Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVE-2021-43138 (High) detected in multiple libraries #1440

Closed
mend-for-github.aaakk.us.kg bot opened this issue Apr 9, 2022 · 0 comments · Fixed by #1449
Closed

CVE-2021-43138 (High) detected in multiple libraries #1440

mend-for-github.aaakk.us.kg bot opened this issue Apr 9, 2022 · 0 comments · Fixed by #1449
Assignees
@tmarkley
Labels
cve Security vulnerabilities detected by Dependabot or Mend high severity High severity CVE Mend: dependency security vulnerability Security vulnerability detected by Mend v2.0.0

Comments

@mend-for-github.aaakk.us.kg
Copy link

mend-for-github.aaakk.us.kg bot commented Apr 9, 2022 •
edited
Loading

CVE-2021-43138 - High Severity Vulnerability

Vulnerable Libraries - async-1.5.2.tgz, async-0.9.2.tgz, async-2.6.3.tgz

async-1.5.2.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-1.5.2.tgz

Dependency Hierarchy:

  • makelogs-6.1.0.tgz (Root Library)
    • ❌ async-1.5.2.tgz (Vulnerable Library)
async-0.9.2.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-0.9.2.tgz

Dependency Hierarchy:

  • @osd/plugin-generator-1.0.0.tgz (Root Library)
    • ejs-3.1.6.tgz
      • jake-10.8.4.tgz
        • ❌ async-0.9.2.tgz (Vulnerable Library)
async-2.6.3.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-2.6.3.tgz

Dependency Hierarchy:

  • grunt-contrib-watch-1.1.0.tgz (Root Library)
    • ❌ async-2.6.3.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A vulnerability exists in Async through 3.2.1 (fixed in 3.2.2) , which could let a malicious user obtain privileges via the mapValues() method.

Publish Date: 2022-04-06

URL: CVE-2021-43138

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138

Release Date: 2022-04-06

Fix Resolution: async - v3.2.2
@mend-for-github.aaakk.us.kg mend-for-github.aaakk.us.kg bot added the Mend: dependency security vulnerability Security vulnerability detected by Mend label Apr 9, 2022
@tmarkley tmarkley added high severity High severity CVE cve Security vulnerabilities detected by Dependabot or Mend labels Apr 11, 2022
@tmarkley tmarkley self-assigned this Apr 11, 2022
@tmarkley tmarkley mentioned this issue Apr 13, 2022
Open
tmarkley pushed a commit to tmarkley/OpenSearch-Dashboards that referenced this issue Apr 13, 2022
Resolves async to v3.2.3
434f17b 
* Resolves older versions: v0.9.2, v1.5.2, v2.6.3
  * There are known breaking changes, so this manual resolution carries
    some risk.
  * [CHANGELOG](https://github.com/caolan/async/blob/v3.2.3/CHANGELOG.md)
* Addresses CVE-2021-43138.
* This requires a manual resolution because `@elastic/[email protected]`,
  `[email protected]`, `[email protected]`, and
  `[email protected]` have downstream dependencies on older
  versions of `async` and none of them have newer versions to fix this.
* Bumps `getos` from v3.1.0 to v3.2.1.
* Bumps `@elastic/makelogs` from v6.0.0 to v6.1.0.
* Bumps `archiver` from v3.1.1 to v5.3.0 and `@types/archiver` from
  v3.1.0 to v5.3.1.
  * Used in the build script, which runs successfully.
  * Breaking changes include removing support for older versions of
    Node.js as well as no longer supporting absolute path glob patterns,
    which are not used in our repository.
  * [CHANGELOG](https://github.com/archiverjs/node-archiver/blob/5.3.0/CHANGELOG.md)
* Bumps `webpack-dev-server` from v4.7.4 to v4.8.1.
* Removes `grunt-contrib-watch` dependency since it is unused.
* Removes unnecessary `@types/react` resolution.

Resolves opensearch-project#1440

Signed-off-by: Tommy Markley <[email protected]>
@tmarkley tmarkley mentioned this issue Apr 13, 2022
Merged
7 tasks
tmarkley pushed a commit to tmarkley/OpenSearch-Dashboards that referenced this issue Apr 13, 2022
Resolves async to v3.2.3
831c0a1 
* Resolves older versions: v0.9.2, v1.5.2, v2.6.3
  * There are known breaking changes, so this manual resolution carries
    some risk.
  * [CHANGELOG](https://github.com/caolan/async/blob/v3.2.3/CHANGELOG.md)
* Addresses CVE-2021-43138.
* This requires a manual resolution because `@elastic/[email protected]`,
  `[email protected]`, `[email protected]`, and
  `[email protected]` have downstream dependencies on older
  versions of `async` and none of them have newer versions to fix this.
* Bumps `getos` from v3.1.0 to v3.2.1.
* Bumps `@elastic/makelogs` from v6.0.0 to v6.1.0.
* Bumps `archiver` from v3.1.1 to v5.3.0 and `@types/archiver` from
  v3.1.0 to v5.3.1.
  * Used in the build script, which runs successfully.
  * Breaking changes include removing support for older versions of
    Node.js as well as no longer supporting absolute path glob patterns,
    which are not used in our repository.
  * [CHANGELOG](https://github.com/archiverjs/node-archiver/blob/5.3.0/CHANGELOG.md)
* Bumps `webpack-dev-server` from v4.7.4 to v4.8.1.
* Removes `grunt-contrib-watch` dependency since it is unused.
* Removes unnecessary `@types/react` resolution.

Resolves opensearch-project#1440

Signed-off-by: Tommy Markley <[email protected]>
tmarkley pushed a commit that referenced this issue Apr 15, 2022
Resolves async to v3.2.3 (#1449)
b854a13 
* Resolves older versions: v0.9.2, v1.5.2, v2.6.3
  * There are known breaking changes, so this manual resolution carries
    some risk.
  * [CHANGELOG](https://github.com/caolan/async/blob/v3.2.3/CHANGELOG.md)
* Addresses CVE-2021-43138.
* This requires a manual resolution because `@elastic/[email protected]`,
  `[email protected]`, `[email protected]`, and
  `[email protected]` have downstream dependencies on older
  versions of `async` and none of them have newer versions to fix this.
* Bumps `getos` from v3.1.0 to v3.2.1.
* Bumps `@elastic/makelogs` from v6.0.0 to v6.1.0.
* Bumps `archiver` from v3.1.1 to v5.3.0 and `@types/archiver` from
  v3.1.0 to v5.3.1.
  * Used in the build script, which runs successfully.
  * Breaking changes include removing support for older versions of
    Node.js as well as no longer supporting absolute path glob patterns,
    which are not used in our repository.
  * [CHANGELOG](https://github.com/archiverjs/node-archiver/blob/5.3.0/CHANGELOG.md)
* Bumps `webpack-dev-server` from v4.7.4 to v4.8.1.
* Removes `grunt-contrib-watch` dependency since it is unused.
* Removes unnecessary `@types/react` resolution.

Resolves #1440

Signed-off-by: Tommy Markley <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@tmarkley tmarkley

Labels
cve Security vulnerabilities detected by Dependabot or Mend high severity High severity CVE Mend: dependency security vulnerability Security vulnerability detected by Mend v2.0.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Resolves async to v3.2.3 tmarkley/OpenSearch-Dashboards
1 participant
@tmarkley