Skip to content

commitizen-2.10.1.tgz: 15 vulnerabilities (highest severity is: 9.8) #98

@mend-for-github-com

Description

@mend-for-github-com
Vulnerable Library - commitizen-2.10.1.tgz

Path to dependency file: /justapis-javascript-sdk/package.json

Path to vulnerable library: /node_modules/lodash/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (commitizen version) Remediation Available
CVE-2020-28499 High 9.8 merge-1.2.1.tgz Transitive 4.2.4
CVE-2021-44906 High 9.8 minimist-1.2.0.tgz Transitive 4.2.5
CVE-2019-10744 High 9.1 lodash-4.17.5.tgz Transitive 3.1.2
CVE-2021-3807 High 7.5 ansi-regex-3.0.0.tgz Transitive 3.0.0
CVE-2019-20149 High 7.5 kind-of-6.0.2.tgz Transitive 3.0.0
CVE-2020-28469 High 7.5 glob-parent-2.0.0.tgz Transitive 3.0.6
CVE-2020-8203 High 7.4 lodash-4.17.5.tgz Transitive 3.0.0
CVE-2021-23337 High 7.2 lodash-4.17.5.tgz Transitive 4.1.3
CVE-2022-0144 High 7.1 shelljs-0.7.6.tgz Transitive 4.1.0
CVE-2019-1010266 Medium 6.5 lodash-4.17.5.tgz Transitive 3.0.0
CVE-2022-0235 Medium 6.1 node-fetch-1.6.3.tgz Transitive 3.0.0
CVE-2020-7598 Medium 5.6 minimist-1.2.0.tgz Transitive 4.0.4
CVE-2018-16487 Medium 5.6 lodash-4.17.5.tgz Transitive 3.0.0
CVE-2020-28500 Medium 5.3 lodash-4.17.5.tgz Transitive 4.1.3
CVE-2020-15168 Medium 5.3 node-fetch-1.6.3.tgz Transitive 3.0.0

Details

CVE-2020-28499

Vulnerable Library - merge-1.2.1.tgz

Merge multiple objects into one, optionally creating a new cloned object. Similar to the jQuery.extend but more flexible. Works in Node.js and the browser.

Library home page: https://registry.npmjs.org/merge/-/merge-1.2.1.tgz

Path to dependency file: /justapis-javascript-sdk/package.json

Path to vulnerable library: /node_modules/merge/package.json

Dependency Hierarchy:

  • commitizen-2.10.1.tgz (Root Library)
    • find-node-modules-1.0.4.tgz
      • merge-1.2.1.tgz (Vulnerable Library)

Vulnerability Details

All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge .

Publish Date: 2021-02-18

URL: CVE-2020-28499

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-02-18

Fix Resolution (merge): 2.1.0

Direct dependency fix Resolution (commitizen): 4.2.4

⛑️ Automatic Remediation is available for this issue

CVE-2021-44906

Vulnerable Library - minimist-1.2.0.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz

Path to dependency file: /justapis-javascript-sdk/package.json

Path to vulnerable library: /node_modules/mochify/node_modules/module-deps/node_modules/minimist/package.json

Dependency Hierarchy:

  • commitizen-2.10.1.tgz (Root Library)
    • minimist-1.2.0.tgz (Vulnerable Library)

Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: 2022-03-17

URL: CVE-2021-44906

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-03-17

Fix Resolution (minimist): 1.2.6

Direct dependency fix Resolution (commitizen): 4.2.5

⛑️ Automatic Remediation is available for this issue

CVE-2019-10744

Vulnerable Library - lodash-4.17.5.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.5.tgz

Path to dependency file: /justapis-javascript-sdk/package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • commitizen-2.10.1.tgz (Root Library)
    • lodash-4.17.5.tgz (Vulnerable Library)

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-26

Fix Resolution (lodash): 4.17.12

Direct dependency fix Resolution (commitizen): 3.1.2

⛑️ Automatic Remediation is available for this issue

CVE-2021-3807

Vulnerable Library - ansi-regex-3.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.0.tgz

Path to dependency file: /justapis-javascript-sdk/package.json

Path to vulnerable library: /node_modules/opencollective/node_modules/ansi-regex/package.json

Dependency Hierarchy:

  • commitizen-2.10.1.tgz (Root Library)
    • opencollective-1.0.3.tgz
      • inquirer-3.0.6.tgz
        • string-width-2.1.1.tgz
          • strip-ansi-4.0.0.tgz
            • ansi-regex-3.0.0.tgz (Vulnerable Library)

Vulnerability Details

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3807

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/

Release Date: 2021-09-17

Fix Resolution (ansi-regex): 3.0.1

Direct dependency fix Resolution (commitizen): 3.0.0

⛑️ Automatic Remediation is available for this issue

CVE-2019-20149

Vulnerable Library - kind-of-6.0.2.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz

Path to dependency file: /justapis-javascript-sdk/package.json

Path to vulnerable library: /node_modules/randomatic/node_modules/kind-of/package.json

Dependency Hierarchy:

  • commitizen-2.10.1.tgz (Root Library)
    • find-node-modules-1.0.4.tgz
      • findup-sync-0.4.2.tgz
        • micromatch-2.3.11.tgz
          • braces-1.8.5.tgz
            • expand-range-1.8.2.tgz
              • fill-range-2.2.4.tgz
                • randomatic-3.1.1.tgz
                  • kind-of-6.0.2.tgz (Vulnerable Library)

Vulnerability Details

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

Publish Date: 2019-12-30

URL: CVE-2019-20149

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20149

Release Date: 2019-12-30

Fix Resolution (kind-of): 6.0.3

Direct dependency fix Resolution (commitizen): 3.0.0

⛑️ Automatic Remediation is available for this issue

CVE-2020-28469

Vulnerable Library - glob-parent-2.0.0.tgz

Strips glob magic from a string to provide the parent path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-2.0.0.tgz

Path to dependency file: /justapis-javascript-sdk/package.json

Path to vulnerable library: /node_modules/glob-parent/package.json

Dependency Hierarchy:

  • commitizen-2.10.1.tgz (Root Library)
    • find-node-modules-1.0.4.tgz
      • findup-sync-0.4.2.tgz
        • micromatch-2.3.11.tgz
          • parse-glob-3.0.4.tgz
            • glob-base-0.3.0.tgz
              • glob-parent-2.0.0.tgz (Vulnerable Library)

Vulnerability Details

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Publish Date: 2021-06-03

URL: CVE-2020-28469

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469

Release Date: 2021-06-03

Fix Resolution (glob-parent): 5.1.2

Direct dependency fix Resolution (commitizen): 3.0.6

⛑️ Automatic Remediation is available for this issue

CVE-2020-8203

Vulnerable Library - lodash-4.17.5.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.5.tgz

Path to dependency file: /justapis-javascript-sdk/package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • commitizen-2.10.1.tgz (Root Library)
    • lodash-4.17.5.tgz (Vulnerable Library)

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-07-15

Fix Resolution (lodash): 4.17.9

Direct dependency fix Resolution (commitizen): 3.0.0

⛑️ Automatic Remediation is available for this issue

CVE-2021-23337

Vulnerable Library - lodash-4.17.5.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.5.tgz

Path to dependency file: /justapis-javascript-sdk/package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • commitizen-2.10.1.tgz (Root Library)
    • lodash-4.17.5.tgz (Vulnerable Library)

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (commitizen): 4.1.3

⛑️ Automatic Remediation is available for this issue

CVE-2022-0144

Vulnerable Library - shelljs-0.7.6.tgz

Portable Unix shell commands for Node.js

Library home page: https://registry.npmjs.org/shelljs/-/shelljs-0.7.6.tgz

Path to dependency file: /justapis-javascript-sdk/package.json

Path to vulnerable library: /node_modules/shelljs/package.json

Dependency Hierarchy:

  • commitizen-2.10.1.tgz (Root Library)
    • shelljs-0.7.6.tgz (Vulnerable Library)

Vulnerability Details

shelljs is vulnerable to Improper Privilege Management

Publish Date: 2022-01-11

URL: CVE-2022-0144

CVSS 3 Score Details (7.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-01-11

Fix Resolution (shelljs): 0.8.5

Direct dependency fix Resolution (commitizen): 4.1.0

⛑️ Automatic Remediation is available for this issue

CVE-2019-1010266

Vulnerable Library - lodash-4.17.5.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.5.tgz

Path to dependency file: /justapis-javascript-sdk/package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • commitizen-2.10.1.tgz (Root Library)
    • lodash-4.17.5.tgz (Vulnerable Library)

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-07-17

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (commitizen): 3.0.0

⛑️ Automatic Remediation is available for this issue

CVE-2022-0235

Vulnerable Library - node-fetch-1.6.3.tgz

A light-weight module that brings window.fetch to node.js and io.js

Library home page: https://registry.npmjs.org/node-fetch/-/node-fetch-1.6.3.tgz

Path to dependency file: /justapis-javascript-sdk/package.json

Path to vulnerable library: /node_modules/node-fetch/package.json

Dependency Hierarchy:

  • commitizen-2.10.1.tgz (Root Library)
    • opencollective-1.0.3.tgz
      • node-fetch-1.6.3.tgz (Vulnerable Library)

Vulnerability Details

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Publish Date: 2022-01-16

URL: CVE-2022-0235

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r683-j2x4-v87g

Release Date: 2022-01-16

Fix Resolution (node-fetch): 2.6.7

Direct dependency fix Resolution (commitizen): 3.0.0

⛑️ Automatic Remediation is available for this issue

CVE-2020-7598

Vulnerable Library - minimist-1.2.0.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz

Path to dependency file: /justapis-javascript-sdk/package.json

Path to vulnerable library: /node_modules/mochify/node_modules/module-deps/node_modules/minimist/package.json

Dependency Hierarchy:

  • commitizen-2.10.1.tgz (Root Library)
    • minimist-1.2.0.tgz (Vulnerable Library)

Vulnerability Details

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.

Publish Date: 2020-03-11

URL: CVE-2020-7598

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-03-11

Fix Resolution (minimist): 1.2.3

Direct dependency fix Resolution (commitizen): 4.0.4

⛑️ Automatic Remediation is available for this issue

CVE-2018-16487

Vulnerable Library - lodash-4.17.5.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.5.tgz

Path to dependency file: /justapis-javascript-sdk/package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • commitizen-2.10.1.tgz (Root Library)
    • lodash-4.17.5.tgz (Vulnerable Library)

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/380873

Release Date: 2019-02-01

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (commitizen): 3.0.0

⛑️ Automatic Remediation is available for this issue

CVE-2020-28500

Vulnerable Library - lodash-4.17.5.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.5.tgz

Path to dependency file: /justapis-javascript-sdk/package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • commitizen-2.10.1.tgz (Root Library)
    • lodash-4.17.5.tgz (Vulnerable Library)

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Mend Note: After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.

Publish Date: 2021-02-15

URL: CVE-2020-28500

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (commitizen): 4.1.3

⛑️ Automatic Remediation is available for this issue

CVE-2020-15168

Vulnerable Library - node-fetch-1.6.3.tgz

A light-weight module that brings window.fetch to node.js and io.js

Library home page: https://registry.npmjs.org/node-fetch/-/node-fetch-1.6.3.tgz

Path to dependency file: /justapis-javascript-sdk/package.json

Path to vulnerable library: /node_modules/node-fetch/package.json

Dependency Hierarchy:

  • commitizen-2.10.1.tgz (Root Library)
    • opencollective-1.0.3.tgz
      • node-fetch-1.6.3.tgz (Vulnerable Library)

Vulnerability Details

node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.

Publish Date: 2020-09-10

URL: CVE-2020-15168

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-w7rc-rwvf-8q5r

Release Date: 2020-09-17

Fix Resolution (node-fetch): 2.6.1

Direct dependency fix Resolution (commitizen): 3.0.0

⛑️ Automatic Remediation is available for this issue


⛑️ Automatic Remediation is available for this issue.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions