ethers-5.7.2.tgz: 3 vulnerabilities (highest severity is: 9.1) #1355
Comments
mend-bolt-for-github
bot
added
the
Mend: dependency security vulnerability
|
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory. |
mend-bolt-for-github
bot
changed the title
mend-bolt-for-github
bot
changed the title
|
ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory. |
mend-bolt-for-github
bot
changed the title
|
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory. |
mend-bolt-for-github
bot
changed the title
|
ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory. |
mend-bolt-for-github
bot
changed the title
|
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory. |
mend-bolt-for-github
bot
changed the title
|
ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory. |
|
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory. |
mend-bolt-for-github
bot
changed the title
|
ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory. |
mend-bolt-for-github
bot
changed the title
mend-bolt-for-github
bot
changed the title
|
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory. |
mend-bolt-for-github
bot
changed the title
|
ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory. |
|
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory. |
mend-bolt-for-github
bot
changed the title
mend-bolt-for-github
bot
changed the title
|
ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory. |
Path to dependency file: /blockchain_integration/pi_network/pi-network-layer2-scaling/package.json
Path to vulnerable library: /blockchain_integration/pi_network/smartship/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json,/blockchain_integration/pi_network/SpacePi/node_modules/elliptic/package.json,/blockchain_integration/pi_network/contracts/node_modules/elliptic/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/ganache/node_modules/elliptic/package.json,/blockchain_integration/pi_network/pi-network-layer2-scaling/node_modules/elliptic/package.json,/blockchain_integration/pi_network/PiRide/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json,/blockchain_integration/pi_network/SpacePi/node_modules/ganache/node_modules/elliptic/package.json,/blockchain_integration/pi_network/pi-browser-app/apps/AstralPlane/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json,/blockchain_integration/pi_network/contracts/node_modules/ganache/node_modules/elliptic/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/elliptic/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/elliptic/package.json,/blockchain_integration/pi_network/node_modules/elliptic/package.json,/blockchain_integration/pi_network/pi-network-interoperability/node_modules/elliptic/package.json,/projects/oracle-nexus/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/ganache/node_modules/elliptic/package.json,/blockchain_integration/pi_network/node_modules/ganache/node_modules/elliptic/package.json,/sidra_chain_integration/advanced-features/blockchain-based-identity-verification/backend/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json
Found in HEAD commit: 011e5f9d5ce310049a1a68c19f7df65be4f88caf
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - elliptic-6.5.4.tgz
EC cryptography
Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.4.tgz
Path to dependency file: /blockchain_integration/pi_network/smartship/package.json
Path to vulnerable library: /blockchain_integration/pi_network/smartship/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json,/blockchain_integration/pi_network/SpacePi/node_modules/elliptic/package.json,/blockchain_integration/pi_network/contracts/node_modules/elliptic/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/ganache/node_modules/elliptic/package.json,/blockchain_integration/pi_network/pi-network-layer2-scaling/node_modules/elliptic/package.json,/blockchain_integration/pi_network/PiRide/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json,/blockchain_integration/pi_network/SpacePi/node_modules/ganache/node_modules/elliptic/package.json,/blockchain_integration/pi_network/pi-browser-app/apps/AstralPlane/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json,/blockchain_integration/pi_network/contracts/node_modules/ganache/node_modules/elliptic/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/elliptic/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/elliptic/package.json,/blockchain_integration/pi_network/node_modules/elliptic/package.json,/blockchain_integration/pi_network/pi-network-interoperability/node_modules/elliptic/package.json,/projects/oracle-nexus/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/ganache/node_modules/elliptic/package.json,/blockchain_integration/pi_network/node_modules/ganache/node_modules/elliptic/package.json,/sidra_chain_integration/advanced-features/blockchain-based-identity-verification/backend/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json
Dependency Hierarchy:
Found in HEAD commit: 011e5f9d5ce310049a1a68c19f7df65be4f88caf
Found in base branch: main
Vulnerability Details
The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.
Publish Date: 2024-10-10
URL: CVE-2024-48949
CVSS 3 Score Details (9.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-48949
Release Date: 2024-10-10
Fix Resolution (elliptic): 6.5.6
Direct dependency fix Resolution (ethers): 6.0.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - ws-7.4.6.tgz
Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js
Library home page: https://registry.npmjs.org/ws/-/ws-7.4.6.tgz
Path to dependency file: /blockchain_integration/pi_network/pi-network-layer2-scaling/package.json
Path to vulnerable library: /blockchain_integration/pi_network/pi-network-layer2-scaling/node_modules/ws/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/ws/package.json,/projects/oracle-nexus/node_modules/ws/package.json,/blockchain_integration/pi_network/pi-network-interoperability/node_modules/ws/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/@ethersproject/providers/node_modules/ws/package.json,/blockchain_integration/pi_network/contracts/node_modules/@ethersproject/providers/node_modules/ws/package.json,/blockchain_integration/pi_network/SpacePi/node_modules/@ethersproject/providers/node_modules/ws/package.json,/blockchain_integration/pi_network/node_modules/@ethersproject/providers/node_modules/ws/package.json
Dependency Hierarchy:
Found in HEAD commit: 011e5f9d5ce310049a1a68c19f7df65be4f88caf
Found in base branch: main
Vulnerability Details
ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in [email protected] (e55e510) and backported to [email protected] (22c2876), [email protected] (eeb76d3), and [email protected] (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.
Publish Date: 2024-06-17
URL: CVE-2024-37890
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-3h5v-q93c-6h6q
Release Date: 2024-06-17
Fix Resolution (ws): 7.5.10
Direct dependency fix Resolution (ethers): 6.0.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - elliptic-6.5.4.tgz
EC cryptography
Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.4.tgz
Path to dependency file: /blockchain_integration/pi_network/smartship/package.json
Path to vulnerable library: /blockchain_integration/pi_network/smartship/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json,/blockchain_integration/pi_network/SpacePi/node_modules/elliptic/package.json,/blockchain_integration/pi_network/contracts/node_modules/elliptic/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/ganache/node_modules/elliptic/package.json,/blockchain_integration/pi_network/pi-network-layer2-scaling/node_modules/elliptic/package.json,/blockchain_integration/pi_network/PiRide/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json,/blockchain_integration/pi_network/SpacePi/node_modules/ganache/node_modules/elliptic/package.json,/blockchain_integration/pi_network/pi-browser-app/apps/AstralPlane/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json,/blockchain_integration/pi_network/contracts/node_modules/ganache/node_modules/elliptic/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/elliptic/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/elliptic/package.json,/blockchain_integration/pi_network/node_modules/elliptic/package.json,/blockchain_integration/pi_network/pi-network-interoperability/node_modules/elliptic/package.json,/projects/oracle-nexus/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/ganache/node_modules/elliptic/package.json,/blockchain_integration/pi_network/node_modules/ganache/node_modules/elliptic/package.json,/sidra_chain_integration/advanced-features/blockchain-based-identity-verification/backend/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json
Dependency Hierarchy:
Found in HEAD commit: 011e5f9d5ce310049a1a68c19f7df65be4f88caf
Found in base branch: main
Vulnerability Details
The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an _truncateToN anomaly. This leads to valid signatures being rejected. Legitimate transactions or communications may be incorrectly flagged as invalid.
Publish Date: 2024-10-15
URL: CVE-2024-48948
CVSS 3 Score Details (4.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-fc9h-whq2-v747
Release Date: 2024-10-15
Fix Resolution: elliptic - 6.6.0
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: