Skip to content

Commit 0778fa4

Browse files
valentijnscholtenvalentijnscholten
committed
temp
1 parent be2a442 commit 0778fa4

1 file changed

Lines changed: 387 additions & 0 deletions

File tree

‎unittests/scans/npm_audit/many_vuln_with_groups_different_titles.json‎

Lines changed: 387 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,387 @@
1+
{
2+
"actions": [
3+
{
4+
"action": "install",
5+
"module": "express",
6+
"target": "4.16.3",
7+
"isMajor": false,
8+
"resolves": [
9+
{
10+
"id": 534,
11+
"path": "express>debug",
12+
"dev": false,
13+
"optional": false,
14+
"bundled": false
15+
},
16+
{
17+
"id": 534,
18+
"path": "express>finalhandler>debug",
19+
"dev": false,
20+
"optional": false,
21+
"bundled": false
22+
},
23+
{
24+
"id": 534,
25+
"path": "express>send>debug",
26+
"dev": false,
27+
"optional": false,
28+
"bundled": false
29+
},
30+
{
31+
"id": 534,
32+
"path": "express>serve-static>send>debug",
33+
"dev": false,
34+
"optional": false,
35+
"bundled": false
36+
},
37+
{
38+
"id": 106,
39+
"path": "express>accepts>negotiator",
40+
"dev": false,
41+
"optional": false,
42+
"bundled": false
43+
},
44+
{
45+
"id": 526,
46+
"path": "express>fresh",
47+
"dev": false,
48+
"optional": false,
49+
"bundled": false
50+
},
51+
{
52+
"id": 526,
53+
"path": "express>send>fresh",
54+
"dev": false,
55+
"optional": false,
56+
"bundled": false
57+
},
58+
{
59+
"id": 526,
60+
"path": "express>serve-static>send>fresh",
61+
"dev": false,
62+
"optional": false,
63+
"bundled": false
64+
},
65+
{
66+
"id": 535,
67+
"path": "express>send>mime",
68+
"dev": false,
69+
"optional": false,
70+
"bundled": false
71+
},
72+
{
73+
"id": 535,
74+
"path": "express>serve-static>send>mime",
75+
"dev": false,
76+
"optional": false,
77+
"bundled": false
78+
}
79+
]
80+
},
81+
{
82+
"action": "install",
83+
"module": "serve-favicon",
84+
"target": "2.5.0",
85+
"isMajor": false,
86+
"resolves": [
87+
{
88+
"id": 526,
89+
"path": "serve-favicon>fresh",
90+
"dev": false,
91+
"optional": false,
92+
"bundled": false
93+
}
94+
]
95+
},
96+
{
97+
"action": "install",
98+
"module": "pg-promise",
99+
"target": "8.4.5",
100+
"isMajor": true,
101+
"resolves": [
102+
{
103+
"id": 521,
104+
"path": "pg-promise>pg",
105+
"dev": false,
106+
"optional": false,
107+
"bundled": false
108+
}
109+
]
110+
},
111+
{
112+
"action": "install",
113+
"module": "body-parser",
114+
"target": "1.18.3",
115+
"isMajor": false,
116+
"resolves": [
117+
{
118+
"id": 534,
119+
"path": "body-parser>debug",
120+
"dev": false,
121+
"optional": false,
122+
"bundled": false
123+
}
124+
]
125+
},
126+
{
127+
"action": "install",
128+
"module": "debug",
129+
"target": "3.1.0",
130+
"isMajor": true,
131+
"resolves": [
132+
{
133+
"id": 534,
134+
"path": "debug",
135+
"dev": false,
136+
"optional": false,
137+
"bundled": false
138+
}
139+
]
140+
},
141+
{
142+
"action": "install",
143+
"module": "morgan",
144+
"target": "1.9.0",
145+
"isMajor": false,
146+
"resolves": [
147+
{
148+
"id": 534,
149+
"path": "morgan>debug",
150+
"dev": false,
151+
"optional": false,
152+
"bundled": false
153+
}
154+
]
155+
}
156+
],
157+
"advisories": {
158+
"106": {
159+
"findings": [
160+
{
161+
"version": "0.5.3",
162+
"paths": [
163+
"express>accepts>negotiator"
164+
],
165+
"dev": false,
166+
"optional": false,
167+
"bundled": false
168+
}
169+
],
170+
"id": 106,
171+
"created": "2016-05-04T16:34:12.000Z",
172+
"updated": "2018-04-17T12:58:40.142Z",
173+
"deleted": null,
174+
"title": "Regular Expression Denial of Service Different Title",
175+
"found_by": {
176+
"name": "Adam Baldwin"
177+
},
178+
"reported_by": {
179+
"name": "Adam Baldwin"
180+
},
181+
"module_name": "negotiator",
182+
"cves": [
183+
"CVE-2016-10539"
184+
],
185+
"vulnerable_versions": "<= 0.6.0",
186+
"patched_versions": ">= 0.6.1",
187+
"overview": "Affected versions of `negotiator` are vulnerable to regular expression denial of service attacks, which trigger upon parsing a specially crafted `Accept-Language` header value.\n\n",
188+
"recommendation": "Update to version 0.6.1 or later.",
189+
"references": "",
190+
"access": "public",
191+
"severity": "moderate",
192+
"cwe": "CWE-400",
193+
"metadata": {
194+
"module_type": "Network.Library",
195+
"exploitability": 6,
196+
"affected_components": "Internal::Code::Function::acceptsLanguages()"
197+
},
198+
"url": "https://nodesecurity.io/advisories/106"
199+
},
200+
"107": {
201+
"findings": [
202+
{
203+
"version": "0.5.3",
204+
"paths": [
205+
"express>accepts>negotiator"
206+
],
207+
"dev": false,
208+
"optional": false,
209+
"bundled": false
210+
}
211+
],
212+
"id": 107,
213+
"created": "2016-05-04T16:34:12.000Z",
214+
"updated": "2018-04-17T12:58:40.142Z",
215+
"deleted": null,
216+
"title": "2222Regular Expression Denial of Service Different Title",
217+
"found_by": {
218+
"name": "Adam Baldwin"
219+
},
220+
"reported_by": {
221+
"name": "Adam Baldwin"
222+
},
223+
"module_name": "negotiator",
224+
"cves": [
225+
"CVE-2019-10321"
226+
],
227+
"vulnerable_versions": "<= 0.6.0",
228+
"patched_versions": ">= 0.6.1",
229+
"overview": "Affected versions of `negotiator` are vulnerable to regular expression denial of service attacks, which trigger upon parsing a specially crafted `Accept-Language` header value.\n\n",
230+
"recommendation": "Update to version 0.6.1 or later.",
231+
"references": "",
232+
"access": "public",
233+
"severity": "high",
234+
"cwe": "CWE-300",
235+
"metadata": {
236+
"module_type": "Network.Library",
237+
"exploitability": 6,
238+
"affected_components": "Internal::Code::Function::acceptsLanguages()"
239+
},
240+
"url": "https://nodesecurity.io/advisories/107"
241+
},
242+
"521": {
243+
"findings": [
244+
{
245+
"version": "5.1.0",
246+
"paths": [
247+
"pg-promise>pg"
248+
],
249+
"dev": false,
250+
"optional": false,
251+
"bundled": false
252+
}
253+
],
254+
"id": 521,
255+
"created": "2017-08-13T04:26:17.960Z",
256+
"updated": "2018-04-08T22:40:41.503Z",
257+
"deleted": null,
258+
"title": "Remote Code Execution Different Title",
259+
"found_by": {
260+
"name": "Sehrope Sarkuni"
261+
},
262+
"reported_by": {
263+
"name": "Sehrope Sarkuni"
264+
},
265+
"module_name": "pg",
266+
"cves": [
267+
"CVE-2017-16082"
268+
],
269+
"vulnerable_versions": "< 2.11.2 || >= 3.0.0 < 3.6.4 || >= 4.0.0 < 4.5.7 || >= 5.0.0 < 5.2.1 || >= 6.0.0 < 6.0.5 || >= 6.1.0 < 6.1.6 || >= 6.2.0 < 6.2.5 || >= 6.3.0 < 6.3.3 || >= 6.4.0 < 6.4.2 || >= 7.0.0 < 7.0.2 || >= 7.1.0 < 7.1.2",
270+
"patched_versions": ">= 2.11.2 < 3.0.0|| >= 3.6.4 < 4.0.0 || >= 4.5.7 < 5.0.0 || >= 5.2.1 < 6.0.0 || >= 6.0.5 < 6.1.0 || >= 6.1.6 < 6.2.0 || >= 6.2.5 < 6.3.0 || >= 6.3.3 < 6.4.0 || >= 6.4.2 < 7.0.0 || >= 7.0.2 < 7.1.0 || >= 7.1.2",
271+
"overview": "Affected versions of `pg` contain a remote code execution vulnerability that occurs when the remote database or query specifies a crafted column name. \n\nThere are two specific scenarios in which it is likely for an application to be vulnerable:\n1. The application executes unsafe, user-supplied sql which contains malicious column names.\n2. The application connects to an untrusted database and executes a query returning results which contain a malicious column name.\n\n## Proof of Concept\n```\nconst { Client } = require('pg')\nconst client = new Client()\nclient.connect()\n\nconst sql = `SELECT 1 AS \"\\\\'/*\", 2 AS \"\\\\'*/\\n + console.log(process.env)] = null;\\n//\"`\n\nclient.query(sql, (err, res) => {\n client.end()\n})\n```",
272+
"recommendation": "* Version 2.x.x: Update to version 2.11.2 or later.\n* Version 3.x.x: Update to version 3.6.4 or later.\n* Version 4.x.x: Update to version 4.5.7 or later.\n* Version 5.x.x: Update to version 5.2.1 or later.\n* Version 6.x.x: Update to version 6.4.2 or later. ( Note that versions 6.1.6, 6.2.5, and 6.3.3 are also patched. )\n* Version 7.x.x: Update to version 7.1.2 or later. ( Note that version 7.0.2 is also patched. )",
273+
"references": "[Node Postgres: Code Execution Vulnerability Announcement](https://node-postgres.com/announcements#2017-08-12-code-execution-vulnerability)",
274+
"access": "public",
275+
"severity": "high",
276+
"cwe": "CWE-94",
277+
"metadata": {
278+
"module_type": "Network.Library",
279+
"exploitability": 5,
280+
"affected_components": ""
281+
},
282+
"url": "https://nodesecurity.io/advisories/521"
283+
},
284+
"526": {
285+
"findings": [
286+
{
287+
"version": "0.3.0",
288+
"paths": [
289+
"express>fresh",
290+
"express>send>fresh",
291+
"express>serve-static>send>fresh",
292+
"serve-favicon>fresh"
293+
],
294+
"dev": false,
295+
"optional": false,
296+
"bundled": false
297+
}
298+
],
299+
"id": 526,
300+
"created": "2017-09-08T20:23:54.164Z",
301+
"updated": "2018-04-09T00:15:21.807Z",
302+
"deleted": null,
303+
"title": "Regular Expression Denial of Service Different Title",
304+
"found_by": {
305+
"name": "Cristian-Alexandru Staicu"
306+
},
307+
"reported_by": {
308+
"name": "Cristian-Alexandru Staicu"
309+
},
310+
"module_name": "fresh",
311+
"cves": [
312+
"CVE-2017-16119"
313+
],
314+
"vulnerable_versions": "< 0.5.2",
315+
"patched_versions": ">= 0.5.2",
316+
"overview": "Affected versions of `fresh` are vulnerable to regular expression denial of service when parsing specially crafted user input.",
317+
"recommendation": "Update to version 0.5.2 or later.",
318+
"references": "",
319+
"access": "public",
320+
"severity": "moderate",
321+
"cwe": "CWE-400",
322+
"metadata": {
323+
"module_type": "Multi.Library",
324+
"exploitability": 5,
325+
"affected_components": ""
326+
},
327+
"url": "https://nodesecurity.io/advisories/526"
328+
},
329+
"522": {
330+
"findings": [
331+
{
332+
"version": "5.1.0",
333+
"paths": [
334+
"pg-promise>pg"
335+
],
336+
"dev": false,
337+
"optional": false,
338+
"bundled": false
339+
}
340+
],
341+
"id": 522,
342+
"created": "2017-08-13T04:26:17.960Z",
343+
"updated": "2018-04-08T22:40:41.503Z",
344+
"deleted": null,
345+
"title": "2222Remote Code Execution Different Title",
346+
"found_by": {
347+
"name": "Sehrope Sarkuni"
348+
},
349+
"reported_by": {
350+
"name": "Sehrope Sarkuni"
351+
},
352+
"module_name": "pg",
353+
"cves": [
354+
"CVE-2019-16082"
355+
],
356+
"vulnerable_versions": "< 2.11.2 || >= 3.0.0 < 3.6.4 || >= 4.0.0 < 4.5.7 || >= 5.0.0 < 5.2.1 || >= 6.0.0 < 6.0.5 || >= 6.1.0 < 6.1.6 || >= 6.2.0 < 6.2.5 || >= 6.3.0 < 6.3.3 || >= 6.4.0 < 6.4.2 || >= 7.0.0 < 7.0.2 || >= 7.1.0 < 7.1.2",
357+
"patched_versions": ">= 2.11.2 < 3.0.0|| >= 3.6.4 < 4.0.0 || >= 4.5.7 < 5.0.0 || >= 5.2.1 < 6.0.0 || >= 6.0.5 < 6.1.0 || >= 6.1.6 < 6.2.0 || >= 6.2.5 < 6.3.0 || >= 6.3.3 < 6.4.0 || >= 6.4.2 < 7.0.0 || >= 7.0.2 < 7.1.0 || >= 7.1.2",
358+
"overview": "Affected versions of `pg` contain a remote code execution vulnerability that occurs when the remote database or query specifies a crafted column name. \n\nThere are two specific scenarios in which it is likely for an application to be vulnerable:\n1. The application executes unsafe, user-supplied sql which contains malicious column names.\n2. The application connects to an untrusted database and executes a query returning results which contain a malicious column name.\n\n## Proof of Concept\n```\nconst { Client } = require('pg')\nconst client = new Client()\nclient.connect()\n\nconst sql = `SELECT 1 AS \"\\\\'/*\", 2 AS \"\\\\'*/\\n + console.log(process.env)] = null;\\n//\"`\n\nclient.query(sql, (err, res) => {\n client.end()\n})\n```",
359+
"recommendation": "* Version 2.x.x: Update to version 2.11.2 or later.\n* Version 3.x.x: Update to version 3.6.4 or later.\n* Version 4.x.x: Update to version 4.5.7 or later.\n* Version 5.x.x: Update to version 5.2.1 or later.\n* Version 6.x.x: Update to version 6.4.2 or later. ( Note that versions 6.1.6, 6.2.5, and 6.3.3 are also patched. )\n* Version 7.x.x: Update to version 7.1.2 or later. ( Note that version 7.0.2 is also patched. )",
360+
"references": "[Node Postgres: Code Execution Vulnerability Announcement](https://node-postgres.com/announcements#2017-08-12-code-execution-vulnerability)",
361+
"access": "public",
362+
"severity": "moderate",
363+
"cwe": "CWE-94",
364+
"metadata": {
365+
"module_type": "Network.Library",
366+
"exploitability": 5,
367+
"affected_components": ""
368+
},
369+
"url": "https://nodesecurity.io/advisories/522"
370+
}
371+
},
372+
"muted": [],
373+
"metadata": {
374+
"vulnerabilities": {
375+
"info": 0,
376+
"low": 7,
377+
"moderate": 2,
378+
"high": 6,
379+
"critical": 0
380+
},
381+
"dependencies": 159,
382+
"devDependencies": 0,
383+
"optionalDependencies": 0,
384+
"totalDependencies": 159
385+
},
386+
"runId": "849ed1f1-5dd8-4fda-872a-05cd46957c82"
387+
}

0 commit comments

Comments
 (0)