Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVE-2019-19919 (High) detected in handlebars-2.0.0.min.js #183

Closed
mend-bolt-for-github bot opened this issue Jan 3, 2022 · 1 comment
Closed

CVE-2019-19919 (High) detected in handlebars-2.0.0.min.js #183

mend-bolt-for-github bot opened this issue Jan 3, 2022 · 1 comment
Labels
Mend: dependency security vulnerability Security vulnerability detected by WhiteSource

Comments

@mend-bolt-for-github
Copy link
Contributor

CVE-2019-19919 - High Severity Vulnerability

Vulnerable Library - handlebars-2.0.0.min.js

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://cdnjs.cloudflare.com/ajax/libs/handlebars.js/2.0.0/handlebars.min.js

Path to dependency file: /base-component/tools/screen/toolstatic/lib/swagger-ui/index.html

Path to vulnerable library: /base-component/tools/screen/toolstatic/lib/swagger-ui/lib/handlebars-2.0.0.js,/base-component/tools/screen/toolstatic/lib/swagger-ui/lib/handlebars-2.0.0.js

Dependency Hierarchy:

  • ❌ handlebars-2.0.0.min.js (Vulnerable Library)

Found in HEAD commit: f5e5c8ccc2d14a1a2f4657ec2306e20c51039f21

Found in base branch: master

Vulnerability Details

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads.

Publish Date: 2019-12-20

URL: CVE-2019-19919

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1164

Release Date: 2019-12-20

Fix Resolution: 4.3.0

Step up your Open Source Security Game with WhiteSource here
@mend-bolt-for-github mend-bolt-for-github bot added the Mend: dependency security vulnerability Security vulnerability detected by WhiteSource label Jan 3, 2022
jonesde added a commit that referenced this issue Jan 4, 2022
@jonesde
Update Swagger UI to 4.1.3 with JS/CSS files loaded from cdnjs instea…
db71b53 
…d of locally to avoid having files in the repos making it easier to update over time, along with cleaning up an old mess and a few CVE and WS security issues: #176, #177, #178, #179, #180, #181, #182, #183, #184, #185, #186
@jonesde
Copy link
Member

jonesde commented Jan 4, 2022

Fixed with update of Swagger UI to 4.1.3 using CDNJS for JS and CSS files, easier to update and trims the feature of embedded Swagger UI to one little html file.

@jonesde jonesde closed this as completed Jan 4, 2022
gagaboy added a commit to gagaboy/moqui-runtime that referenced this issue Jan 31, 2022
@gagaboy
Merge commit '05f8e8e55895495c1a8e79e34563a89ed159841d'
5ab8676 
* commit '05f8e8e55895495c1a8e79e34563a89ed159841d': (34 commits)
  On DataExport screen handle entityNames parameter that is a comma separated string which happens in qapps, fixes latest issue with DataExport under qapps/qvt
  Fixed the problem that moqui cannot be deployed as non-root webapp in Tomcat (moqui#190)
  On DataImport screen add support for creating missing records, with warnings about incomplete PKs because they can cause duplicate records; on a side note this screen is now a good way to test data for incomplete PKs
  Some improvements to Data Check functionality on the Data Import screen, shows check results in a table and allows selective update of field values; a first pass on this, another thing to handle that isn't there yet is adding missing records though that can be done with existing add missing functionality, just not selectively within a file
  On UserGroupDetail add new UserGroupPreference.groupPriority field to add/update group pref forms
  Added a new column for linking to auto screen. (moqui#188)
  On System/dashboard screen add a try/catch to handle errors getting ES cluster info, found this to break the whole page when ES is down
  MFA REST API and Login screen improvements (moqui#187)
  Update Swagger UI to 4.1.3 with JS/CSS files loaded from cdnjs instead of locally to avoid having files in the repos making it easier to update over time, along with cleaning up an old mess and a few CVE and WS security issues: moqui#176, moqui#177, moqui#178, moqui#179, moqui#180, moqui#181, moqui#182, moqui#183, moqui#184, moqui#185, moqui#186
  Add .whitesource configuration file (moqui#173)
  BugFix date-find can not select date from calendar. (moqui#174)
  Remove empty lines before <!doctype html>, now it become the first line. (moqui#175)
  In qvt render mode m-text-line VueJS component add reverseFillMask prop, in qvt text-line macro if field has the number validation class then set reverse-fill-mask
  In Login.xml specify in-map for call to reset#Password service so that other parameters cannot be specified as url parameters/etc
  Removed unused code from last commit to System/dashboard for Request Details dialog
  Add Request Details dialog to System/dashboard for inspecting headers, etc; change /status transition in webroot.xml to use ec.user.getClientIp() to use client ip header settings to avoid X-Forwarded-For spoof
  Misc improvements suggested by Arzang Kasiri: in WebrootVue.qvt.js m-display preserve whitespace in output by using the quasar q-input autogrow option; show the current date/time in system default time zone on System/dashboard; on AutoFind do a count query and only require parameters if table has more than 1 million records
  Add new targetPath field to EntitySyncDetail screen
  Use new getStatusMap(true) variation now support in ECFI in moqui-framework
  In DataExport screen add CSV support, in DataSnapshot screen add CSV and JSON support and commented fields for isoDateTime and tableColumnNames, currently commented because they are only supported for CSV and not XML or JSON yet
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Mend: dependency security vulnerability Security vulnerability detected by WhiteSource
Milestone
No milestone
Development

No branches or pull requests
1 participant
@jonesde