CVE-2022-0122 (Medium) detected in node-forge-0.10.0.tgz

[mend-for-github-com]

CVE-2022-0122 - Medium Severity Vulnerability

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Dependency Hierarchy:

• ❌ node-forge-0.10.0.tgz (Vulnerable Library)

Found in HEAD commit: 3d9f5425b6bb5dae38277bc68c45cb86ae608642

Found in base branch: main

Vulnerability Details

forge is vulnerable to URL Redirection to Untrusted Site

Publish Date: 2022-01-06

URL: CVE-2022-0122

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gf8q-jrpm-jvxq

Release Date: 2022-01-06

Fix Resolution: 1.2.1

[tmarkley]

$ yarn why node-forge
yarn why v1.22.17
[1/4] Why do we have the module "node-forge"...?
[2/4] Initialising dependency graph...
warning Resolution field "typescript@4.0.2" is incompatible with requested version "typescript@~4.5.2"
[3/4] Finding dependency...
[4/4] Calculating file sizes...
=> Found "node-forge@0.10.0"
info Has been hoisted to "node-forge"
info Reasons this module exists
   - "workspace-aggregator-081297c8-05ca-4128-8865-4db8afe8e29e" depends on it
   - Specified in "dependencies"
   - Hoisted from "_project_#node-forge"
   - Hoisted from "_project_#@elastic#request-crypto#node-jose#node-forge"
   - Hoisted from "_project_#@osd#ui-framework#webpack-dev-server#selfsigned#node-forge"
info Disk size without dependencies: "1.77MB"
info Disk size with unique dependencies: "1.77MB"
info Disk size with transitive dependencies: "1.77MB"
info Number of shared dependencies: 0
Done in 1.53s.

[tmarkley]

$ npm ls node-forge
opensearch-dashboards@2.0.0 /home/ubuntu/ws/OpenSearch-Dashboards
├─┬ @elastic/request-crypto@1.1.4
│ └─┬ node-jose@1.1.0
│   └── node-forge@0.10.0 deduped invalid: "^0.7.6" from node_modules/node-jose
├─┬ @osd/ui-framework@1.0.0 -> ./packages/osd-ui-framework
│ └─┬ webpack-dev-server@3.11.2
│   └─┬ selfsigned@1.10.11
│     └── node-forge@0.10.0 deduped invalid: "^0.7.6" from node_modules/node-jose
└── node-forge@0.10.0