • 3aec038 [Dev Deps] update `tape`
  • 85994cd [Fix] properly check the upper bound for DSA signatures
  • 9ac5a5e [meta] fix package.json indentation
  • dcf49ce [meta] add `safe-publish-latest`
  • 4418183 [meta] add `npmignore` and `auto-changelog`
  • 8767739 [Fix] `sign`: throw on unsupported padding scheme
  • 5f6fb17 [Tests] log when openssl doesn't support cipher
  • f5f17c2 [Tests] handle openSSL not supporting a scheme
  • d845d85 [Tests] migrate from travis to github actions
  • 703c83e [Tests] skip unsupported schemes
  • 3aa43cf [Tests] node < 6 lacks array `includes`
  • 75dd8fd [Tests] add `npm run posttest`
  • 98d4e0d [Dev Deps] fix eslint range
  • 75ce1d5 [Tests] always run coverage; downgrade `nyc`

@snyk-bot
fix: large-file/package.json to reduce vulnerabilities
ec60862 
The following vulnerabilities are fixed with an upgrade:
- https://dev.snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://dev.snyk.io/vuln/SNYK-JS-ASYNC-2441827
- https://dev.snyk.io/vuln/SNYK-JS-BABELTRAVERSE-5962462
- https://dev.snyk.io/vuln/SNYK-JS-BODYPARSER-7926860
- https://dev.snyk.io/vuln/SNYK-JS-BRACES-6838727
- https://dev.snyk.io/vuln/SNYK-JS-BROWSERIFYSIGN-6037026
- https://dev.snyk.io/vuln/SNYK-JS-BROWSERSLIST-1090194
- https://dev.snyk.io/vuln/SNYK-JS-COLORSTRING-1082939
- https://dev.snyk.io/vuln/SNYK-JS-CSSWHAT-3035488
- https://dev.snyk.io/vuln/SNYK-JS-DECODEURICOMPONENT-3149970
- https://dev.snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899
- https://dev.snyk.io/vuln/SNYK-JS-ELLIPTIC-7577916
- https://dev.snyk.io/vuln/SNYK-JS-ELLIPTIC-7577917
- https://dev.snyk.io/vuln/SNYK-JS-ELLIPTIC-7577918
- https://dev.snyk.io/vuln/SNYK-JS-ES5EXT-6095076
- https://dev.snyk.io/vuln/SNYK-JS-EXPRESS-7926867
- https://dev.snyk.io/vuln/SNYK-JS-GETFUNCNAME-5923417
- https://dev.snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
- https://dev.snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355
- https://dev.snyk.io/vuln/SNYK-JS-INFLIGHT-6095116
- https://dev.snyk.io/vuln/SNYK-JS-INI-1048974
- https://dev.snyk.io/vuln/SNYK-JS-ISSVG-1085627
- https://dev.snyk.io/vuln/SNYK-JS-ISSVG-1243891
- https://dev.snyk.io/vuln/SNYK-JS-JSON5-3182856
- https://dev.snyk.io/vuln/SNYK-JS-JSONSCHEMA-1920922
- https://dev.snyk.io/vuln/SNYK-JS-LOADERUTILS-3042992
- https://dev.snyk.io/vuln/SNYK-JS-LOADERUTILS-3043105
- https://dev.snyk.io/vuln/SNYK-JS-LOADERUTILS-3105943
- https://dev.snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://dev.snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://dev.snyk.io/vuln/SNYK-JS-LODASHES-2434283
- https://dev.snyk.io/vuln/SNYK-JS-LODASHES-2434284
- https://dev.snyk.io/vuln/SNYK-JS-LODASHES-2434285
- https://dev.snyk.io/vuln/SNYK-JS-LODASHES-2434286
- https://dev.snyk.io/vuln/SNYK-JS-LODASHES-2434287
- https://dev.snyk.io/vuln/SNYK-JS-LODASHES-2434289
- https://dev.snyk.io/vuln/SNYK-JS-LODASHES-2434290
- https://dev.snyk.io/vuln/SNYK-JS-MICROMATCH-6838728
- https://dev.snyk.io/vuln/SNYK-JS-MINIMATCH-3050818
- https://dev.snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://dev.snyk.io/vuln/SNYK-JS-MOMENT-2440688
- https://dev.snyk.io/vuln/SNYK-JS-MOMENT-2944238
- https://dev.snyk.io/vuln/SNYK-JS-NODEFETCH-2342118
- https://dev.snyk.io/vuln/SNYK-JS-NODEFETCH-674311
- https://dev.snyk.io/vuln/SNYK-JS-PATHPARSE-1077067
- https://dev.snyk.io/vuln/SNYK-JS-PATHTOREGEXP-7925106
- https://dev.snyk.io/vuln/SNYK-JS-PATHVAL-596926
- https://dev.snyk.io/vuln/SNYK-JS-POSTCSS-1090595
- https://dev.snyk.io/vuln/SNYK-JS-POSTCSS-1255640
- https://dev.snyk.io/vuln/SNYK-JS-POSTCSS-5926692
- https://dev.snyk.io/vuln/SNYK-JS-QS-3153490
- https://dev.snyk.io/vuln/SNYK-JS-SANITIZEHTML-1070780
- https://dev.snyk.io/vuln/SNYK-JS-SANITIZEHTML-1070786
- https://dev.snyk.io/vuln/SNYK-JS-SANITIZEHTML-2957526
- https://dev.snyk.io/vuln/SNYK-JS-SANITIZEHTML-585892
- https://dev.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334
- https://dev.snyk.io/vuln/SNYK-JS-SEMVER-3247795
- https://dev.snyk.io/vuln/SNYK-JS-SEND-7926862
- https://dev.snyk.io/vuln/SNYK-JS-SERVESTATIC-7926865
- https://dev.snyk.io/vuln/SNYK-JS-SETVALUE-1540541
- https://dev.snyk.io/vuln/SNYK-JS-SETVALUE-450213
- https://dev.snyk.io/vuln/SNYK-JS-SHELLJS-2332187
- https://dev.snyk.io/vuln/SNYK-JS-SSRI-1246392
- https://dev.snyk.io/vuln/SNYK-JS-TAR-1536528
- https://dev.snyk.io/vuln/SNYK-JS-TAR-1536531
- https://dev.snyk.io/vuln/SNYK-JS-TAR-1536758
- https://dev.snyk.io/vuln/SNYK-JS-TAR-1579147
- https://dev.snyk.io/vuln/SNYK-JS-TAR-1579152
- https://dev.snyk.io/vuln/SNYK-JS-TAR-1579155
- https://dev.snyk.io/vuln/SNYK-JS-TAR-6476909
- https://dev.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873
- https://dev.snyk.io/vuln/SNYK-JS-UAPARSERJS-1023599
- https://dev.snyk.io/vuln/SNYK-JS-UAPARSERJS-1072471
- https://dev.snyk.io/vuln/SNYK-JS-UAPARSERJS-610226
- https://dev.snyk.io/vuln/SNYK-JS-UNSETVALUE-2400660
- https://dev.snyk.io/vuln/SNYK-JS-WEBPACK-7840298
- https://dev.snyk.io/vuln/SNYK-JS-WS-1296835
- https://dev.snyk.io/vuln/SNYK-JS-WS-7266574
- https://dev.snyk.io/vuln/SNYK-JS-Y18N-1021887
- https://dev.snyk.io/vuln/npm:debug:20170905
- https://dev.snyk.io/vuln/npm:parsejson:20170908
- https://dev.snyk.io/vuln/npm:ws:20171108
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@lili2311 @snyk-bot