help secure Express/Connect apps with various HTTP headers

Path to dependency file: /package.json

Vulnerable Library - helmet-csp-1.2.2.tgz

Content Security Policy middleware.

Library home page: https://registry.npmjs.org/helmet-csp/-/helmet-csp-1.2.2.tgz

Path to dependency file: /package.json

Dependency Hierarchy:

• helmet-2.3.0.tgz (Root Library)
  • ❌ helmet-csp-1.2.2.tgz (Vulnerable Library)

Vulnerability Details

Helmet-csp before 2.9.1 is vulnerable to a Configuration Override affecting the application's Content Security Policy (CSP). The package's browser sniffing for Firefox deletes the default-src CSP policy, which is the fallback policy. This allows an attacker to remove an application's default CSP, possibly rendering the application vulnerable to Cross-Site Scripting.

Publish Date: Nov 18, 2019 03:14 AM

URL: WS-2019-0289

Threat Assessment

Exploit Maturity:N/A

EPSS:N/A

Score: 6.1

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :

Vulnerable Library - ms-0.7.1.tgz

Tiny ms conversion utility

Library home page: https://registry.npmjs.org/ms/-/ms-0.7.1.tgz

Path to dependency file: /package.json

Dependency Hierarchy:

• helmet-2.3.0.tgz (Root Library)
  • connect-3.4.1.tgz
    • debug-2.2.0.tgz
      • ❌ ms-0.7.1.tgz (Vulnerable Library)

Vulnerability Details

A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The patch is named caae2988ba2a37765d055c4eee63d383320ee662. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217451.

Publish Date: Jan 05, 2023 11:49 AM

URL: CVE-2017-20162

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 4.3

Suggested Fix

Type: Upgrade version

Origin: vercel/ms#89

Release Date: Jan 05, 2023 11:49 AM

Fix Resolution (ms): 2.0.0

Direct dependency fix Resolution (helmet): 3.6.1

Vulnerable Library - debug-2.2.0.tgz

small debugging utility

Library home page: https://registry.npmjs.org/debug/-/debug-2.2.0.tgz

Path to dependency file: /package.json

Dependency Hierarchy:

• helmet-2.3.0.tgz (Root Library)
  • connect-3.4.1.tgz
    • ❌ debug-2.2.0.tgz (Vulnerable Library)

Vulnerability Details

A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.

Publish Date: Jan 09, 2023 09:33 AM

URL: CVE-2017-20165

Threat Assessment

Exploit Maturity:Not Defined

EPSS:1.2%

Score: 3.5

Suggested Fix

Type: Upgrade version

Origin: GHSA-9vvw-cc9w-f27h

Release Date: Jan 09, 2023 09:33 AM

Fix Resolution (debug): 2.6.9

Direct dependency fix Resolution (helmet): 3.8.2