temporalio / edu-102-typescript-code Goto Github PK

View Code? Open in Web Editor NEW

1.0 1.0 4.0 384 KB

JavaScript 10.71% TypeScript 68.46% Shell 0.99% CSS 19.84%

edu-102-typescript-code's People

Contributors

Watchers

Forkers

rgarcia henrytseng anthonywong555

edu-102-typescript-code's Issues

activity-1.7.0.tgz: 1 vulnerabilities (highest severity is: 9.8) - autoclosed

Vulnerable Library - activity-1.7.0.tgz

Path to dependency file: /exercises/debug-activity/practice/package.json

Path to vulnerable library: /exercises/debug-activity/practice/node_modules/protobufjs/package.json,/samples/age-estimation/node_modules/protobufjs/package.json,/exercises/testing-code/solution/node_modules/protobufjs/package.json,/exercises/debug-activity/solution/node_modules/protobufjs/package.json,/exercises/durable-execution/solution/node_modules/protobufjs/package.json,/exercises/using-objects/practice/node_modules/protobufjs/package.json,/exercises/version-workflow/solution/node_modules/protobufjs/package.json,/exercises/durable-execution/practice/node_modules/protobufjs/package.json,/exercises/testing-code/practice/node_modules/protobufjs/package.json,/exercises/version-workflow/practice/node_modules/protobufjs/package.json,/exercises/using-objects/solution/node_modules/protobufjs/package.json

Found in HEAD commit: 8e2ea5f4783e9e4eccd6f7e85bc875f0a045a556

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (activity version)	Remediation Available
CVE-2023-36665	Critical	9.8	protobufjs-7.2.3.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2023-36665

Vulnerable Library - protobufjs-7.2.3.tgz

Library home page: https://registry.npmjs.org/protobufjs/-/protobufjs-7.2.3.tgz

Path to dependency file: /exercises/debug-activity/practice/package.json

Dependency Hierarchy:

activity-1.7.0.tgz (Root Library)
- common-1.7.0.tgz
  - ❌ protobufjs-7.2.3.tgz (Vulnerable Library)

Found in HEAD commit: 8e2ea5f4783e9e4eccd6f7e85bc875f0a045a556

Found in base branch: main

Vulnerability Details

protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.4 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty. NOTE: this CVE Record is about "Object.constructor.prototype. = ...;" whereas CVE-2022-25878 was about "Object.proto. = ...;" instead.

Publish Date: 2023-07-05

URL: CVE-2023-36665

CVSS 3 Score Details (9.8)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.code-intelligence.com/blog/cve-protobufjs-prototype-pollution-cve-2023-36665

Release Date: 2023-07-05

Fix Resolution: protobufjs - 7.2.4

activity-1.8.2.tgz: 1 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - activity-1.8.2.tgz

Found in HEAD commit: 0a1411fb4be270603729e78bb5822e79460ab6eb