Skip to content

dns-0.1.2.tgz: 39 vulnerabilities (highest severity is: 9.8) #12

New issue
New issue
Open
Open
dns-0.1.2.tgz: 39 vulnerabilities (highest severity is: 9.8)#12
Labels
Mend: dependency security vulnerabilitySecurity vulnerability detected by Mend
@mend-for-g.yxqyang.asia

Description

@mend-for-g.yxqyang.asia
mend-for-g.yxqyang.asia
bot
opened on Jun 12, 2025
Vulnerable Library - dns-0.1.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/request/package.json,/node_modules/tomahawk/node_modules/winston/node_modules/request/package.json

Found in HEAD commit: 2e8e5197e265211790961302633a7091296b414c

Vulnerabilities

Vulnerability Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (dns version) Remediation Possible** Reachability
CVE-2018-1000620 Critical 9.8 Not Defined 0.4% detected in multiple dependencies Transitive N/A* ❌

Unreachable
CVE-2015-8857 Critical 9.8 Not Defined 0.3% uglify-js-1.2.5.tgz Transitive 0.1.3 ✅

Unreachable
CVE-2018-3728 High 8.8 Not Defined 1.8% detected in multiple dependencies Transitive N/A* ❌

Unreachable
CVE-2020-36604 High 8.1 Not Defined 0.70000005% detected in multiple dependencies Transitive N/A* ❌

Unreachable
CVE-2020-28502 High 8.1 Proof of concept 17.4% xmlhttprequest-1.4.2.tgz Transitive 0.1.3 ✅

Unreachable
WS-2017-0421 High 7.5 Not Defined ws-0.4.31.tgz Transitive N/A* ❌

Unreachable
WS-2014-0005 High 7.5 Not Defined detected in multiple dependencies Transitive N/A* ❌

Unreachable
CVE-2017-16138 High 7.5 Not Defined 0.4% mime-1.2.11.tgz Transitive N/A* ❌

Unreachable
CVE-2017-16119 High 7.5 Not Defined 0.3% fresh-0.2.0.tgz Transitive N/A* ❌

Unreachable
CVE-2017-1000048 High 7.5 Not Defined 0.6% detected in multiple dependencies Transitive N/A* ❌

Unreachable
CVE-2016-2515 High 7.5 Not Defined 5.1% hawk-0.10.2.tgz Transitive N/A* ❌

Unreachable
CVE-2016-10542 High 7.5 Not Defined 0.3% ws-0.4.31.tgz Transitive N/A* ❌

Unreachable
CVE-2016-10539 High 7.5 Not Defined 0.3% negotiator-0.3.0.tgz Transitive N/A* ❌

Unreachable
CVE-2016-10518 High 7.5 Not Defined 0.4% ws-0.4.31.tgz Transitive N/A* ❌

Unreachable
CVE-2015-8858 High 7.5 Not Defined 0.9% uglify-js-1.2.5.tgz Transitive 0.1.3 ✅

Unreachable
CVE-2015-8851 High 7.5 Not Defined 0.5% node-uuid-1.4.1.tgz Transitive N/A* ❌

Unreachable
CVE-2014-10064 High 7.5 Not Defined 0.6% detected in multiple dependencies Transitive N/A* ❌

Unreachable
WS-2017-0107 High 7.4 Not Defined ws-0.4.31.tgz Transitive N/A* ❌

Unreachable
CVE-2024-38355 High 7.3 Not Defined 0.1% socket.io-0.9.16.tgz Transitive N/A* ❌

Unreachable
CVE-2014-6394 High 7.3 Not Defined 4.8% send-0.1.4.tgz Transitive N/A* ❌

Unreachable
CVE-2024-29041 Medium 6.1 Not Defined 0.0% express-3.4.8.tgz Transitive N/A* ❌

Unreachable
CVE-2023-28155 Medium 6.1 Not Defined 0.6% request-2.16.6.tgz Transitive N/A* ❌

Unreachable
CVE-2014-6393 Medium 6.1 Not Defined 0.3% express-3.4.8.tgz Transitive 0.1.3 ✅

Unreachable
CVE-2017-16026 Medium 5.9 Not Defined 0.9% request-2.16.6.tgz Transitive N/A* ❌

Unreachable
CVE-2018-3717 Medium 5.4 Not Defined 0.3% connect-2.12.0.tgz Transitive 0.1.3 ✅

Unreachable
CVE-2024-47764 Medium 5.3 Not Defined 0.1% cookie-0.1.0.tgz Transitive N/A* ❌

Unreachable
CVE-2020-28481 Medium 5.3 Proof of concept 0.2% socket.io-0.9.16.tgz Transitive N/A* ❌

Unreachable
CVE-2015-8859 Medium 5.3 Not Defined 0.2% send-0.1.4.tgz Transitive N/A* ❌

Unreachable
CVE-2014-7191 Medium 5.3 Not Defined 1.1% detected in multiple dependencies Transitive N/A* ❌

Unreachable
WS-2018-0076 Medium 5.1 Not Defined tunnel-agent-0.2.0.tgz Transitive N/A* ❌

Unreachable
CVE-2024-43799 Medium 5.0 Not Defined 0.1% send-0.1.4.tgz Transitive N/A* ❌

Unreachable
CVE-2024-43796 Medium 5.0 Not Defined 0.1% express-3.4.8.tgz Transitive N/A* ❌

Unreachable
CVE-2024-9266 Medium 4.7 Not Defined 0.0% express-3.4.8.tgz Transitive N/A* ❌

Unreachable
CVE-2016-1000236 Medium 4.4 Not Defined 0.5% cookie-signature-1.0.1.tgz Transitive 0.1.3 ✅

Unreachable
CVE-2024-10491 Medium 4.0 Not Defined 0.1% express-3.4.8.tgz Transitive N/A* ❌

Unreachable
CVE-2017-16137 Low 3.7 Not Defined 0.1% detected in multiple dependencies Transitive N/A* ❌

Unreachable
CVE-2017-20165 Low 3.5 Not Defined 1.2% detected in multiple dependencies Transitive N/A* ❌

Unreachable
CVE-2025-7783 High 8.7 Not Defined 0.1% form-data-0.0.10.tgz Transitive N/A* ❌
CVE-2022-29167 High 7.4 Not Defined 0.1% hawk-0.10.2.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

Partial details (17 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2018-1000620

Vulnerable Libraries - cryptiles-0.1.0.tgz, cryptiles-0.1.3.tgz

cryptiles-0.1.0.tgz

General purpose crypto utilities

Library home page: https://registry.npmjs.org/cryptiles/-/cryptiles-0.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/cryptiles/package.json

Dependency Hierarchy:

  • dns-0.1.2.tgz (Root Library)
    • winston-0.7.2.tgz
      • request-2.16.6.tgz
        • hawk-0.10.2.tgz
          • ❌ cryptiles-0.1.0.tgz (Vulnerable Library)

cryptiles-0.1.3.tgz

General purpose crypto utilities

Library home page: https://registry.npmjs.org/cryptiles/-/cryptiles-0.1.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tomahawk/node_modules/winston/node_modules/request/node_modules/hawk/node_modules/cryptiles/package.json

Dependency Hierarchy:

  • dns-0.1.2.tgz (Root Library)
    • tomahawk-0.0.14.tgz
      • winston-0.7.2.tgz
        • request-2.16.6.tgz
          • hawk-0.10.2.tgz
            • ❌ cryptiles-0.1.3.tgz (Vulnerable Library)

Found in HEAD commit: 2e8e5197e265211790961302633a7091296b414c

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2.

Publish Date: 2018-07-09

URL: CVE-2018-1000620

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.4%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000620

Release Date: 2018-07-09

Fix Resolution: v4.1.2

CVE-2015-8857

Vulnerable Library - uglify-js-1.2.5.tgz

JavaScript parser and compressor/beautifier toolkit

Library home page: https://registry.npmjs.org/uglify-js/-/uglify-js-1.2.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tomahawk/node_modules/socket.io/node_modules/socket.io-client/node_modules/uglify-js/package.json

Dependency Hierarchy:

  • dns-0.1.2.tgz (Root Library)
    • tomahawk-0.0.14.tgz
      • socket.io-0.9.16.tgz
        • socket.io-client-0.9.16.tgz
          • ❌ uglify-js-1.2.5.tgz (Vulnerable Library)

Found in HEAD commit: 2e8e5197e265211790961302633a7091296b414c

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.

Publish Date: 2017-01-23

URL: CVE-2015-8857

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.3%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8858

Release Date: 2017-01-23

Fix Resolution (uglify-js): 2.4.24

Direct dependency fix Resolution (dns): 0.1.3

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2018-3728

Vulnerable Libraries - hoek-0.4.2.tgz, hoek-0.7.6.tgz

hoek-0.4.2.tgz

General purpose node utilities

Library home page: https://registry.npmjs.org/hoek/-/hoek-0.4.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/sntp/node_modules/hoek/package.json,/node_modules/boom/node_modules/hoek/package.json

Dependency Hierarchy:

  • dns-0.1.2.tgz (Root Library)
    • winston-0.7.2.tgz
      • request-2.16.6.tgz
        • hawk-0.10.2.tgz
          • sntp-0.1.2.tgz
            • ❌ hoek-0.4.2.tgz (Vulnerable Library)

hoek-0.7.6.tgz

General purpose node utilities

Library home page: https://registry.npmjs.org/hoek/-/hoek-0.7.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/hoek/package.json,/node_modules/tomahawk/node_modules/winston/node_modules/request/node_modules/hawk/node_modules/hoek/package.json

Dependency Hierarchy:

  • dns-0.1.2.tgz (Root Library)
    • tomahawk-0.0.14.tgz
      • winston-0.7.2.tgz
        • request-2.16.6.tgz
          • hawk-0.10.2.tgz
            • ❌ hoek-0.7.6.tgz (Vulnerable Library)

Found in HEAD commit: 2e8e5197e265211790961302633a7091296b414c

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-03-30

URL: CVE-2018-3728

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 1.8%

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jp4x-w63m-7wgm

Release Date: 2018-03-30

Fix Resolution: hoek - 5.0.3

CVE-2020-36604

Vulnerable Libraries - hoek-0.4.2.tgz, hoek-0.7.6.tgz

hoek-0.4.2.tgz

General purpose node utilities

Library home page: https://registry.npmjs.org/hoek/-/hoek-0.4.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/sntp/node_modules/hoek/package.json,/node_modules/boom/node_modules/hoek/package.json

Dependency Hierarchy:

  • dns-0.1.2.tgz (Root Library)
    • winston-0.7.2.tgz
      • request-2.16.6.tgz
        • hawk-0.10.2.tgz
          • sntp-0.1.2.tgz
            • ❌ hoek-0.4.2.tgz (Vulnerable Library)

hoek-0.7.6.tgz

General purpose node utilities

Library home page: https://registry.npmjs.org/hoek/-/hoek-0.7.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/hoek/package.json,/node_modules/tomahawk/node_modules/winston/node_modules/request/node_modules/hawk/node_modules/hoek/package.json

Dependency Hierarchy:

  • dns-0.1.2.tgz (Root Library)
    • tomahawk-0.0.14.tgz
      • winston-0.7.2.tgz
        • request-2.16.6.tgz
          • hawk-0.10.2.tgz
            • ❌ hoek-0.7.6.tgz (Vulnerable Library)

Found in HEAD commit: 2e8e5197e265211790961302633a7091296b414c

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.

Publish Date: 2022-09-23

URL: CVE-2020-36604

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.70000005%

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-36604

Release Date: 2022-09-23

Fix Resolution: @hapi/hoek - 9.0.3

CVE-2020-28502

Vulnerable Library - xmlhttprequest-1.4.2.tgz

XMLHttpRequest for Node

Library home page: https://registry.npmjs.org/xmlhttprequest/-/xmlhttprequest-1.4.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tomahawk/node_modules/socket.io/node_modules/socket.io-client/node_modules/xmlhttprequest/package.json

Dependency Hierarchy:

  • dns-0.1.2.tgz (Root Library)
    • tomahawk-0.0.14.tgz
      • socket.io-0.9.16.tgz
        • socket.io-client-0.9.16.tgz
          • ❌ xmlhttprequest-1.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 2e8e5197e265211790961302633a7091296b414c

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and run.

Publish Date: 2021-03-05

URL: CVE-2020-28502

Threat Assessment

Exploit Maturity: Proof of concept

EPSS: 17.4%

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-h4j5-c7cj-74xg

Release Date: 2021-03-05

Fix Resolution (xmlhttprequest): 1.7.0

Direct dependency fix Resolution (dns): 0.1.3

⛑️ Automatic Remediation will be attempted for this issue.

WS-2017-0421

Vulnerable Library - ws-0.4.31.tgz

simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455

Library home page: https://registry.npmjs.org/ws/-/ws-0.4.31.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tomahawk/node_modules/socket.io/node_modules/socket.io-client/node_modules/ws/package.json

Dependency Hierarchy:

  • dns-0.1.2.tgz (Root Library)
    • tomahawk-0.0.14.tgz
      • socket.io-0.9.16.tgz
        • socket.io-client-0.9.16.tgz
          • ❌ ws-0.4.31.tgz (Vulnerable Library)

Found in HEAD commit: 2e8e5197e265211790961302633a7091296b414c

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Denial of Service vulnerability was found in ws npm package 0.2.6 through 1.1.4 and 2.0.0 through 3.3.0. ws can crash when a specially crafted Sec-WebSocket-Extensions header containing Object.prototype property names as extension or parameter names are sent.

Publish Date: 2017-11-08

URL: WS-2017-0421

Threat Assessment

Exploit Maturity: Not Defined

EPSS:

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5v72-xg48-5rpm

Release Date: 2017-11-08

Fix Resolution: ws - 1.1.5,3.3.1

WS-2014-0005

Vulnerable Libraries - qs-0.5.6.tgz, qs-0.6.6.tgz

qs-0.5.6.tgz

querystring parser

Library home page: https://registry.npmjs.org/qs/-/qs-0.5.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/request/node_modules/qs/package.json,/node_modules/tomahawk/node_modules/winston/node_modules/request/node_modules/qs/package.json

Dependency Hierarchy:

  • dns-0.1.2.tgz (Root Library)
    • tomahawk-0.0.14.tgz
      • winston-0.7.2.tgz
        • request-2.16.6.tgz
          • ❌ qs-0.5.6.tgz (Vulnerable Library)

qs-0.6.6.tgz

querystring parser

Library home page: https://registry.npmjs.org/qs/-/qs-0.6.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/qs/package.json,/node_modules/tomahawk/node_modules/connect/node_modules/qs/package.json

Dependency Hierarchy:

  • dns-0.1.2.tgz (Root Library)
    • tomahawk-0.0.14.tgz
      • connect-2.12.0.tgz
        • ❌ qs-0.6.6.tgz (Vulnerable Library)

Found in HEAD commit: 2e8e5197e265211790961302633a7091296b414c

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Denial-of-Service Extended Event Loop Blocking.The qs module does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time

Publish Date: 2014-07-31

URL: WS-2014-0005

Threat Assessment

Exploit Maturity: Not Defined

EPSS:

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/qs_dos_extended_event_loop_blocking

Release Date: 2014-08-06

Fix Resolution: Update qs to version 1.0.0 or greater

CVE-2017-16138

Vulnerable Library - mime-1.2.11.tgz

A comprehensive library for mime-type mapping

Library home page: https://registry.npmjs.org/mime/-/mime-1.2.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mime/package.json,/node_modules/tomahawk/node_modules/connect/node_modules/send/node_modules/mime/package.json,/node_modules/tomahawk/node_modules/winston/node_modules/request/node_modules/mime/package.json,/node_modules/tomahawk/node_modules/express/node_modules/send/node_modules/mime/package.json

Dependency Hierarchy:

  • dns-0.1.2.tgz (Root Library)
    • tomahawk-0.0.14.tgz
      • express-3.4.8.tgz
        • send-0.1.4.tgz
          • ❌ mime-1.2.11.tgz (Vulnerable Library)

Found in HEAD commit: 2e8e5197e265211790961302633a7091296b414c

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input. Converted from WS-2017-0330, on 2022-11-08.

Publish Date: 2018-06-07

URL: CVE-2017-16138

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.4%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16138

Release Date: 2018-06-07

Fix Resolution: 1.4.1,2.0.3

CVE-2017-16119

Vulnerable Library - fresh-0.2.0.tgz

HTTP response freshness testing

Library home page: https://registry.npmjs.org/fresh/-/fresh-0.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tomahawk/node_modules/connect/node_modules/fresh/package.json,/node_modules/fresh/package.json,/node_modules/tomahawk/node_modules/express/node_modules/fresh/package.json

Dependency Hierarchy:

  • dns-0.1.2.tgz (Root Library)
    • tomahawk-0.0.14.tgz
      • express-3.4.8.tgz
        • ❌ fresh-0.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 2e8e5197e265211790961302633a7091296b414c

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.

Publish Date: 2018-06-07

URL: CVE-2017-16119

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.3%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/526

Release Date: 2018-06-07

Fix Resolution: fresh - 0.5.2

CVE-2017-1000048

Vulnerable Libraries - qs-0.6.6.tgz, qs-0.5.6.tgz

qs-0.6.6.tgz

querystring parser

Library home page: https://registry.npmjs.org/qs/-/qs-0.6.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/qs/package.json,/node_modules/tomahawk/node_modules/connect/node_modules/qs/package.json

Dependency Hierarchy:

  • dns-0.1.2.tgz (Root Library)
    • tomahawk-0.0.14.tgz
      • connect-2.12.0.tgz
        • ❌ qs-0.6.6.tgz (Vulnerable Library)

qs-0.5.6.tgz

querystring parser

Library home page: https://registry.npmjs.org/qs/-/qs-0.5.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/request/node_modules/qs/package.json,/node_modules/tomahawk/node_modules/winston/node_modules/request/node_modules/qs/package.json

Dependency Hierarchy:

  • dns-0.1.2.tgz (Root Library)
    • tomahawk-0.0.14.tgz
      • winston-0.7.2.tgz
        • request-2.16.6.tgz
          • ❌ qs-0.5.6.tgz (Vulnerable Library)

Found in HEAD commit: 2e8e5197e265211790961302633a7091296b414c

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.

Publish Date: 2017-07-13

URL: CVE-2017-1000048

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.6%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000048

Release Date: 2017-07-13

Fix Resolution: qs - 6.0.4,6.1.2,6.2.3,6.3.2

CVE-2016-2515

Vulnerable Library - hawk-0.10.2.tgz

HTTP Hawk Authentication Scheme

Library home page: https://registry.npmjs.org/hawk/-/hawk-0.10.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/hawk/package.json,/node_modules/tomahawk/node_modules/winston/node_modules/request/node_modules/hawk/package.json

Dependency Hierarchy:

  • dns-0.1.2.tgz (Root Library)
    • tomahawk-0.0.14.tgz
      • winston-0.7.2.tgz
        • request-2.16.6.tgz
          • ❌ hawk-0.10.2.tgz (Vulnerable Library)

Found in HEAD commit: 2e8e5197e265211790961302633a7091296b414c

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service (CPU consumption or partial outage) via a long (1) header or (2) URI that is matched against an improper regular expression.

Publish Date: 2016-04-13

URL: CVE-2016-2515

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 5.1%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-2515

Release Date: 2016-04-13

Fix Resolution: 3.1.3,4.1.1

CVE-2016-10542

Vulnerable Library - ws-0.4.31.tgz

simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455

Library home page: https://registry.npmjs.org/ws/-/ws-0.4.31.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tomahawk/node_modules/socket.io/node_modules/socket.io-client/node_modules/ws/package.json

Dependency Hierarchy:

  • dns-0.1.2.tgz (Root Library)
    • tomahawk-0.0.14.tgz
      • socket.io-0.9.16.tgz
        • socket.io-client-0.9.16.tgz
          • ❌ ws-0.4.31.tgz (Vulnerable Library)

Found in HEAD commit: 2e8e5197e265211790961302633a7091296b414c

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a ws server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.

Publish Date: 2018-05-31

URL: CVE-2016-10542

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.3%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8858

Release Date: 2018-05-31

Fix Resolution: v2.4.24

CVE-2016-10539

Vulnerable Library - negotiator-0.3.0.tgz

HTTP content negotiation

Library home page: https://registry.npmjs.org/negotiator/-/negotiator-0.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tomahawk/node_modules/connect/node_modules/negotiator/package.json,/node_modules/negotiator/package.json

Dependency Hierarchy:

  • dns-0.1.2.tgz (Root Library)
    • tomahawk-0.0.14.tgz
      • connect-2.12.0.tgz
        • ❌ negotiator-0.3.0.tgz (Vulnerable Library)

Found in HEAD commit: 2e8e5197e265211790961302633a7091296b414c

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.

Publish Date: 2018-05-31

URL: CVE-2016-10539

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.3%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/106

Release Date: 2018-05-31

Fix Resolution: 0.6.1

CVE-2016-10518

Vulnerable Library - ws-0.4.31.tgz

simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455

Library home page: https://registry.npmjs.org/ws/-/ws-0.4.31.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tomahawk/node_modules/socket.io/node_modules/socket.io-client/node_modules/ws/package.json

Dependency Hierarchy:

  • dns-0.1.2.tgz (Root Library)
    • tomahawk-0.0.14.tgz
      • socket.io-0.9.16.tgz
        • socket.io-client-0.9.16.tgz
          • ❌ ws-0.4.31.tgz (Vulnerable Library)

Found in HEAD commit: 2e8e5197e265211790961302633a7091296b414c

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping functionality by default responds with a pong frame and the previously given payload of the ping frame. This is exactly what you expect, but internally ws always transforms all data that we need to send to a Buffer instance and that is where the vulnerability existed. ws didn't do any checks for the type of data it was sending. With buffers in node when you allocate it when a number instead of a string it will allocate the amount of bytes.

Publish Date: 2018-05-31

URL: CVE-2016-10518

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.4%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-10518

Release Date: 2018-05-31

Fix Resolution: 1.0.0

CVE-2015-8858

Vulnerable Library - uglify-js-1.2.5.tgz

JavaScript parser and compressor/beautifier toolkit

Library home page: https://registry.npmjs.org/uglify-js/-/uglify-js-1.2.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tomahawk/node_modules/socket.io/node_modules/socket.io-client/node_modules/uglify-js/package.json

Dependency Hierarchy:

  • dns-0.1.2.tgz (Root Library)
    • tomahawk-0.0.14.tgz
      • socket.io-0.9.16.tgz
        • socket.io-client-0.9.16.tgz
          • ❌ uglify-js-1.2.5.tgz (Vulnerable Library)

Found in HEAD commit: 2e8e5197e265211790961302633a7091296b414c

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse call, aka a "regular expression denial of service (ReDoS)."

Publish Date: 2017-01-23

URL: CVE-2015-8858

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.9%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8858

Release Date: 2017-01-23

Fix Resolution (uglify-js): 2.6.0

Direct dependency fix Resolution (dns): 0.1.3

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2015-8851

Vulnerable Library - node-uuid-1.4.1.tgz

Rigorous implementation of RFC4122 (v1 and v4) UUIDs.

Library home page: https://registry.npmjs.org/node-uuid/-/node-uuid-1.4.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tomahawk/node_modules/winston/node_modules/request/node_modules/node-uuid/package.json

Dependency Hierarchy:

  • dns-0.1.2.tgz (Root Library)
    • tomahawk-0.0.14.tgz
      • winston-0.7.2.tgz
        • request-2.16.6.tgz
          • ❌ node-uuid-1.4.1.tgz (Vulnerable Library)

Found in HEAD commit: 2e8e5197e265211790961302633a7091296b414c

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing. Converted from WS-2016-0013, on 2022-11-08.

Publish Date: 2020-01-30

URL: CVE-2015-8851

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.5%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-01-30

Fix Resolution: node-uuid - 1.4.6

CVE-2014-10064

Vulnerable Libraries - qs-0.5.6.tgz, qs-0.6.6.tgz

qs-0.5.6.tgz

querystring parser

Library home page: https://registry.npmjs.org/qs/-/qs-0.5.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/request/node_modules/qs/package.json,/node_modules/tomahawk/node_modules/winston/node_modules/request/node_modules/qs/package.json

Dependency Hierarchy:

  • dns-0.1.2.tgz (Root Library)
    • tomahawk-0.0.14.tgz
      • winston-0.7.2.tgz
        • request-2.16.6.tgz
          • ❌ qs-0.5.6.tgz (Vulnerable Library)

qs-0.6.6.tgz

querystring parser

Library home page: https://registry.npmjs.org/qs/-/qs-0.6.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/qs/package.json,/node_modules/tomahawk/node_modules/connect/node_modules/qs/package.json

Dependency Hierarchy:

  • dns-0.1.2.tgz (Root Library)
    • tomahawk-0.0.14.tgz
      • connect-2.12.0.tgz
        • ❌ qs-0.6.6.tgz (Vulnerable Library)

Found in HEAD commit: 2e8e5197e265211790961302633a7091296b414c

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.

Publish Date: 2018-05-31

URL: CVE-2014-10064

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.6%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-f9cm-p3w6-xvr3

Release Date: 2018-05-31

Fix Resolution: qs - 1.0.0

⛑️Automatic Remediation will be attempted for this issue.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Mend: dependency security vulnerabilitySecurity vulnerability detected by Mend

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions