web3-1.10.4.tgz: 7 vulnerabilities (highest severity is: 9.1) #128
Labels
Mend: dependency security vulnerability
Security vulnerability detected by Mend
Comments
mend-bolt-for-github
bot
added
the
Mend: dependency security vulnerability
mend-bolt-for-github
bot
changed the title
mend-bolt-for-github
bot
changed the title
|
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory. |
mend-bolt-for-github
bot
changed the title
|
ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory. |
mend-bolt-for-github
bot
changed the title
mend-bolt-for-github
bot
changed the title
mend-bolt-for-github
bot
changed the title
|
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory. |
mend-bolt-for-github
bot
changed the title
|
ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory. |
mend-bolt-for-github
bot
changed the title
mend-bolt-for-github
bot
changed the title
mend-bolt-for-github
bot
changed the title
mend-bolt-for-github
bot
changed the title
mend-bolt-for-github
bot
changed the title
mend-bolt-for-github
bot
changed the title
mend-bolt-for-github
bot
changed the title
mend-bolt-for-github
bot
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Path to dependency file: /projects/oracle-nexus/package.json
Path to vulnerable library: /blockchain_integration/pi_network/node_modules/elliptic/package.json,/blockchain_integration/pi_network/smartship/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json,/blockchain_integration/pi_network/node_modules/ganache/node_modules/elliptic/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/ganache/node_modules/elliptic/package.json,/blockchain_integration/pi_network/pi-browser-app/apps/AstralPlane/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json,/blockchain_integration/pi_network/SpacePi/node_modules/elliptic/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/elliptic/package.json,/blockchain_integration/pi_network/PiRide/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/ganache/node_modules/elliptic/package.json,/blockchain_integration/pi_network/contracts/node_modules/elliptic/package.json,/blockchain_integration/pi_network/pi-network-layer2-scaling/node_modules/elliptic/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/elliptic/package.json,/blockchain_integration/pi_network/contracts/node_modules/ganache/node_modules/elliptic/package.json,/blockchain_integration/pi_network/pi-network-interoperability/node_modules/elliptic/package.json,/projects/oracle-nexus/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json,/blockchain_integration/pi_network/SpacePi/node_modules/ganache/node_modules/elliptic/package.json,/sidra_chain_integration/advanced-features/blockchain-based-identity-verification/backend/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json
Found in HEAD commit: 011e5f9d5ce310049a1a68c19f7df65be4f88caf
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - elliptic-6.5.4.tgz
EC cryptography
Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.4.tgz
Path to dependency file: /blockchain_integration/pi_network/package.json
Path to vulnerable library: /blockchain_integration/pi_network/node_modules/elliptic/package.json,/blockchain_integration/pi_network/smartship/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json,/blockchain_integration/pi_network/node_modules/ganache/node_modules/elliptic/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/ganache/node_modules/elliptic/package.json,/blockchain_integration/pi_network/pi-browser-app/apps/AstralPlane/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json,/blockchain_integration/pi_network/SpacePi/node_modules/elliptic/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/elliptic/package.json,/blockchain_integration/pi_network/PiRide/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/ganache/node_modules/elliptic/package.json,/blockchain_integration/pi_network/contracts/node_modules/elliptic/package.json,/blockchain_integration/pi_network/pi-network-layer2-scaling/node_modules/elliptic/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/elliptic/package.json,/blockchain_integration/pi_network/contracts/node_modules/ganache/node_modules/elliptic/package.json,/blockchain_integration/pi_network/pi-network-interoperability/node_modules/elliptic/package.json,/projects/oracle-nexus/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json,/blockchain_integration/pi_network/SpacePi/node_modules/ganache/node_modules/elliptic/package.json,/sidra_chain_integration/advanced-features/blockchain-based-identity-verification/backend/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json
Dependency Hierarchy:
Found in HEAD commit: 011e5f9d5ce310049a1a68c19f7df65be4f88caf
Found in base branch: main
Vulnerability Details
The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.
Publish Date: 2024-10-10
URL: CVE-2024-48949
CVSS 3 Score Details (9.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-48949
Release Date: 2024-10-10
Fix Resolution (elliptic): 6.5.6
Direct dependency fix Resolution (web3): 4.0.1
Step up your Open Source Security Game with Mend here
Vulnerable Library - ws-3.3.3.tgz
Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js
Library home page: https://registry.npmjs.org/ws/-/ws-3.3.3.tgz
Path to dependency file: /blockchain_integration/pi_network/SpacePi/package.json
Path to vulnerable library: /blockchain_integration/pi_network/SpacePi/node_modules/eth-lib/node_modules/ws/package.json,/sidra_chain_integration/advanced-features/blockchain-based-identity-verification/backend/node_modules/ws/package.json,/blockchain_integration/pi_network/smartship/node_modules/ws/package.json,/blockchain_integration/pi_network/pi-network-interoperability/node_modules/eth-lib/node_modules/ws/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/eth-lib/node_modules/ws/package.json,/blockchain_integration/pi_network/PiRide/node_modules/eth-lib/node_modules/ws/package.json,/blockchain_integration/pi_network/contracts/node_modules/eth-lib/node_modules/ws/package.json,/projects/oracle-nexus/node_modules/eth-lib/node_modules/ws/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/eth-lib/node_modules/ws/package.json,/blockchain_integration/pi_network/node_modules/eth-lib/node_modules/ws/package.json,/blockchain_integration/pi_network/pi-browser-app/apps/AstralPlane/node_modules/ws/package.json
Dependency Hierarchy:
Found in HEAD commit: 011e5f9d5ce310049a1a68c19f7df65be4f88caf
Found in base branch: main
Vulnerability Details
ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in [email protected] (e55e510) and backported to [email protected] (22c2876), [email protected] (eeb76d3), and [email protected] (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.
Publish Date: 2024-06-17
URL: CVE-2024-37890
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-3h5v-q93c-6h6q
Release Date: 2024-06-17
Fix Resolution (ws): 5.2.4
Direct dependency fix Resolution (web3): 4.0.1
Step up your Open Source Security Game with Mend here
Vulnerable Library - web3-utils-1.10.4.tgz
Library home page: https://registry.npmjs.org/web3-utils/-/web3-utils-1.10.4.tgz
Path to dependency file: /projects/oracle-nexus/package.json
Path to vulnerable library: /projects/oracle-nexus/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/contracts/node_modules/web3-eth/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/contracts/node_modules/web3-core/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/contracts/node_modules/web3-core-helpers/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/SpacePi/node_modules/web3-eth-iban/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/PiRide/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/pi-browser-app/apps/AstralPlane/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/node_modules/web3-eth-personal/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/web3/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/contracts/node_modules/web3-eth-ens/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/node_modules/web3-core-helpers/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/contracts/node_modules/web3-eth-personal/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/SpacePi/node_modules/web3-eth-ens/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/contracts/node_modules/web3/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/SpacePi/node_modules/web3-eth-personal/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/SpacePi/node_modules/web3-eth-contract/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/node_modules/web3-core-method/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/web3-core-method/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/node_modules/web3-eth-contract/node_modules/web3-utils/package.json,/sidra_chain_integration/advanced-features/blockchain-based-identity-verification/backend/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/web3-eth-personal/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/web3-eth-ens/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/web3-eth-personal/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/node_modules/web3-eth/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/contracts/node_modules/web3-net/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/web3-eth-iban/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/web3-core-helpers/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/node_modules/web3-net/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/web3-core-helpers/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/SpacePi/node_modules/web3/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/web3/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/node_modules/web3-core/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/SpacePi/node_modules/web3-core/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/SpacePi/node_modules/web3-core-helpers/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/web3-eth/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/node_modules/web3-eth-ens/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/contracts/node_modules/web3-eth-accounts/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/web3-eth/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/web3-eth-iban/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/web3-core/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/web3-eth-contract/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/web3-core-method/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/node_modules/web3/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/SpacePi/node_modules/web3-net/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/SpacePi/node_modules/web3-core-method/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/contracts/node_modules/web3-core-method/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/contracts/node_modules/web3-eth-contract/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/SpacePi/node_modules/web3-eth/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/web3-eth-accounts/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/web3-eth-contract/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/contracts/node_modules/web3-eth-iban/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/web3-net/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/web3-eth-accounts/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/node_modules/web3-eth-iban/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/pi-network-interoperability/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/web3-eth-ens/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/web3-net/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/smartship/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/web3-core/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/node_modules/web3-eth-accounts/node_modules/web3-utils/package.json,/blockchain_integration/pi_network/SpacePi/node_modules/web3-eth-accounts/node_modules/web3-utils/package.json
Dependency Hierarchy:
Found in HEAD commit: 011e5f9d5ce310049a1a68c19f7df65be4f88caf
Found in base branch: main
Vulnerability Details
Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due to insecure recursive merge.
An attacker can manipulate an object's prototype, potentially leading to the alteration of the behavior of all objects inheriting from the affected prototype by passing specially crafted input to these functions.
Publish Date: 2024-03-25
URL: CVE-2024-21505
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-21505
Release Date: 2024-03-25
Fix Resolution (web3-utils): 4.2.1
Direct dependency fix Resolution (web3): 4.0.1
Step up your Open Source Security Game with Mend here
Vulnerable Library - tar-4.4.19.tgz
tar for node
Library home page: https://registry.npmjs.org/tar/-/tar-4.4.19.tgz
Path to dependency file: /blockchain_integration/pi_network/contracts/package.json
Path to vulnerable library: /blockchain_integration/pi_network/contracts/node_modules/tar/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/tar/package.json,/blockchain_integration/pi_network/pi-browser-app/apps/AstralPlane/node_modules/tar/package.json,/projects/oracle-nexus/node_modules/tar/package.json,/blockchain_integration/pi_network/SpacePi/node_modules/tar/package.json,/blockchain_integration/pi_network/node_modules/tar/package.json,/blockchain_integration/pi_network/PiRide/node_modules/tar/package.json,/blockchain_integration/pi_network/pi-network-interoperability/node_modules/tar/package.json,/sidra_chain_integration/advanced-features/blockchain-based-identity-verification/backend/node_modules/tar/package.json,/blockchain_integration/pi_network/smartship/node_modules/swarm-js/node_modules/tar/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/tar/package.json
Dependency Hierarchy:
Found in HEAD commit: 011e5f9d5ce310049a1a68c19f7df65be4f88caf
Found in base branch: main
Vulnerability Details
node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.
Publish Date: 2024-03-21
URL: CVE-2024-28863
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-f5x3-32g6-xq36
Release Date: 2024-03-21
Fix Resolution: tar - 6.2.1
Step up your Open Source Security Game with Mend here
Vulnerable Library - tough-cookie-2.5.0.tgz
RFC6265 Cookies and Cookie Jar for node.js
Library home page: https://registry.npmjs.org/tough-cookie/-/tough-cookie-2.5.0.tgz
Path to dependency file: /blockchain_integration/pi_network/pi-browser-app/apps/AstralPlane/package.json
Path to vulnerable library: /blockchain_integration/pi_network/pi-browser-app/apps/AstralPlane/node_modules/tough-cookie/package.json,/sidra_chain_integration/advanced-features/blockchain-based-identity-verification/backend/node_modules/tough-cookie/package.json,/blockchain_integration/pi_network/node_modules/request/node_modules/tough-cookie/package.json,/blockchain_integration/pi_network/SpacePi/node_modules/request/node_modules/tough-cookie/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/request/node_modules/tough-cookie/package.json,/blockchain_integration/pi_network/pi-network-interoperability/node_modules/tough-cookie/package.json,/blockchain_integration/pi_network/contracts/node_modules/request/node_modules/tough-cookie/package.json,/blockchain_integration/pi_network/smartship/node_modules/tough-cookie/package.json,/blockchain_integration/pi_network/PiRide/node_modules/request/node_modules/tough-cookie/package.json,/projects/oracle-nexus/node_modules/tough-cookie/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/request/node_modules/tough-cookie/package.json
Dependency Hierarchy:
Found in HEAD commit: 011e5f9d5ce310049a1a68c19f7df65be4f88caf
Found in base branch: main
Vulnerability Details
Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.
Publish Date: 2023-07-01
URL: CVE-2023-26136
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-26136
Release Date: 2023-07-01
Fix Resolution (tough-cookie): 4.1.3
Direct dependency fix Resolution (web3): 4.0.1
Step up your Open Source Security Game with Mend here
Vulnerable Library - request-2.88.2.tgz
Simplified HTTP request client.
Library home page: https://registry.npmjs.org/request/-/request-2.88.2.tgz
Path to dependency file: /blockchain_integration/pi_network/pi-network-interoperability/package.json
Path to vulnerable library: /blockchain_integration/pi_network/pi-network-interoperability/node_modules/request/package.json,/projects/oracle-nexus/node_modules/request/package.json,/blockchain_integration/pi_network/node_modules/request/package.json,/blockchain_integration/pi_network/pi-browser-app/apps/AstralPlane/node_modules/request/package.json,/blockchain_integration/pi_network/SpacePi/node_modules/request/package.json,/blockchain_integration/pi_network/smartship/node_modules/request/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/request/package.json,/sidra_chain_integration/advanced-features/blockchain-based-identity-verification/backend/node_modules/request/package.json,/blockchain_integration/pi_network/contracts/node_modules/request/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/request/package.json,/blockchain_integration/pi_network/PiRide/node_modules/request/package.json
Dependency Hierarchy:
Found in HEAD commit: 011e5f9d5ce310049a1a68c19f7df65be4f88caf
Found in base branch: main
Vulnerability Details
The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Publish Date: 2023-03-16
URL: CVE-2023-28155
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-p8p7-x288-28g6
Release Date: 2023-03-16
Fix Resolution: @cypress/request - 3.0.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - elliptic-6.5.4.tgz
EC cryptography
Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.4.tgz
Path to dependency file: /blockchain_integration/pi_network/package.json
Path to vulnerable library: /blockchain_integration/pi_network/node_modules/elliptic/package.json,/blockchain_integration/pi_network/smartship/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json,/blockchain_integration/pi_network/node_modules/ganache/node_modules/elliptic/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/ganache/node_modules/elliptic/package.json,/blockchain_integration/pi_network/pi-browser-app/apps/AstralPlane/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json,/blockchain_integration/pi_network/SpacePi/node_modules/elliptic/package.json,/blockchain_integration/pi_network/PiSure/contracts/node_modules/elliptic/package.json,/blockchain_integration/pi_network/PiRide/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/ganache/node_modules/elliptic/package.json,/blockchain_integration/pi_network/contracts/node_modules/elliptic/package.json,/blockchain_integration/pi_network/pi-network-layer2-scaling/node_modules/elliptic/package.json,/blockchain_integration/pi_network/contracts/PI-bank/node_modules/elliptic/package.json,/blockchain_integration/pi_network/contracts/node_modules/ganache/node_modules/elliptic/package.json,/blockchain_integration/pi_network/pi-network-interoperability/node_modules/elliptic/package.json,/projects/oracle-nexus/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json,/blockchain_integration/pi_network/SpacePi/node_modules/ganache/node_modules/elliptic/package.json,/sidra_chain_integration/advanced-features/blockchain-based-identity-verification/backend/node_modules/@ethersproject/signing-key/node_modules/elliptic/package.json
Dependency Hierarchy:
Found in HEAD commit: 011e5f9d5ce310049a1a68c19f7df65be4f88caf
Found in base branch: main
Vulnerability Details
The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at least four leading 0 bytes and when the order of the elliptic curve's base point is smaller than the hash, because of an _truncateToN anomaly. This leads to valid signatures being rejected. Legitimate transactions or communications may be incorrectly flagged as invalid.
Publish Date: 2024-10-15
URL: CVE-2024-48948
CVSS 3 Score Details (4.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-fc9h-whq2-v747
Release Date: 2024-10-28
Fix Resolution: elliptic - 6.6.0
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: