body-parser-1.18.3.tgz: 4 vulnerabilities (highest severity is: 9.8)

[dev-mend-for-github-com]

Vulnerable Library - body-parser-1.18.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (body-parser version)	Remediation Possible**	Reachability
CVE-2022-24999	High	7.5	qs-6.5.2.tgz	Transitive	1.19.0	✅	Unreachable
CVE-587792-470342	Critical	9.8	on-finished-2.3.0.tgz	Transitive	N/A*	❌
CVE-275296-826791	Critical	9.8	qs-6.5.2.tgz	Transitive	N/A*	❌
CVE-154062-641864	Critical	9.8	ee-first-1.1.1.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-24999

Vulnerable Library - qs-6.5.2.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.5.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• body-parser-1.18.3.tgz (Root Library)
  • ❌ qs-6.5.2.tgz (Vulnerable Library)

Found in base branch: master

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2022-11-26

URL: CVE-2022-24999

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hrpp-h998-j3pp

Release Date: 2022-11-26

Fix Resolution (qs): 6.5.3

Direct dependency fix Resolution (body-parser): 1.19.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-587792-470342

Vulnerable Library - on-finished-2.3.0.tgz

Execute a callback when a request closes, finishes, or errors

Library home page: https://registry.npmjs.org/on-finished/-/on-finished-2.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• body-parser-1.18.3.tgz (Root Library)
  • ❌ on-finished-2.3.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Created automatically by the test suite

Publish Date: 2010-06-07

URL: CVE-587792-470342

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-275296-826791

Vulnerable Library - qs-6.5.2.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.5.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• body-parser-1.18.3.tgz (Root Library)
  • ❌ qs-6.5.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Created automatically by the test suite

Publish Date: 2010-06-07

URL: CVE-275296-826791

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-154062-641864

Vulnerable Library - ee-first-1.1.1.tgz

return the first event in a set of ee/event pairs

Library home page: https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• body-parser-1.18.3.tgz (Root Library)
  • on-finished-2.3.0.tgz
    • ❌ ee-first-1.1.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Created automatically by the test suite

Publish Date: 2010-06-07

URL: CVE-154062-641864

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

---

⛑️Automatic Remediation will be attempted for this issue.