Expressjs 4.17.3

[tadashi0713]

No description provided.

[github-actions]

🔍 Vulnerabilities of tadashi/docker-scout-demo:a5e8df13a13f1fe7eb17d9a87723dfb156c05339

📦 Image Reference tadashi/docker-scout-demo:a5e8df13a13f1fe7eb17d9a87723dfb156c05339

digest	sha256:46c74311c7084c2e857b319c1a49fa1e58a3236f5b2215a5136263b0beb491e4
vulnerabilities
size	22 MB
packages	79

📦 Base Image alpine:3

also known as	3.14 3.14.1 latest
digest	sha256:be9bdc0ef8e96dbc428dc189b31e2e3b05523d96d12ed627c37aa2936653258c
vulnerabilities

openssl 1.1.1k-r0 (apk) pkg:apk/alpine/[email protected]?os_name=alpine&os_version=3.14 Affected range <1.1.1l-r0 Fixed version 1.1.1l-r0 EPSS Score 6.79% EPSS Percentile 94th percentile Description Affected range <1.1.1t-r1 Fixed version 1.1.1t-r1 EPSS Score 0.51% EPSS Percentile 77th percentile Description Affected range <1.1.1n-r0 Fixed version 1.1.1n-r0 EPSS Score 1.58% EPSS Percentile 88th percentile Description Affected range <1.1.1l-r0 Fixed version 1.1.1l-r0 EPSS Score 0.49% EPSS Percentile 77th percentile Description Affected range <1.1.1t-r0 Fixed version 1.1.1t-r0 EPSS Score 0.39% EPSS Percentile 74th percentile Description There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network. OpenSSL versions 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue. OpenSSL 3.0 users should upgrade to OpenSSL 3.0.8. OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1t. OpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zg (premium support customers only). This issue was reported on 11th January 2023 by David Benjamin (Google). The fix was developed by Hugo Landau.

zlib 1.2.11-r3 (apk) pkg:apk/alpine/[email protected]?os_name=alpine&os_version=3.14 Affected range <1.2.12-r2 Fixed version 1.2.12-r2 EPSS Score 0.34% EPSS Percentile 72nd percentile Description Affected range <1.2.12-r0 Fixed version 1.2.12-r0 EPSS Score 0.34% EPSS Percentile 72nd percentile Description

busybox 1.33.1-r3 (apk) pkg:apk/alpine/[email protected]?os_name=alpine&os_version=3.14 Affected range <1.33.1-r7 Fixed version 1.33.1-r7 EPSS Score 1.30% EPSS Percentile 86th percentile Description Affected range <1.33.1-r6 Fixed version 1.33.1-r6 EPSS Score 0.24% EPSS Percentile 62nd percentile Description Affected range <1.33.1-r6 Fixed version 1.33.1-r6 EPSS Score 0.24% EPSS Percentile 62nd percentile Description Affected range <1.33.1-r6 Fixed version 1.33.1-r6 EPSS Score 0.24% EPSS Percentile 62nd percentile Description Affected range <1.33.1-r6 Fixed version 1.33.1-r6 EPSS Score 0.24% EPSS Percentile 62nd percentile Description Affected range <1.33.1-r6 Fixed version 1.33.1-r6 EPSS Score 0.24% EPSS Percentile 62nd percentile Description Affected range <1.33.1-r6 Fixed version 1.33.1-r6 EPSS Score 0.24% EPSS Percentile 62nd percentile Description Affected range <1.33.1-r6 Fixed version 1.33.1-r6 EPSS Score 0.24% EPSS Percentile 62nd percentile Description Affected range <1.33.1-r6 Fixed version 1.33.1-r6 EPSS Score 0.24% EPSS Percentile 62nd percentile Description Affected range <1.33.1-r6 Fixed version 1.33.1-r6 EPSS Score 0.24% EPSS Percentile 62nd percentile Description

libretls 3.3.3p1-r2 (apk) pkg:apk/alpine/[email protected]?os_name=alpine&os_version=3.14 Affected range <3.3.3p1-r3 Fixed version 3.3.3p1-r3 EPSS Score 1.58% EPSS Percentile 88th percentile Description

body-parser 1.19.2 (npm) pkg:npm/[email protected] Asymmetric Resource Consumption (Amplification) Affected range <1.20.3 Fixed version 1.20.3 CVSS Score 7.5 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N EPSS Score 0.05% EPSS Percentile 18th percentile Description Impact body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. Patches this issue is patched in 1.20.3 References

path-to-regexp 0.1.7 (npm) pkg:npm/[email protected] Inefficient Regular Expression Complexity Affected range <0.1.10 Fixed version 0.1.10 CVSS Score 7.5 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P EPSS Score 0.04% EPSS Percentile 17th percentile Description Impact A bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b. Patches For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0. These versions add backtrack protection when a custom regex pattern is not provided: 0.1.10 1.9.0 3.3.0 6.3.0 They do not protect against vulnerable user supplied capture groups. Protecting against explicit user patterns is out of scope for old versions and not considered a vulnerability. Version 7.1.0 can enable strict: true and get an error when the regular expression might be bad. Version 8.0.0 removes the features that can cause a ReDoS. Workarounds All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change /:a-:b to /:a-:b([^-/]+). If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length. For example, halving the attack string improves performance by 4x faster. Details Using /:a-:b will produce the regular expression /^\/([^\/]+?)-([^\/]+?)\/?$/. This can be exploited by a path such as /a${'-a'.repeat(8_000)}/a. OWASP has a good example of why this occurs, but the TL;DR is the /a at the end ensures this route would never match but due to naive backtracking it will still attempt every combination of the :a-:b on the repeated 8,000 -a. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and can lead to a DoS. In local benchmarks, exploiting the unsafe regex will result in performance that is over 1000x worse than the safe regex. In a more realistic environment using Express v4 and 10 concurrent connections, this translated to average latency of ~600ms vs 1ms. References OWASP Detailed blog post