Skip to content
This repository has been archived by the owner on Aug 21, 2023. It is now read-only.

firebase-tools-11.24.0.tgz: 11 vulnerabilities (highest severity is: 10.0) #52

Open
mend-for-github-com bot opened this issue Jul 9, 2023 · 0 comments
Open

firebase-tools-11.24.0.tgz: 11 vulnerabilities (highest severity is: 10.0) #52

mend-for-github-com bot opened this issue Jul 9, 2023 · 0 comments
Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend

Comments

@mend-for-github-com
Copy link
Contributor

mend-for-github-com bot commented Jul 9, 2023 •
edited
Loading

Vulnerable Library - firebase-tools-11.24.0.tgz

Found in HEAD commit: 84871f913299c03569bde7baed81829733ed9798

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (firebase-tools version) Remediation Possible**
CVE-2023-30547 Critical 10.0 vm2-3.9.15.tgz Transitive 11.24.1 ❌
CVE-2023-29199 Critical 10.0 vm2-3.9.15.tgz Transitive 11.24.1 ❌
CVE-2023-37903 Critical 10.0 vm2-3.9.15.tgz Transitive N/A* ❌
CVE-2023-32314 Critical 10.0 vm2-3.9.15.tgz Transitive 11.24.1 ❌
CVE-2023-37466 Critical 9.8 vm2-3.9.15.tgz Transitive N/A* ❌
CVE-2023-26136 Critical 9.8 tough-cookie-2.5.0.tgz Transitive N/A* ❌
CVE-2023-36665 Critical 9.8 protobufjs-7.2.3.tgz Transitive 11.24.1 ❌
CVE-2023-26115 High 7.5 word-wrap-1.2.3.tgz Transitive N/A* ❌
CVE-2022-25883 High 7.5 detected in multiple dependencies Transitive N/A* ❌
CVE-2023-28155 Medium 6.1 request-2.88.2.tgz Transitive N/A* ❌
CVE-2023-32313 Medium 5.3 vm2-3.9.15.tgz Transitive 11.24.1 ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-30547

Vulnerable Library - vm2-3.9.15.tgz

Library home page: https://registry.npmjs.org/vm2/-/vm2-3.9.15.tgz

Dependency Hierarchy:

  • firebase-tools-11.24.0.tgz (Root Library)
    • proxy-agent-5.0.0.tgz
      • pac-proxy-agent-5.0.0.tgz
        • pac-resolver-5.0.0.tgz
          • degenerator-3.0.1.tgz
            • ❌ vm2-3.9.15.tgz (Vulnerable Library)

Found in HEAD commit: 84871f913299c03569bde7baed81829733ed9798

Found in base branch: master

Vulnerability Details

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside handleException() which can be used to escape the sandbox and run arbitrary code in host context. This vulnerability was patched in the release of version 3.9.17 of vm2. There are no known workarounds for this vulnerability. Users are advised to upgrade.

Publish Date: 2023-04-17

URL: CVE-2023-30547

CVSS 3 Score Details (10.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-30547

Release Date: 2023-04-17

Fix Resolution (vm2): 3.9.18

Direct dependency fix Resolution (firebase-tools): 11.24.1

CVE-2023-29199

Vulnerable Library - vm2-3.9.15.tgz

Library home page: https://registry.npmjs.org/vm2/-/vm2-3.9.15.tgz

Dependency Hierarchy:

  • firebase-tools-11.24.0.tgz (Root Library)
    • proxy-agent-5.0.0.tgz
      • pac-proxy-agent-5.0.0.tgz
        • pac-resolver-5.0.0.tgz
          • degenerator-3.0.1.tgz
            • ❌ vm2-3.9.15.tgz (Vulnerable Library)

Found in HEAD commit: 84871f913299c03569bde7baed81829733ed9798

Found in base branch: master

Vulnerability Details

There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass handleException() and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context. A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.16 of vm2.

Publish Date: 2023-04-14

URL: CVE-2023-29199

CVSS 3 Score Details (10.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-xj72-wvfv-8985

Release Date: 2023-04-14

Fix Resolution (vm2): 3.9.16

Direct dependency fix Resolution (firebase-tools): 11.24.1

CVE-2023-37903

Vulnerable Library - vm2-3.9.15.tgz

Library home page: https://registry.npmjs.org/vm2/-/vm2-3.9.15.tgz

Dependency Hierarchy:

  • firebase-tools-11.24.0.tgz (Root Library)
    • proxy-agent-5.0.0.tgz
      • pac-proxy-agent-5.0.0.tgz
        • pac-resolver-5.0.0.tgz
          • degenerator-3.0.1.tgz
            • ❌ vm2-3.9.15.tgz (Vulnerable Library)

Found in HEAD commit: 84871f913299c03569bde7baed81829733ed9798

Found in base branch: master

Vulnerability Details

vm2 is an open source vm/sandbox for Node.js. In vm2 for versions up to and including 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code. This may result in Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox. There are no patches and no known workarounds. Users are advised to find an alternative software.

Publish Date: 2023-07-21

URL: CVE-2023-37903

CVSS 3 Score Details (10.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-2023-32314

Vulnerable Library - vm2-3.9.15.tgz

Library home page: https://registry.npmjs.org/vm2/-/vm2-3.9.15.tgz

Dependency Hierarchy:

  • firebase-tools-11.24.0.tgz (Root Library)
    • proxy-agent-5.0.0.tgz
      • pac-proxy-agent-5.0.0.tgz
        • pac-resolver-5.0.0.tgz
          • degenerator-3.0.1.tgz
            • ❌ vm2-3.9.15.tgz (Vulnerable Library)

Found in HEAD commit: 84871f913299c03569bde7baed81829733ed9798

Found in base branch: master

Vulnerability Details

vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17. It abuses an unexpected creation of a host object based on the specification of Proxy. As a result a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.18 of vm2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Publish Date: 2023-05-15

URL: CVE-2023-32314

CVSS 3 Score Details (10.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-whpj-8f3w-67p5

Release Date: 2023-05-15

Fix Resolution (vm2): 3.9.18

Direct dependency fix Resolution (firebase-tools): 11.24.1

CVE-2023-37466

Vulnerable Library - vm2-3.9.15.tgz

Library home page: https://registry.npmjs.org/vm2/-/vm2-3.9.15.tgz

Dependency Hierarchy:

  • firebase-tools-11.24.0.tgz (Root Library)
    • proxy-agent-5.0.0.tgz
      • pac-proxy-agent-5.0.0.tgz
        • pac-resolver-5.0.0.tgz
          • degenerator-3.0.1.tgz
            • ❌ vm2-3.9.15.tgz (Vulnerable Library)

Found in HEAD commit: 84871f913299c03569bde7baed81829733ed9798

Found in base branch: master

Vulnerability Details

vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed with @@species accessor property allowing attackers to escape the sandbox and run arbitrary code. Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox.

Publish Date: 2023-07-14

URL: CVE-2023-37466

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-2023-26136

Vulnerable Library - tough-cookie-2.5.0.tgz

RFC6265 Cookies and Cookie Jar for node.js

Library home page: https://registry.npmjs.org/tough-cookie/-/tough-cookie-2.5.0.tgz

Dependency Hierarchy:

  • firebase-tools-11.24.0.tgz (Root Library)
    • request-2.88.2.tgz
      • ❌ tough-cookie-2.5.0.tgz (Vulnerable Library)

Found in HEAD commit: 84871f913299c03569bde7baed81829733ed9798

Found in base branch: master

Vulnerability Details

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

Publish Date: 2023-07-01

URL: CVE-2023-26136

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-26136

Release Date: 2023-07-01

Fix Resolution: tough-cookie - 4.1.3

CVE-2023-36665

Vulnerable Library - protobufjs-7.2.3.tgz

Library home page: https://registry.npmjs.org/protobufjs/-/protobufjs-7.2.3.tgz

Dependency Hierarchy:

  • firebase-tools-11.24.0.tgz (Root Library)
    • pubsub-3.0.1.tgz
      • google-gax-3.6.0.tgz
        • ❌ protobufjs-7.2.3.tgz (Vulnerable Library)

Found in HEAD commit: 84871f913299c03569bde7baed81829733ed9798

Found in base branch: master

Vulnerability Details

protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.4 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty. NOTE: this CVE Record is about "Object.constructor.prototype. = ...;" whereas CVE-2022-25878 was about "Object.proto. = ...;" instead.

Publish Date: 2023-07-05

URL: CVE-2023-36665

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.code-intelligence.com/blog/cve-protobufjs-prototype-pollution-cve-2023-36665

Release Date: 2023-07-05

Fix Resolution (protobufjs): 7.2.4

Direct dependency fix Resolution (firebase-tools): 11.24.1

CVE-2023-26115

Vulnerable Library - word-wrap-1.2.3.tgz

Wrap words to a specified length.

Library home page: https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.3.tgz

Dependency Hierarchy:

  • firebase-tools-11.24.0.tgz (Root Library)
    • pubsub-3.0.1.tgz
      • google-gax-3.6.0.tgz
        • protobufjs-cli-1.1.1.tgz
          • escodegen-1.14.3.tgz
            • optionator-0.8.3.tgz
              • ❌ word-wrap-1.2.3.tgz (Vulnerable Library)

Found in HEAD commit: 84871f913299c03569bde7baed81829733ed9798

Found in base branch: master

Vulnerability Details

All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.

Publish Date: 2023-06-22

URL: CVE-2023-26115

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-j8xg-fqg3-53r7

Release Date: 2023-06-22

Fix Resolution: word-wrap - 1.2.4

CVE-2022-25883

Vulnerable Libraries - semver-7.3.5.tgz, semver-5.7.1.tgz, semver-7.3.7.tgz, semver-7.3.8.tgz, semver-6.3.0.tgz

semver-7.3.5.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-7.3.5.tgz

Dependency Hierarchy:

  • firebase-tools-11.24.0.tgz (Root Library)
    • exegesis-4.1.0.tgz
      • ❌ semver-7.3.5.tgz (Vulnerable Library)

semver-5.7.1.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-5.7.1.tgz

Dependency Hierarchy:

  • firebase-tools-11.24.0.tgz (Root Library)
    • ❌ semver-5.7.1.tgz (Vulnerable Library)

semver-7.3.7.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-7.3.7.tgz

Dependency Hierarchy:

  • firebase-tools-11.24.0.tgz (Root Library)
    • superstatic-9.0.3.tgz
      • re2-1.17.7.tgz
        • node-gyp-9.1.0.tgz
          • ❌ semver-7.3.7.tgz (Vulnerable Library)

semver-7.3.8.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-7.3.8.tgz

Dependency Hierarchy:

  • firebase-tools-11.24.0.tgz (Root Library)
    • jsonwebtoken-9.0.0.tgz
      • ❌ semver-7.3.8.tgz (Vulnerable Library)

semver-6.3.0.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-6.3.0.tgz

Dependency Hierarchy:

  • firebase-tools-11.24.0.tgz (Root Library)
    • configstore-5.0.1.tgz
      • make-dir-3.1.0.tgz
        • ❌ semver-6.3.0.tgz (Vulnerable Library)

Found in HEAD commit: 84871f913299c03569bde7baed81829733ed9798

Found in base branch: master

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c2qf-rxjj-qqgw

Release Date: 2023-06-21

Fix Resolution: semver - 5.7.2,6.3.1,7.5.2;org.webjars.npm:semver:7.5.2

CVE-2023-28155

Vulnerable Library - request-2.88.2.tgz

Simplified HTTP request client.

Library home page: https://registry.npmjs.org/request/-/request-2.88.2.tgz

Dependency Hierarchy:

  • firebase-tools-11.24.0.tgz (Root Library)
    • ❌ request-2.88.2.tgz (Vulnerable Library)

Found in HEAD commit: 84871f913299c03569bde7baed81829733ed9798

Found in base branch: master

Vulnerability Details

** UNSUPPORTED WHEN ASSIGNED ** The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Publish Date: 2023-03-16

URL: CVE-2023-28155

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

CVE-2023-32313

Vulnerable Library - vm2-3.9.15.tgz

Library home page: https://registry.npmjs.org/vm2/-/vm2-3.9.15.tgz

Dependency Hierarchy:

  • firebase-tools-11.24.0.tgz (Root Library)
    • proxy-agent-5.0.0.tgz
      • pac-proxy-agent-5.0.0.tgz
        • pac-resolver-5.0.0.tgz
          • degenerator-3.0.1.tgz
            • ❌ vm2-3.9.15.tgz (Vulnerable Library)

Found in HEAD commit: 84871f913299c03569bde7baed81829733ed9798

Found in base branch: master

Vulnerability Details

vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node inspect method and edit options for console.log. As a result a threat actor can edit options for the console.log command. This vulnerability was patched in the release of version 3.9.18 of vm2. Users are advised to upgrade. Users unable to upgrade may make the inspect method readonly with vm.readonly(inspect) after creating a vm.

Publish Date: 2023-05-15

URL: CVE-2023-32313

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-32313

Release Date: 2023-05-15

Fix Resolution (vm2): 3.9.18

Direct dependency fix Resolution (firebase-tools): 11.24.1
@mend-for-github-com mend-for-github-com bot added the Mend: dependency security vulnerability Security vulnerability detected by Mend label Jul 9, 2023
@mend-for-github-com mend-for-github-com bot mentioned this issue Jul 9, 2023
Closed
1 task
@mend-for-github-com mend-for-github-com bot changed the title firebase-tools-11.24.0.tgz: 8 vulnerabilities (highest severity is: 10.0) firebase-tools-11.24.0.tgz: 11 vulnerabilities (highest severity is: 10.0) Jul 27, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend
Milestone
No milestone
Development

No branches or pull requests
0 participants