[Snyk] Security upgrade npmconf from 0.0.24 to 2.1.3 #19

tedlassodevops · 2024-02-02T18:09:22Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json
- package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Priority Score (*)	Issue	Breaking Change	Exploit Maturity
686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-INI-1048974	Yes	Proof of Concept
756/1000 Why? Mature exploit, Has a fix available, CVSS 7.4	Uninitialized Memory Exposure npm:npmconf:20180512	Yes	Mature
479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) npm:semver:20150403	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Regular Expression Denial of Service (ReDoS)

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-INI-1048974 - https://snyk.io/vuln/npm:npmconf:20180512 - https://snyk.io/vuln/npm:semver:20150403

prisma-cloud-devsecops · 2024-02-02T18:10:46Z

package.json

@@ -40,7 +40,7 @@
    "morgan": "latest",
    "ms": "^0.7.1",
    "mysql": "^2.18.1",
-    "npmconf": "0.0.24",
+    "npmconf": "2.1.3",
    "optional": "^0.1.3",
    "st": "0.2.4",


st 0.2.4 / package.json

Total vulnerabilities: 3

Critical: 0 High: 2 Medium: 1 Low: 0

Vulnerability ID Severity CVSS Fixed in Status

CVE-2016-10539 HIGH 7.5 - Open

CVE-2017-16138 HIGH 7.5 - Open

CVE-2017-16224 MEDIUM 6.1 - Open

prisma-cloud-devsecops · 2024-02-02T18:10:49Z

package.json

@@ -40,7 +40,7 @@
    "morgan": "latest",
    "ms": "^0.7.1",
    "mysql": "^2.18.1",
-    "npmconf": "0.0.24",
+    "npmconf": "2.1.3",


npmconf 2.1.3 / package.json

Total vulnerabilities: 1

Critical: 0 High: 1 Medium: 0 Low: 0

Vulnerability ID Severity CVSS Fixed in Status

CVE-2022-25883 HIGH 7.5 - Open

prisma-cloud-devsecops · 2024-02-02T18:10:54Z

package.json

@@ -40,7 +40,7 @@
    "morgan": "latest",
    "ms": "^0.7.1",
    "mysql": "^2.18.1",
-    "npmconf": "0.0.24",
+    "npmconf": "2.1.3",


ms 0.7.3 / package.json

Total vulnerabilities: 1

Critical: 0 High: 0 Medium: 1 Low: 0

Vulnerability ID Severity CVSS Fixed in Status

CVE-2017-20162 MEDIUM 5.3 2.0.0 Open

prisma-cloud-devsecops · 2024-02-02T18:10:58Z

package.json

@@ -40,7 +40,7 @@
    "morgan": "latest",
    "ms": "^0.7.1",
    "mysql": "^2.18.1",
-    "npmconf": "0.0.24",
+    "npmconf": "2.1.3",


bytes 1.0.0 / package.json

Unknown License (NOT_FOUND)

This package use a non-SPDX, unrecognized, or private open-source license. Ensure this package is compliant.

prisma-cloud-devsecops · 2024-02-02T18:10:59Z

package.json

@@ -40,7 +40,7 @@
    "morgan": "latest",
    "ms": "^0.7.1",
    "mysql": "^2.18.1",
-    "npmconf": "0.0.24",
+    "npmconf": "2.1.3",


cookie 0.1.2 / package.json

Unknown License (NOT_FOUND)

This package use a non-SPDX, unrecognized, or private open-source license. Ensure this package is compliant.

prisma-cloud-devsecops · 2024-02-02T18:11:00Z

package.json

@@ -40,7 +40,7 @@
    "morgan": "latest",
    "ms": "^0.7.1",
    "mysql": "^2.18.1",
-    "npmconf": "0.0.24",
+    "npmconf": "2.1.3",


ejs 1.0.0 / package.json

Unknown License (NOT_FOUND)

This package use a non-SPDX, unrecognized, or private open-source license. Ensure this package is compliant.

prisma-cloud-devsecops · 2024-02-02T18:11:00Z

package.json

@@ -40,7 +40,7 @@
    "morgan": "latest",
    "ms": "^0.7.1",
    "mysql": "^2.18.1",
-    "npmconf": "0.0.24",
+    "npmconf": "2.1.3",


ejs-locals 1.0.2 / package.json

Unknown License (NOT_FOUND)

This package use a non-SPDX, unrecognized, or private open-source license. Ensure this package is compliant.

prisma-cloud-devsecops · 2024-02-02T18:11:01Z

package.json

@@ -40,7 +40,7 @@
    "morgan": "latest",
    "ms": "^0.7.1",
    "mysql": "^2.18.1",
-    "npmconf": "0.0.24",
+    "npmconf": "2.1.3",


ejs 0.8.8 / package.json

Unknown License (NOT_FOUND)

This package use a non-SPDX, unrecognized, or private open-source license. Ensure this package is compliant.

prisma-cloud-devsecops · 2024-02-02T18:11:02Z

package.json

@@ -40,7 +40,7 @@
    "morgan": "latest",
    "ms": "^0.7.1",
    "mysql": "^2.18.1",
-    "npmconf": "0.0.24",
+    "npmconf": "2.1.3",


escape-html 1.0.1 / package.json

Unknown License (NOT_FOUND)

This package use a non-SPDX, unrecognized, or private open-source license. Ensure this package is compliant.

prisma-cloud-devsecops · 2024-02-02T18:11:02Z

package.json

@@ -40,7 +40,7 @@
    "morgan": "latest",
    "ms": "^0.7.1",
    "mysql": "^2.18.1",
-    "npmconf": "0.0.24",
+    "npmconf": "2.1.3",


ms 0.7.1 / package.json

Unknown License (NOT_FOUND)

This package use a non-SPDX, unrecognized, or private open-source license. Ensure this package is compliant.

prisma-cloud-devsecops · 2024-02-02T18:11:03Z

package.json

@@ -40,7 +40,7 @@
    "morgan": "latest",
    "ms": "^0.7.1",
    "mysql": "^2.18.1",
-    "npmconf": "0.0.24",
+    "npmconf": "2.1.3",


foreachasync 3.0.0 / package.json

Unknown License (NOT_FOUND)

This package use a non-SPDX, unrecognized, or private open-source license. Ensure this package is compliant.

prisma-cloud-devsecops · 2024-02-02T18:11:04Z

package.json

@@ -40,7 +40,7 @@
    "morgan": "latest",
    "ms": "^0.7.1",
    "mysql": "^2.18.1",
-    "npmconf": "0.0.24",
+    "npmconf": "2.1.3",


kareem 1.0.1 / package.json

Unknown License (NOT_FOUND)

This package use a non-SPDX, unrecognized, or private open-source license. Ensure this package is compliant.

prisma-cloud-devsecops · 2024-02-02T18:11:05Z

package.json

@@ -40,7 +40,7 @@
    "morgan": "latest",
    "ms": "^0.7.1",
    "mysql": "^2.18.1",
-    "npmconf": "0.0.24",
+    "npmconf": "2.1.3",


hooks-fixed 1.1.0 / package.json

Unknown License (NOT_FOUND)

This package use a non-SPDX, unrecognized, or private open-source license. Ensure this package is compliant.

prisma-cloud-devsecops · 2024-02-02T18:11:05Z

package.json

@@ -40,7 +40,7 @@
    "morgan": "latest",
    "ms": "^0.7.1",
    "mysql": "^2.18.1",
-    "npmconf": "0.0.24",
+    "npmconf": "2.1.3",


ms 0.6.2 / package.json

Unknown License (NOT_FOUND)

This package use a non-SPDX, unrecognized, or private open-source license. Ensure this package is compliant.

fix: package.json & package-lock.json to reduce vulnerabilities

9262555

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-INI-1048974 - https://snyk.io/vuln/npm:npmconf:20180512 - https://snyk.io/vuln/npm:semver:20150403

prisma-cloud-devsecops bot reviewed Feb 2, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Snyk] Security upgrade npmconf from 0.0.24 to 2.1.3 #19

[Snyk] Security upgrade npmconf from 0.0.24 to 2.1.3 #19

Uh oh!

tedlassodevops commented Feb 2, 2024

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Uh oh!

Uh oh!

Vulnerability ID	Severity	CVSS	Fixed in	Status
CVE-2016-10539	HIGH	7.5	`-`	Open
CVE-2017-16138	HIGH	7.5	`-`	Open
CVE-2017-16224	MEDIUM	6.1	`-`	Open

[Snyk] Security upgrade npmconf from 0.0.24 to 2.1.3 #19

Are you sure you want to change the base?

[Snyk] Security upgrade npmconf from 0.0.24 to 2.1.3 #19

Uh oh!

Conversation

tedlassodevops commented Feb 2, 2024

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Choose a reason for hiding this comment

st 0.2.4 / package.json

Total vulnerabilities: 3

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Choose a reason for hiding this comment

npmconf 2.1.3 / package.json

Total vulnerabilities: 1

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Choose a reason for hiding this comment

ms 0.7.3 / package.json

Total vulnerabilities: 1

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Choose a reason for hiding this comment

bytes 1.0.0 / package.json

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Choose a reason for hiding this comment

cookie 0.1.2 / package.json

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Choose a reason for hiding this comment

ejs 1.0.0 / package.json

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Choose a reason for hiding this comment

ejs-locals 1.0.2 / package.json

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Choose a reason for hiding this comment

ejs 0.8.8 / package.json

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Choose a reason for hiding this comment

escape-html 1.0.1 / package.json

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Choose a reason for hiding this comment

ms 0.7.1 / package.json

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Choose a reason for hiding this comment

foreachasync 3.0.0 / package.json

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Choose a reason for hiding this comment

kareem 1.0.1 / package.json

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Choose a reason for hiding this comment

hooks-fixed 1.1.0 / package.json

Uh oh!

prisma-cloud-devsecops bot Feb 2, 2024

Choose a reason for hiding this comment

ms 0.6.2 / package.json

Uh oh!

Uh oh!