Skip to content

[DO NOT MERGE] - Snap debugging branch #1799

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 6 commits into
base: main
Choose a base branch
from

temp: adding debug snap test button for testing

fa23db1
Select commit
Loading
Failed to load commit list.
Draft

[DO NOT MERGE] - Snap debugging branch #1799

temp: adding debug snap test button for testing
fa23db1
Select commit
Loading
Failed to load commit list.
GitHub Advanced Security / Trivy failed Jan 10, 2025 in 3s

15 new alerts including 4 high severity security vulnerabilities

New alerts in code changed by this pull request

Security Alerts:

  • 4 high
  • 11 medium

See annotations below for details.

View all branch alerts.

Annotations

Check failure on line 8504 in package-lock.json

See this annotation in the file changed.

Code scanning / Trivy

nodejs-axios: Regular expression denial of service in trim function High

Package: axios
Installed Version: 0.18.1
Vulnerability CVE-2021-3749
Severity: HIGH
Fixed Version: 0.21.2
Link: CVE-2021-3749

Check warning on line 8504 in package-lock.json

See this annotation in the file changed.

Code scanning / Trivy

nodejs-axios: allows an attacker to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address Medium

Package: axios
Installed Version: 0.18.1
Vulnerability CVE-2020-28168
Severity: MEDIUM
Fixed Version: 0.21.1
Link: CVE-2020-28168

Check warning on line 8504 in package-lock.json

See this annotation in the file changed.

Code scanning / Trivy

axios: exposure of confidential data stored in cookies Medium

Package: axios
Installed Version: 0.18.1
Vulnerability CVE-2023-45857
Severity: MEDIUM
Fixed Version: 1.6.0, 0.28.0
Link: CVE-2023-45857

Check warning on line 9855 in package-lock.json

See this annotation in the file changed.

Code scanning / Trivy

nodejs-got: missing verification of requested URLs allows redirects to UNIX sockets Medium

Package: got
Installed Version: 6.7.1
Vulnerability CVE-2022-33987
Severity: MEDIUM
Fixed Version: 12.1.0, 11.8.5
Link: CVE-2022-33987

Check failure on line 10701 in package-lock.json

See this annotation in the file changed.

Code scanning / Trivy

cross-spawn: regular expression denial of service High

Package: cross-spawn
Installed Version: 7.0.3
Vulnerability CVE-2024-21538
Severity: HIGH
Fixed Version: 7.0.5, 6.0.6
Link: CVE-2024-21538

Check warning on line 12258 in package-lock.json

See this annotation in the file changed.

Code scanning / Trivy

elliptic: ECDSA signature verification error may reject legitimate transactions Medium

Package: elliptic
Installed Version: 6.5.7
Vulnerability CVE-2024-48948
Severity: LOW
Fixed Version: 6.6.0
Link: CVE-2024-48948

Check warning on line 13398 in package-lock.json

See this annotation in the file changed.

Code scanning / Trivy

path-to-regexp: path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x High

Package: path-to-regexp
Installed Version: 0.1.10
Vulnerability CVE-2024-52798
Severity: HIGH
Fixed Version: 0.1.12
Link: CVE-2024-52798

Check failure on line 13827 in package-lock.json

See this annotation in the file changed.

Code scanning / Trivy

follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor High

Package: follow-redirects
Installed Version: 1.5.10
Vulnerability CVE-2022-0155
Severity: HIGH
Fixed Version: 1.14.7
Link: CVE-2022-0155

Check warning on line 13827 in package-lock.json

See this annotation in the file changed.

Code scanning / Trivy

follow-redirects: Exposure of Sensitive Information via Authorization Header leak Medium

Package: follow-redirects
Installed Version: 1.5.10
Vulnerability CVE-2022-0536
Severity: MEDIUM
Fixed Version: 1.14.8
Link: CVE-2022-0536

Check warning on line 13827 in package-lock.json

See this annotation in the file changed.

Code scanning / Trivy

follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse() Medium

Package: follow-redirects
Installed Version: 1.5.10
Vulnerability CVE-2023-26159
Severity: MEDIUM
Fixed Version: 1.15.4
Link: CVE-2023-26159

Check warning on line 13827 in package-lock.json

See this annotation in the file changed.

Code scanning / Trivy

follow-redirects: Possible credential leak Medium

Package: follow-redirects
Installed Version: 1.5.10
Vulnerability CVE-2024-28849
Severity: MEDIUM
Fixed Version: 1.15.6
Link: CVE-2024-28849

Check failure on line 15085 in package-lock.json

See this annotation in the file changed.

Code scanning / Trivy

http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability High

Package: http-cache-semantics
Installed Version: 3.8.1
Vulnerability CVE-2022-25881
Severity: HIGH
Fixed Version: 4.1.1
Link: CVE-2022-25881

Check failure on line 15179 in package-lock.json

See this annotation in the file changed.

Code scanning / Trivy

http-proxy-middleware: Denial of Service High

Package: http-proxy-middleware
Installed Version: 2.0.6
Vulnerability CVE-2024-21536
Severity: HIGH
Fixed Version: 2.0.7, 3.0.3
Link: CVE-2024-21536

Check failure on line 17106 in package-lock.json

See this annotation in the file changed.

Code scanning / Trivy

nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode High

Package: ssri
Installed Version: 5.3.0
Vulnerability CVE-2021-27290
Severity: HIGH
Fixed Version: 6.0.2, 7.1.1, 8.0.1
Link: CVE-2021-27290

Check failure on line 17710 in package-lock.json

See this annotation in the file changed.

Code scanning / Trivy

Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify High

Package: mermaid
Installed Version: 10.9.1
Vulnerability GHSA-m4gq-x24j-jpmf
Severity: HIGH
Fixed Version: 10.9.3
Link: GHSA-m4gq-x24j-jpmf

Check warning on line 20192 in package-lock.json

See this annotation in the file changed.

Code scanning / Trivy

nanoid: nanoid mishandles non-integer values Medium

Package: nanoid
Installed Version: 3.3.7
Vulnerability CVE-2024-55565
Severity: MEDIUM
Fixed Version: 5.0.9, 3.3.8
Link: CVE-2024-55565

Check failure on line 23314 in package-lock.json

See this annotation in the file changed.

Code scanning / Trivy

node-fetch: exposure of sensitive information to an unauthorized actor High

Package: node-fetch
Installed Version: 1.7.3
Vulnerability CVE-2022-0235
Severity: HIGH
Fixed Version: 3.1.1, 2.6.7
Link: CVE-2022-0235

Check failure on line 24402 in package-lock.json

See this annotation in the file changed.

Code scanning / Trivy

path-to-regexp: Backtracking regular expressions cause ReDoS High

Package: path-to-regexp
Installed Version: 2.2.1
Vulnerability CVE-2024-45296
Severity: HIGH
Fixed Version: 1.9.0, 0.1.10, 8.0.0, 3.3.0, 6.3.0
Link: CVE-2024-45296

Check warning on line 24620 in package-lock.json

See this annotation in the file changed.

Code scanning / Trivy

nanoid: nanoid mishandles non-integer values Medium

Package: nanoid
Installed Version: 2.1.11
Vulnerability CVE-2024-55565
Severity: MEDIUM
Fixed Version: 5.0.9, 3.3.8
Link: CVE-2024-55565

Check warning on line 24936 in package-lock.json

See this annotation in the file changed.

Code scanning / Trivy

index.js in the ssri module before 5.2.2 for Node.js is prone to a reg ... Medium

Package: ssri
Installed Version: 4.1.6
Vulnerability CVE-2018-7651
Severity: MEDIUM
Fixed Version: 5.2.2
Link: CVE-2018-7651

Check failure on line 25772 in package-lock.json

See this annotation in the file changed.

Code scanning / Trivy

cross-spawn: regular expression denial of service High

Package: cross-spawn
Installed Version: 5.1.0
Vulnerability CVE-2024-21538
Severity: HIGH
Fixed Version: 7.0.5, 6.0.6
Link: CVE-2024-21538

Check warning on line 10085 in package-lock.json

See this annotation in the file changed.

Code scanning / Trivy

nodejs-axios: allows an attacker to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address Medium

Package: axios
Installed Version: 0.18.1
Vulnerability CVE-2020-28168
Severity: MEDIUM
Fixed Version: 0.21.1
Link: CVE-2020-28168

Check warning on line 10085 in package-lock.json

See this annotation in the file changed.

Code scanning / Trivy

axios: exposure of confidential data stored in cookies Medium

Package: axios
Installed Version: 0.18.1
Vulnerability CVE-2023-45857
Severity: MEDIUM
Fixed Version: 1.6.0, 0.28.0
Link: CVE-2023-45857

Check failure on line 10488 in package-lock.json

See this annotation in the file changed.

Code scanning / Trivy

cross-spawn: regular expression denial of service High

Package: cross-spawn
Installed Version: 7.0.3
Vulnerability CVE-2024-21538
Severity: HIGH
Fixed Version: 7.0.5, 6.0.6
Link: CVE-2024-21538

Check warning on line 11398 in package-lock.json

See this annotation in the file changed.

Code scanning / Trivy

elliptic: ECDSA signature verification error may reject legitimate transactions Medium

Package: elliptic
Installed Version: 6.5.7
Vulnerability CVE-2024-48948
Severity: LOW
Fixed Version: 6.6.0
Link: CVE-2024-48948