GHSA-GF8Q-JRPM-JVXQ低危已审查

URL parsing in node-forge could lead to undesired behavior.

OSV 1.4.0 · github-reviewed · 修改于 2022-01-08 06:20

发布时间

2022-01-08 08:22

GitHub 审查时间

2022-01-08 06:20

NVD 发布时间

—

源文件

advisories/github-reviewed/2022/01/GHSA-gf8q-jrpm-jvxq/GHSA-gf8q-jrpm-jvxq.json

公告说明

Impact

The regex used for the forge.util.parseUrl API would not properly parse certain inputs resulting in a parsed data structure that could lead to undesired behavior.

Patches

forge.util.parseUrl and other very old related URL APIs were removed in 1.0.0 in favor of letting applications use the more modern WHATWG URL Standard API.

Workarounds

Ensure code does not directly or indirectly call forge.util.parseUrl with untrusted input.

References

https://www.huntr.dev/bounties/41852c50-3c6d-4703-8c55-4db27164a4ae/

For more information

If you have any questions or comments about this advisory:

Open an issue in forge
Email us at [email protected]

受影响的软件包

npm

node-forge

标识信息

别名 / CVE

无

CWE

CWE-601

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

没有 CVSS 数据。

原始 OSV JSON

{
  "id": "GHSA-gf8q-jrpm-jvxq",
  "aliases": [],
  "details": "### Impact\nThe regex used for the `forge.util.parseUrl` API would not properly parse certain inputs resulting in a parsed data structure that could lead to undesired behavior.\n\n### Patches\n`forge.util.parseUrl` and other very old related URL APIs were removed in 1.0.0 in favor of letting applications use the more modern WHATWG URL Standard API.\n\n### Workarounds\nEnsure code does not directly or indirectly call `forge.util.parseUrl` with untrusted input.\n\n### References\n- https://www.huntr.dev/bounties/41852c50-3c6d-4703-8c55-4db27164a4ae/\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [forge](https://github.com/digitalbazaar/forge)\n* Email us at [email protected]\n",
  "summary": "URL parsing in node-forge could lead to undesired behavior.",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.0"
            }
          ]
        }
      ],
      "package": {
        "name": "node-forge",
        "ecosystem": "npm"
      }
    }
  ],
  "modified": "2022-01-07T22:20:43Z",
  "severity": [],
  "published": "2022-01-08T00:22:02Z",
  "references": [
    {
      "url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-gf8q-jrpm-jvxq",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0122",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/digitalbazaar/forge",
      "type": "WEB"
    },
    {
      "url": "https://www.huntr.dev/bounties/41852c50-3c6d-4703-8c55-4db27164a4ae",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2022-01-07T22:20:43Z"
  }
}