Giter Club home page Giter Club logo

opentok-rtc's Introduction

OpenTokRTC

Tokbox is now known as Vonage

Build Status codecov

OpenTokRTC is your private web-based video conferencing solution. It is based on the OpenTok platform (now the Vonage Video API) and uses the OpenTok SDKs and API. You can deploy the app on your servers to get your own video conferencing app running on WebRTC.

This repository contains a Node.js server and a web client application.

Table of Contents


Installation

If you want to install OpenTokRTC on your own server, read on. If you want to deploy OpenTokRTC to Heroku, see INSTALL-heroku.md.

Requirements

You will need to install these dependencies on your machine:

  • NodeJS v12: This version of OpenTokRTC is tested with NodeJS v12 LTS.
  • Redis: A redis server running on localhost.

You will also need these an OpenTok API key and secret. You can obtain these by signing up with OpenTok/Vonage Video API.

Installing dependencies

First, install the dependencies for the server.

If you use nvm, have it use the correct version of Node (v8):

$ nvm use

Then install the Node module dependencies:

$ npm install

Note: You will need to run these commands as a non-root user, else bower will refuse to execute.

Basic configuration

Once all the dependencies are in place, you will need to set some configuration options and install the application's dependencies. At a minimum, you need to set options for the OpenTok API key and secret to be used by the app. You can obtain these from your OpenTok account.

Other features of the app are enabled and configured using more configuration options, described in this README.

There are two ways to set configuration options for the application:

  • Using a config.json file
  • Setting environment variables

Using a config.json file

First create create a config.json file in the config folder.

$ cd <path-to-opentok-rtc>
$ cp config/example.json config/config.json

Edit the config.json file with the following, and replace <key> and <secret> with your OpenTok API key and the corresponding API secret:

{
    "OpenTok": {
        "apiKey": "<key>"
        "apiSecret": "<secret>"
    }
}

The config/example.json file includes settings for other options, which are described in the Configuration options section below.

Setting environment variables

You can set the TB_API_KEY and TB_API_SECRET to your OpenTok API key and secret. For example, the following shell commands export these values for use by the app (replace <key> and <secret> with your OpenTok API key and the corresponding API secret):

export TB_API_KEY=<key>
export TB_API_SECRET=<secret>

You can set other environment variables to enable and configure other options, which are described in the Configuration options section.

Running the app

Ensure that Redis server is running on localhost. In a terminal, run:

redis-server

Then start the application in foreground by running:

$ node server

This will start the application on port 8123 by default.

To specify a custom port number, use the -p flag when calling node server. For example, to run the application on port 8080, run:

$ node server -p 8080

Additionally, you can start the application as a daemon by passing -d flag, which starts the application and keeps it running in the background so that your terminal is not blocked:

$ node server -d

To start the server with HTTPS enabled, pass -S flag to launch a secure server along with -C <dir> flag to specify a directory that holds SSL certificate files. To quickly start a secure server, run:

$ node server -S -C sampleCerts

The server expects SSL certificate file to be named serverCert.pem and an SSL private key file to be named serverKey.pem. There is a pre-generated, self-signed SSL certificate pair in the ./sampleCerts directory.

For detailed information on available options, run $ node server -h.

Configuration options

You can enable and configure UI settings and other options using a config JSON file or by setting environment variables.

Environment variable settings overwrite any value set with the config JSON file.

The default config JSON file location is config/config.json. This path can be overwritten by setting the DEFAULT_JSON_CONFIG_PATH environment variable.

OpenTok configuration

The required configuration settings for the OpenTok API key and secret are described in the basic configuration section, earlier in this README.

There are other OpenTok configuration settings (each of which are optional):

  • Publisher resolution -- You can set the desired resolution of published video. The config.json setting is OpenTok.publisherResolution. The environment variable name is PUBLISHER_RESOLUTION.

    The format of the string is "widthxheight", where the width and height are represented in pixels. Valid values are "1280x720", "640x480", and "320x240". The published video will only use the desired resolution if the client configuration supports it. Some browsers and clients do not support each of these resolution settings.

    The default resolution for a stream (if you do not specify a resolution) is 640x480 pixels. If the client system cannot support the resolution you requested, the stream will use the next largest setting supported.

  • OpenTok.js URL -- By default, the app uses the latest standard line version of OpenTok.js. You can change the OpenTok.js source URL. For example you may want to change this to the enterprise line version of OpenTok.js (https://static.opentok.com/v2/js/opentok.min.js).

    The config.json setting is OpenTok.jsUrl. The environment variable name is TB_JS_URL.

  • Session expiration length -- To conserve Redis memory, the app limits how long how long room names are associated with OpenTok session IDs. The app stores the last time a session is used and if when we fetch it from Redis we determine it's older than this max age (in days). This is the key where that value (in days) should be stored. By default, sessions live two days.

    The config.json setting is OpenTok.maxSessionAge. The environment variable name is TB_MAX_SESSION_AGE.

  • OpenTok media mode -- You can specify whether the OpenTok sessions will use the OpenTok Media Router ('routed') or not ('relayed'). For more information, see The OpenTok Media Router and media modes. The default value is 'routed'.

The config.json setting is mediaMode. The environment variable name is MEDIA_MODE.

Config.json example:

{
    "OpenTok": {
      "apiKey": "<key>",
      "apiSecret": "<secret>",
      "publisherResolution": "1280x720",
      "jsUrl": "https://static.opentok.com/v2/js/opentok.min.js",
      "maxSessionAge": 7
    },
    "mediaMode": "routed"
}

Environment variable example:

export PUBLISHER_RESOLUTION="1280x720";
export TB_JS_URL="https://static.opentok.com/v2/js/opentok.min.js";
export TB_MAX_SESSION_AGE="7";

Phone dial-out

The app can dial out and add a phone-based end user to the OpenTok session, using the OpenTok SIP API. This app uses Nexmo as the SIP application that connects to OpenTok. (You can also use the OpenTok SIP API to connect to other SIP endpoints.)

To enable this feature:

  1. Sign up for a Nexmo/Vonage account.

  2. Edit options in the config/config.json file or set environment variables:

    • SIP.enabled (config.json) / SIP_ENABLED (environment variable) -- Set this to true.

    • SIP.username (config.json) / SIP_USERNAME (environment variable) -- Set this to the apiKey for the Nexmo account you created.

    • SIP.password (config.json) / SIP_PASSWORD (environment variable) -- Set this to the apiSecret for the Nexmo account you created.

    • SIP.requireGoogleAuth (config.json) / SIP_REQUIRE_GOOGLE_AUTH (environment variable) -- See Google Authentication for Phone dial-out for instructions on how to limit this functionality to users authenticated by their Google account.

Config.json example:

{
    "SIP": {
        "enabled" : true,
        "sipUsername" : "nexmoApiKey",
        "sipPassword" : "nexmoApiSecret",
        "requireGoogleAuth": false
    }
}

Environment variable example:

export SIP_ENABLED=true;
export SIP_USERNAME="nexmoApiKey";
export SIP_PASSWORD="nexmoApiSecret";
export SIP_REQUIRE_GOOGLE_AUTH=false;

Google Authentication for Phone dial-out

You can limit the ability to place outgoing calls to those authenticated by Google. To enable this feature:

  1. Create a Google API Console Project and client ID following the steps detailed here: https://developers.google.com/identity/sign-in/web/devconsole-project.

  2. Edit options in the config/config.json file or set environment variables:

  • Google.clientId (config.json) / GOOGLE_CLIENT_ID (environment variable) -- Set this to your client ID.

  • Google.hostedDomain (config.json) / GOOGLE_HOSTED_DOMAIN (environment variable) -- If you wish to limit sign in to accounts associated with a hosted domain, set the domain here.

  • Sip.requireGoogleAuth (config.json) / SIP_REQUIRE_GOOGLE_AUTH (environment variable) -- Set this totrue to require Google authentication for SIP dial-out as detailed in Phone dial-out.

Config.json example:

{
    "Google": {
        "clientId": "yourClientId.apps.googleusercontent.com",
        "hostedDomain": "yourhosteddomain.com"
    },
    "SIP" : {
        "sipUri" : "sip:[email protected]",
      "sipUsername" : "nexmoApiKey",
      "sipPassword" : "nexmoApiSecret",
      "requireGoogleAuth": true
    }
}

Environment variable example:

export GOOGLE_CLIENT_ID=yourClientId.apps.googleusercontent.com;
export GOOGLE_HOSTED_DOMAIN=yourhosteddomain.com;
export SIP_REQUIRE_GOOGLE_AUTH=true;

Archiving

To enable and configure archiving (recording), edit options in the config/config.json file or set environment variables:

  • Archiving.enabled (config.json) / ENABLE_ARCHIVING (environment variable) -- Set this to true to include the Record button in the UI, allowing the end user to record a session. If you also set the Archiving.archiveAlways / ARCHIVE_ALWAYS to true, each session is recorded automatically and the UI does not include the Record button. The default value is false.

  • Archiving.archiveAlways (config.json) / ARCHIVE_ALWAYS (environment variable) -- Whether to record all sessions automatically (without the end user having to click the Record button (which is not displayed if this option is set to true). The default value is false.

  • Archiving.pollingInitialTimeout (config.json) / ARCHIVE_TIMEOUT (environment variable -- The initial polling timeout (in milliseconds) for archive status change updates. Set this to 0 to disable polling. The default value is 5000.

  • Archiving.pollingTimeoutMultiplier (config.json) / TIMEOUT_MULTIPLIER (environment variable -- The timeout multiplier for archive status updates. If the first archive status update polling fails, subsequent polling intervals will apply this multiplier successively. Set to a lower number to poll more often. The default value is 1.5.

  • Archiving.archivingManager.enabled (config.json) / ENABLE_ARCHIVE_MANAGER (environment variable) -- Whether the UI will include a list of archive recordings for the session. The end user can click an archive to view the recording. This setting is only meaningful if Archiving.enabled / ENABLE_ARCHIVING is set to true. The default value is false.

    Note: The OpenTokRTC app retrieves the archive recordings from the OpenTok cloud storage. However, you may choose to have archives uploaded to an Amazon S3 bucket or an Azure container. If you do, you will need to modify the OpenTokRTC code to obtain archive recordings from the chosen storage location. For more information, see Archive storage in the OpenTok developer guides.

Config.json example:

{
    "Archiving": {
        "enabled": true,
        "archiveAlways": true,
        "pollingInitialTimeout": 10000,
        "pollingTimeoutMultiplier": 1,
        "archiveManager": {
            "enabled": true,
        }
    }
}

Environment variable example:

export ENABLE_ARCHIVING=true;
export ARCHIVE_ALWAYS=true;
export ARCHIVE_TIMEOUT=10000;
export TIMEOUT_MULTIPLIER=1;
export ENABLE_ARCHIVE_MANAGER=true;

Screen sharing

To enable and configure screen sharing, edit options in the config/config.json file or set environment variables:

  • Screensharing.enabled (config.json) / ENABLE_SCREENSHARING (environment variable) -- Whether to enable screen sharing. The default value is false.

  • Screensharing.chromeExtensionId (config.json) / CHROME_EXTENSION_ID (environment variable) -- The Chrome add-on extension ID for screen sharing. Note: an extension is no longer required for screen sharing in Chrome 72+ and Opera 59+. The browser prompts the end user for access to the screen as it would for access to the camera. Use a screen-sharing extension only if you need to support older versions of Chrome and Opera. The default value is null.

  • Screensharing.annotations (config.json) / ENABLE_ANNOTATIONS (environment variable) -- Whether to enable annotations in screen sharing. With annotations enabled, the room toolbar includes an Annotate button is This is only meaningful if screen sharing is enabled. The default value is true.

To learn more about how screen sharing works in OpenTok, see the guide on screen sharing.

Config.json example:

{
    "Screensharing": {
        "enabled": true,
        "chromeExtensionId": "cfhdojbkjhnklbpkdaibdccddilifddb",
        "annotations": {
            "enabled": true
        }
    } 
}

Environment variable example:

export ENABLE_SCREENSHARING=true;
export CHROME_EXTENSION_ID=cfhdojbkjhnklbpkdaibdccddilifddb;
export ENABLE_ANNOTATIONS=true;

Feedback

The app lets the developer POST feedback data to an endpoint on your HTTP server. To enable and configure this, edit options in the config/config.json file or set environment variables:

  • Feedback.url (config.json) / FEEDBACK_URL (environment variable) -- The URL to send a POST request with feedback data. Leave this as an empty string or undefined to disable issue reporting. The default value is ''.

  • Feedback.reportIssueLevel (config.json) / REPORT_ISSUE_LEVEL (environment variable) -- The audio and video scores in the feedback form are between 1 (awful) and 5 (excellent). When the feedback form is submitted, if an audio or video score is less than or equal to the report issue level, the app calls OT.reportIssue(). This reports an issue, which you can view in OpenTok Inspector. For more information, see Reporting an issue in the OpenTok developer guides. Set this to 0 to disable issue reporting. The default value is 3.

Config.json example:

{
    "Feedback": {
        "url": "https://my-app.com/feedback-endpoint/",
        "reportIssueLevel": 3
    }
}

Environment variable example:

export FEEDBACK_URL="https://my-app.com/feedback-endpoint/";
export REPORT_ISSUE_LEVEL=3;

Instead of posting feedback to an endpoint on your HTTP server, you can use Hotjar to collect feedback. Edit the following options in the config/config.json file or set environment variables:

  • Feedback.hotjarId (config.json) / HOTJAR_ID: (Optional, default value: null) The unique site ID for the application. This helps Hotjar tracking code to collect feedback data.

  • Feedback.hotjarVersion (config.json) / HOTJAR_VERSION: (Optional, default value: null) Version of the Tracking Code using with hjsv.

  • Feedback.enableFeedback (config.json) / ENABLE_FEEDBACK (environment variable) -- Set this to true when using Hotjar for feedback.

  • Feedback.reportIssueLevel (config.json) / REPORT_ISSUE_LEVEL (environment variable) -- This setting is ignored when using Hotjar for feedback.

  • Feedback.url (config.json) / FEEDBACK_URL (environment variable) -- This setting is ignored when using Hotjar for feedback.

Config.json example:

{
     "Feedback": {
         "hotjarId": "your-hotjar-id",
         "hotjarVersion": "your-hotjar-version",
         "enableFeedback": true,
     }
}

Environment variable example:

export HOTJAR_ID=your-hotjar-id;
export HOTJAR_VERSION=your-hotjar-version;
export ENABLE_FEEDBACK=true;

Pre-call test

Set the the TB_PRECALL_API_KEY and TB_PRECALL_API_SECRET environment variables to the the OpenTok API key and secret to use for the test session used by the precall-test. Or set these in the config.json file:

Config.json example:

{
    "precallTest": {
        "apiKey": "46049502",
        "apiSecret": "0f4a63f629cec64ebdc5552974fe2566d2eb2835"
    }
}

These are optional. If you do not set these, the pre-call test will use the same API key and secret that is used for the main OpenTok session used in the room.

You can disable the pre-call test by setting the ENABLE_PRECALL_TEST environment variable to false. Or you can disable it using the config file:

Config.json example:

{
    "precallTest": {
        "enabled": false
    }
}

Adobe Analytics

The app lets the developer configure Adobe Analytics to track user information. To configure this, edit options in the config/config.json file or set environment variables:

  • adobeTracking.url (config.json) / ADOBE_TRACKING_URL (environment variable) -- The URL to download the custom embed code. The default value is ''.

  • adobeTracking.primaryCategory (config.json) / ADOBE_TRACKING_PRIMARY_CATEGORY (environment variable) -- The value that will be included in Adobe Analytics object field: digitalData.page.pageInfo.primaryCategory. The default value is ''.

  • adobeTracking.siteIdentifier (config.json) / ADOBE_TRACKING_SITE_IDENTIFIER (environment variable) -- The value that will be included in Adobe Analytics object field: digitalData.page.pageInfo.siteIdentifier. The default value is ''.

  • adobeTracking.functionDept (config.json) / ADOBE_TRACKING_FUNCTION_DEPT (environment variable) -- The value that will be included in Adobe Analytics object field: digitalData.page.pageInfo.functionDept. The default value is ''.

ICID tracking

You can set ICID query string values for the end (/thanks) page URLs with these settings:

  • icid.startBuiliding (config.json) / START_BUILDING_ICID (environment variable) -- The ICID for the "How to make this app better" and "Start building for free" links. The default value is ''.

  • icid.contactUs (config.json) / CONTACT_US_ICID (environment variable) -- The ICID for the "Contact us" link. The default value is ''.

Additional configuration options

  • appName (config.json) / APP_NAME (environment variable) -- The name of the application displayed in the precall widget, in the top of the room page, and in the end (/thanks) page. The default value is 'Vonage Video Conferencing'.

  • introText (config.json) / INTRO_TEXT (environment variable) -- The text displayed under the application name in the precall widget. The default value is 'Welcome to Video Conferencing'.

  • introFooterLinkText (config.json) / INTRO_FOOTER_LINK_TEXT (environment variable) -- The text for the optional link displayed under the intro text in the precall widget. If no value is specified (or if it is set the an empty string), no link is displayed. The default value is ''.

  • introFooterLinkUrl (config.json) / INTRO_FOOTER_LINK_URL (environment variable) -- The URL for the optional link displayed under the intro text in the precall widget. The default value is ''.

  • helpLinkText1 (config.json) / HELP_LINK_TEXT_1 (environment variable) -- The text for the first help link displayed after "Need help?" at the top of the precall widget. If you do not set this option, the "Need help" section is omitted.

  • helpLinkUrl1 (config.json) / HELP_LINK_URL_1 (environment variable) -- The URL for the first help link the precall widget.

  • helpLinkText2 (config.json) / HELP_LINK_TEXT_2 (environment variable) -- The text for the second help link displayed after "Need help?" at the top of the precall widget. If you do not set this option, second help link is omitted.

  • helpLinkUrl2 (config.json) / HELP_LINK_URL_2 (environment variable) -- The URL for the second help link the precall widget.

  • showTos (config.json) / SHOW_TOS (environment variable) -- Whether the app will display the terms of service dialog box and require the user to agree to the terms before joining a room. The default value is false.

  • meetingsRatePerMinute (config.json) / MEETINGS_RATE_PER_MINUTE (environment variable) -- Determines the maximum amount of new meetings that can be created in a minute. Users will be allowed to join a meeting that already exists. Otherwise a message will appear telling them that the service is not available at the moment. If the value is set to any negative number, rate limiting will be turned off and all meetings will be allowed. If this value is set to 0, all new meetings will be rejected. The default value is -1.

  • minMeetingNameLength (config.json) / MIN_MEETING_NAME_LENGTH (environment variable) -- The minimum length of meeting names created. The default value, 0, indicates that there is no minimum length. (You can set this in the config file using the minMeetingNameLength setting.) The default value is 0.

  • allowIframing (config.json) / ALLOW_IFRAMING (environment variable) -- Controls the server-side restriction on allowing content to load inside an iframe. The allowed values are:

    • 'always' -- Allow iframing unconditionally (note that rtcApp.js should also be changed to reflect this, this option only changes what the server allows)

    • 'never' Set X-Frame-Options to 'DENY' (Deny loading content in any iframe)

    • 'sameorigin': Set X-Frame-Options to 'SAMEORIGIN' (Only allow iframe content to be loaded from pages in the same origin)

    We don't allow restricting iframe loading to specific URIs because it doesn't work on Chrome. The default value is 'never'.

  • useGoogleFonts (config.json) / USE_GOOGLE_FONTS (environment variable) -- Whether the client app will load the Open Sans font (the main font used in the user interface) from the Google font library (fonts.googleapis.com) or not. The default value is true.

  • jqueryUrl (config.json) / JQUERY_URL (environment variable) -- Route of the CDN that will be used to load JQuery scripts. The default value is 'https://ajax.googleapis.com/ajax/libs/jquery/'.

  • oneTrustCookieConsentUrl (config.json) / ONE_TRUST_COOKIE_CONSENT_URL (environment variable) -- Route of the OneTrust cookie consent URL. Leave blank or unset to turn the feature off. This setting is unset by default.

  • enableMuteAll (config.json) / ENABLE_MUTE_ALL (environment variable) -- Whether to show the Mute All control in the top menu of the room. (You can set this in the config file using the enableMuteAll setting.) The default value is true.

  • enableStopReceivingVideo (config.json) / ENABLE_STOP_RECEIVING_VIDEO (environment variable) -- Whether to show the Stop Receiving Video control in the top menu of the room. The default value is true.

  • maxUsersPerRoom (config.json) / MAX_USERS_PER_ROOM (environment variable) -- The maximum number of users allowed in a room at the same time. Set this to 0, the default, to allow any number of users. The default value is 0.

  • enableRoomLocking (config.json) / ENABLE_ROOM_LOCKING (environment variable) -- Whether or not to include the Lock Meeting command to users in the options menu. This command allows users to prevent new participants from joining a meeting. The default value is true.

  • autoGenerateRoomName (config.json) / AUTO_GENERATE_ROOM_NAME (environment variable) -- Whether or not to auto-generate the room name on behalf of the user. If this setting is turned on, we will use haikunator to generate room names for new rooms. If turned off, users will be prompted to enter a room/meeting name when they visit the landing page and won't be allowed to move forward until they do so. The default value is true.

  • enableEmoji (config.json) / ENABLE_EMOJI (environment variable) -- Whether or not to enable emoji support in the text chat widget.

Customizing the UI

For information on how to customize the OpenTokRTC UI, see CUSTOMIZING-UI.md.

Troubleshooting

"ServerPersistence: Timeout while connecting to the Persistence Provider! Is Redis running?

Ensure Redis server is running on localhost (run redis-server in the command line) and restart OpenTokRTC.

OpenTokRTC does not work when served over HTTP.

Browser security policies require HTTPS for WebRTC video communications. You will need to set up the app to be served over HTTPS. You can set up a secure reverse-proxy to your OpenTokRTC port using Nginx. For details, read this post.

UI looks broken

UI assets are compiled as part of the build process when installing application dependencies using npm install. If the web application UI still looks broken, run the following commands in the root directory of the application:

$ bower install
$ npm run clientBuild

We recommend that you run the application as a non-root user. However, if you are running the application as the root user, you will additionally need to tell bower to allow the root user to install dependencies, else bower will refuse to work:

$ bower install --allow-root

Health status check

There is a health status check endpoint at /server/health. You can load this URL to check whether the app is able to connect to all required external services. On success, this health check endpoint sends a response with the HTTP status code set to 200 and the JSON like the following:

{
  "name": "opentok-rtc",
  "version": "4.1.1",
  "gitHash": "312903cd043d5267bc11639718c47a9b313c1663",
  "opentok": true,
  "googleAuth": true,
  "status": "pass"
}

The JSON includes the following properties:

  • name -- "ot-embed"

  • version -- The version number deployed (from package.json)

  • git_hash -- The git commit deployed

  • opentok -- Whether the OpenTok API check passed. The app uses the OpenTok Node.js SDK, which connects to the OpenTok API server to create OpenTok sessions.

  • googleAuth -- Whether the Google Authentication check passed. This check is only run if the app uses Google Authentication for making outbound SIP calls. (See Google Authentication for Phone dial-out.)

  • status -- "pass" (if all checks pass) or "fail" (if any check fails)

On failure, the health status check endpoint returns a response with the HTTP status code set 400 and JSON like the following:

{
  "name": "opentok-rtc",
  "version": "4.1.1",
  "git_hash": "312903cd043d5267bc11639718c47a9b313c1663",
  "opentok": false,
  "error": "OpenTok API server timeout exceeded.",
  "status": "fail"
}

Note that upon failure, the status property is set to "fail" and the error property is set to an error message. Also, the property for the failing test, such as opentok, will be set to false. If a test fails, the health check will not run subsequent tests.

Development and Contributing

Interested in contributing? We ❤️ pull requests! See the Contribution guidelines.

Getting Help

We love to hear from you. If you have questions, comments or find a bug, let us know:

Further Reading

Check out the OpenTok documentation at https://tokbox.com/developer/.

opentok-rtc's People

Contributors

albertoacn avatar aoberoi avatar behaze avatar danielnetzeriam avatar dependabot[bot] avatar emilianop11 avatar ggarber avatar ggoldens avatar ibai avatar jeffswartz avatar jtiet avatar kaustavdm avatar kmoulder avatar lautarolobo12 avatar maikthomas avatar marcioaffonso avatar marinaserranomontes avatar michaeljolley avatar msach22 avatar namr-ta avatar normanargueta avatar raulkg avatar rhainer avatar robjperez avatar sailuvejella avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

opentok-rtc's Issues

qs-6.9.4.tgz: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - qs-6.9.4.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.9.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/qs/package.json

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (qs version) Remediation Possible** Reachability
CVE-2022-24999 High 7.5 Not Defined 1.9% qs-6.9.4.tgz Direct 6.9.7

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-24999

Vulnerable Library - qs-6.9.4.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.9.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/qs/package.json

Dependency Hierarchy:

  • qs-6.9.4.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).

Publish Date: 2022-11-26

URL: CVE-2022-24999

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 1.9%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999

Release Date: 2022-11-26

Fix Resolution: 6.9.7

⛑️ Automatic Remediation will be attempted for this issue.


⛑️Automatic Remediation will be attempted for this issue.

swagger-boilerplate-0.1.6.tgz: 4 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - swagger-boilerplate-0.1.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in Remediation Available
CVE-2022-24434 High 7.5 dicer-0.2.5.tgz Transitive N/A
CVE-2022-0155 Medium 6.5 follow-redirects-1.13.0.tgz Transitive 0.1.7
CVE-2022-0536 Medium 5.9 follow-redirects-1.13.0.tgz Transitive 0.1.7
CVE-2017-16137 Medium 5.3 debug-2.2.0.tgz Transitive N/A

Details

CVE-2022-24434

Vulnerable Library - dicer-0.2.5.tgz

A very fast streaming multipart parser for node.js

Library home page: https://registry.npmjs.org/dicer/-/dicer-0.2.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/dicer/package.json

Dependency Hierarchy:

  • swagger-boilerplate-0.1.6.tgz (Root Library)
    • multer-1.4.2.tgz
      • busboy-0.2.14.tgz
        • dicer-0.2.5.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes.

Publish Date: 2022-05-20

URL: CVE-2022-24434

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-2022-0155

Vulnerable Library - follow-redirects-1.13.0.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.13.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • swagger-boilerplate-0.1.6.tgz (Root Library)
    • node-rest-client-3.1.0.tgz
      • follow-redirects-1.13.0.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

Publish Date: 2022-01-10

URL: CVE-2022-0155

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406/

Release Date: 2022-01-10

Fix Resolution (follow-redirects): 1.14.7

Direct dependency fix Resolution (swagger-boilerplate): 0.1.7

⛑️ Automatic Remediation is available for this issue

CVE-2022-0536

Vulnerable Library - follow-redirects-1.13.0.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.13.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • swagger-boilerplate-0.1.6.tgz (Root Library)
    • node-rest-client-3.1.0.tgz
      • follow-redirects-1.13.0.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.

Publish Date: 2022-02-09

URL: CVE-2022-0536

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0536

Release Date: 2022-02-09

Fix Resolution (follow-redirects): 1.14.8

Direct dependency fix Resolution (swagger-boilerplate): 0.1.7

⛑️ Automatic Remediation is available for this issue

CVE-2017-16137

Vulnerable Library - debug-2.2.0.tgz

small debugging utility

Library home page: https://registry.npmjs.org/debug/-/debug-2.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-rest-client/node_modules/debug/package.json

Dependency Hierarchy:

  • swagger-boilerplate-0.1.6.tgz (Root Library)
    • node-rest-client-3.1.0.tgz
      • debug-2.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Publish Date: 2018-06-07

URL: CVE-2017-16137

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-16137

Release Date: 2018-06-07

Fix Resolution: 2.6.9


⛑️ Automatic Remediation is available for this issue.

swagger-boilerplate-0.1.8.tgz: 4 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - swagger-boilerplate-0.1.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-rest-client/node_modules/follow-redirects/package.json

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (swagger-boilerplate version) Remediation Possible** Reachability
CVE-2022-24434 High 7.5 Not Defined 0.2% dicer-0.2.5.tgz Transitive N/A*
CVE-2024-28849 Medium 6.5 Not Defined 0.0% follow-redirects-1.15.2.tgz Transitive N/A*
CVE-2023-26159 Medium 6.1 Not Defined 0.1% follow-redirects-1.15.2.tgz Transitive N/A*
CVE-2023-0842 Medium 5.3 Not Defined 0.1% xml2js-0.4.23.tgz Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-24434

Vulnerable Library - dicer-0.2.5.tgz

A very fast streaming multipart parser for node.js

Library home page: https://registry.npmjs.org/dicer/-/dicer-0.2.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/dicer/package.json

Dependency Hierarchy:

  • swagger-boilerplate-0.1.8.tgz (Root Library)
    • multer-1.4.4.tgz
      • busboy-0.2.14.tgz
        • dicer-0.2.5.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes.

Publish Date: 2022-05-20

URL: CVE-2022-24434

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.2%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-2024-28849

Vulnerable Library - follow-redirects-1.15.2.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-rest-client/node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • swagger-boilerplate-0.1.8.tgz (Root Library)
    • node-rest-client-3.1.1.tgz
      • follow-redirects-1.15.2.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Publish Date: 2024-03-14

URL: CVE-2024-28849

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cxjh-pqwp-8mfp

Release Date: 2024-03-14

Fix Resolution: follow-redirects - 1.15.6

CVE-2023-26159

Vulnerable Library - follow-redirects-1.15.2.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-rest-client/node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • swagger-boilerplate-0.1.8.tgz (Root Library)
    • node-rest-client-3.1.1.tgz
      • follow-redirects-1.15.2.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.

Publish Date: 2024-01-02

URL: CVE-2023-26159

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-26159

Release Date: 2024-01-02

Fix Resolution: follow-redirects - 1.15.4

CVE-2023-0842

Vulnerable Library - xml2js-0.4.23.tgz

Simple XML to JavaScript object converter.

Library home page: https://registry.npmjs.org/xml2js/-/xml2js-0.4.23.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/xml2js/package.json

Dependency Hierarchy:

  • swagger-boilerplate-0.1.8.tgz (Root Library)
    • node-rest-client-3.1.1.tgz
      • xml2js-0.4.23.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited.

Publish Date: 2023-04-05

URL: CVE-2023-0842

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-0842

Release Date: 2023-04-05

Fix Resolution: xml2js - 0.5.0

Deploying in linux EC-2

I am able to run the app on localhost:8123 in windows 10. However, I am unable to run/deploy the app to EC-2 in linux. When I "npm run start", I see the script is running on port 8123. I've also included the ec-2 rules and server logs which contain no errors.
When I try to view the app in the browser (http://ec2-54-219-133-186.us-west-1.compute.amazonaws.com:8123/), the request times out.

Separately, I have tried to route the root request in the browser (http://ec2-54-219-133-186.us-west-1.compute.amazonaws.com:8123/) using nginx I believe I have set up nginx correctly to route to localhost:8123.

I should also mention that when I exit the application in linux, I receive the following error log. I'm not sure if this is helpful

errors

image

OpenTok Server Log2

nginx

Opentok ports

Add screen sharing functionality

The README still talks about implementing your own Chrome extension for screen sharing.

Since this is now supported directly in the newer Chrome versions, could you add this functionality to the opentok-rtc app?

how to build

How can i build the script and host on my server?

CycleVideo Bug Ios

The cycleVideo function does not work on Ios iPhone. We are unable to switch camera.
Image from iOS

server node performance for multiple connections

Hi guys, how are you?

I have a performance problem in my project, at times of high access on my platform I have more than 500 people simultaneously accessing the video conference, with this I start having problems with connection drops and even the service becoming unavailable, about the server I have plenty of resources, which makes me think it's something with node js, would anyone have any performance specification for node? I need to improve his performance but I don't know the way, can someone help me?

lodash-4.17.20.tgz: 2 vulnerabilities (highest severity is: 7.2)

Vulnerable Library - lodash-4.17.20.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json,/node_modules/grunt-bower-task/node_modules/async/node_modules/lodash/package.json

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (lodash version) Remediation Possible** Reachability
CVE-2021-23337 High 7.2 Not Defined 0.6% lodash-4.17.20.tgz Direct 4.17.21
CVE-2020-28500 Medium 5.3 Not Defined 0.2% lodash-4.17.20.tgz Direct 4.17.21

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-23337

Vulnerable Library - lodash-4.17.20.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json,/node_modules/grunt-bower-task/node_modules/async/node_modules/lodash/package.json

Dependency Hierarchy:

  • lodash-4.17.20.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.6%

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-35jh-r3h4-6jhm

Release Date: 2021-02-15

Fix Resolution: 4.17.21

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-28500

Vulnerable Library - lodash-4.17.20.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json,/node_modules/grunt-bower-task/node_modules/async/node_modules/lodash/package.json

Dependency Hierarchy:

  • lodash-4.17.20.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Mend Note: After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.

Publish Date: 2021-02-15

URL: CVE-2020-28500

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.2%

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500

Release Date: 2021-02-15

Fix Resolution: 4.17.21

⛑️ Automatic Remediation will be attempted for this issue.


⛑️Automatic Remediation will be attempted for this issue.

opentok-2.10.0.tgz: 8 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - opentok-2.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tough-cookie/package.json

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (opentok version) Remediation Possible** Reachability
CVE-2023-26136 Critical 9.8 Not Defined 0.2% tough-cookie-2.5.0.tgz Transitive 2.17.0
CVE-2021-3918 Critical 9.8 Not Defined 0.5% json-schema-0.2.3.tgz Transitive 2.11.0
CVE-2022-23539 High 8.1 Not Defined 0.1% jsonwebtoken-8.5.1.tgz Transitive 2.15.2
CVE-2022-23540 High 7.6 Not Defined 0.1% jsonwebtoken-8.5.1.tgz Transitive 2.15.2
CVE-2022-25883 High 7.5 Not Defined 0.2% semver-5.7.1.tgz Transitive 2.15.0
CVE-2022-24999 High 7.5 Not Defined 1.9% qs-6.5.2.tgz Transitive 2.11.0
CVE-2022-23541 Medium 6.3 Not Defined 0.1% jsonwebtoken-8.5.1.tgz Transitive 2.15.2
CVE-2023-28155 Medium 6.1 Not Defined 0.1% request-2.88.2.tgz Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-26136

Vulnerable Library - tough-cookie-2.5.0.tgz

RFC6265 Cookies and Cookie Jar for node.js

Library home page: https://registry.npmjs.org/tough-cookie/-/tough-cookie-2.5.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tough-cookie/package.json

Dependency Hierarchy:

  • opentok-2.10.0.tgz (Root Library)
    • request-2.88.2.tgz
      • tough-cookie-2.5.0.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

Publish Date: 2023-07-01

URL: CVE-2023-26136

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.2%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-26136

Release Date: 2023-07-01

Fix Resolution (tough-cookie): 4.1.3

Direct dependency fix Resolution (opentok): 2.17.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-3918

Vulnerable Library - json-schema-0.2.3.tgz

JSON Schema validation and specifications

Library home page: https://registry.npmjs.org/json-schema/-/json-schema-0.2.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/json-schema/package.json

Dependency Hierarchy:

  • opentok-2.10.0.tgz (Root Library)
    • request-2.88.2.tgz
      • http-signature-1.2.0.tgz
        • jsprim-1.4.1.tgz
          • json-schema-0.2.3.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Publish Date: 2021-11-13

URL: CVE-2021-3918

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.5%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-3918

Release Date: 2021-11-13

Fix Resolution (json-schema): 0.4.0

Direct dependency fix Resolution (opentok): 2.11.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-23539

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jsonwebtoken/package.json

Dependency Hierarchy:

  • opentok-2.10.0.tgz (Root Library)
    • jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

Versions <=8.5.1 of jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the allowInvalidAsymmetricKeyTypes option to true in the sign() and/or verify() functions.

Publish Date: 2022-12-23

URL: CVE-2022-23539

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8cf7-32gw-wr33

Release Date: 2022-12-23

Fix Resolution (jsonwebtoken): 9.0.0

Direct dependency fix Resolution (opentok): 2.15.2

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-23540

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jsonwebtoken/package.json

Dependency Hierarchy:

  • opentok-2.10.0.tgz (Root Library)
    • jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

In versions <=8.5.1 of jsonwebtoken library, lack of algorithm definition in the jwt.verify() function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification. Users are affected if you do not specify algorithms in the jwt.verify() function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the jwt.verify() method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the none algorithm. If you need 'none' algorithm, you have to explicitly specify that in jwt.verify() options.

Publish Date: 2022-12-22

URL: CVE-2022-23540

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (7.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-23540

Release Date: 2022-12-22

Fix Resolution (jsonwebtoken): 9.0.0

Direct dependency fix Resolution (opentok): 2.15.2

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-25883

Vulnerable Library - semver-5.7.1.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-5.7.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/semver/package.json

Dependency Hierarchy:

  • opentok-2.10.0.tgz (Root Library)
    • jsonwebtoken-8.5.1.tgz
      • semver-5.7.1.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.2%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c2qf-rxjj-qqgw

Release Date: 2024-08-01

Fix Resolution (semver): 5.7.2

Direct dependency fix Resolution (opentok): 2.15.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-24999

Vulnerable Library - qs-6.5.2.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.5.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/request/node_modules/qs/package.json

Dependency Hierarchy:

  • opentok-2.10.0.tgz (Root Library)
    • request-2.88.2.tgz
      • qs-6.5.2.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).

Publish Date: 2022-11-26

URL: CVE-2022-24999

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 1.9%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999

Release Date: 2022-11-26

Fix Resolution (qs): 6.5.3

Direct dependency fix Resolution (opentok): 2.11.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-23541

Vulnerable Library - jsonwebtoken-8.5.1.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-8.5.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jsonwebtoken/package.json

Dependency Hierarchy:

  • opentok-2.10.0.tgz (Root Library)
    • jsonwebtoken-8.5.1.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

jsonwebtoken is an implementation of JSON Web Tokens. Versions <= 8.5.1 of jsonwebtoken library can be misconfigured so that passing a poorly implemented key retrieval function referring to the secretOrPublicKey argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.

Publish Date: 2022-12-22

URL: CVE-2022-23541

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (6.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hjrf-2m68-5959

Release Date: 2022-12-22

Fix Resolution (jsonwebtoken): 9.0.0

Direct dependency fix Resolution (opentok): 2.15.2

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-28155

Vulnerable Library - request-2.88.2.tgz

Simplified HTTP request client.

Library home page: https://registry.npmjs.org/request/-/request-2.88.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/request/package.json

Dependency Hierarchy:

  • opentok-2.10.0.tgz (Root Library)
    • request-2.88.2.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Publish Date: 2023-03-16

URL: CVE-2023-28155

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-p8p7-x288-28g6

Release Date: 2023-03-16

Fix Resolution: @cypress/request - 3.0.0


⛑️Automatic Remediation will be attempted for this issue.

grunt-contrib-connect-3.0.0.tgz: 2 vulnerabilities (highest severity is: 7.8)

Vulnerable Library - grunt-contrib-connect-3.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ws/package.json

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (grunt-contrib-connect version) Remediation Possible** Reachability
CVE-2021-43138 High 7.8 Not Defined 0.2% async-3.2.0.tgz Transitive 4.0.0
CVE-2024-37890 High 7.5 Not Defined 0.0% ws-3.3.3.tgz Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-43138

Vulnerable Library - async-3.2.0.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-3.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-contrib-connect/node_modules/async/package.json

Dependency Hierarchy:

  • grunt-contrib-connect-3.0.0.tgz (Root Library)
    • async-3.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

Publish Date: 2022-04-06

URL: CVE-2021-43138

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.2%

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138

Release Date: 2022-04-06

Fix Resolution (async): 3.2.2

Direct dependency fix Resolution (grunt-contrib-connect): 4.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-37890

Vulnerable Library - ws-3.3.3.tgz

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

Library home page: https://registry.npmjs.org/ws/-/ws-3.3.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ws/package.json

Dependency Hierarchy:

  • grunt-contrib-connect-3.0.0.tgz (Root Library)
    • node-http2-4.0.1.tgz
      • websocket-stream-5.5.2.tgz
        • ws-3.3.3.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in [email protected] (e55e510) and backported to [email protected] (22c2876), [email protected] (eeb76d3), and [email protected] (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.

Publish Date: 2024-06-17

URL: CVE-2024-37890

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3h5v-q93c-6h6q

Release Date: 2024-06-17

Fix Resolution: ws - 5.2.4,6.2.3,7.5.10,8.17.1


⛑️Automatic Remediation will be attempted for this issue.

grunt-contrib-compress-1.6.0.tgz: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - grunt-contrib-compress-1.6.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/simple-get/package.json

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (grunt-contrib-compress version) Remediation Possible** Reachability
CVE-2022-0355 High 7.5 Not Defined 0.2% simple-get-3.1.0.tgz Transitive 2.0.0

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-0355

Vulnerable Library - simple-get-3.1.0.tgz

Simplest way to make http get requests. Supports HTTPS, redirects, gzip/deflate, streams in < 100 lines.

Library home page: https://registry.npmjs.org/simple-get/-/simple-get-3.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/simple-get/package.json

Dependency Hierarchy:

  • grunt-contrib-compress-1.6.0.tgz (Root Library)
    • iltorb-2.4.5.tgz
      • prebuild-install-5.3.6.tgz
        • simple-get-3.1.0.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

Improper Removal of Sensitive Information Before Storage or Transfer in NPM simple-get prior to 4.0.1.

Publish Date: 2022-01-26

URL: CVE-2022-0355

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.2%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0355

Release Date: 2022-01-26

Fix Resolution (simple-get): 3.1.1

Direct dependency fix Resolution (grunt-contrib-compress): 2.0.0

⛑️ Automatic Remediation will be attempted for this issue.


⛑️Automatic Remediation will be attempted for this issue.

grunt-html-build-0.7.1.tgz: 1 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - grunt-html-build-0.7.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ini/package.json

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (grunt-html-build version) Remediation Possible** Reachability
CVE-2020-7788 Critical 9.8 Not Defined 1.2% ini-1.3.5.tgz Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2020-7788

Vulnerable Library - ini-1.3.5.tgz

An ini encoder/decoder for node

Library home page: https://registry.npmjs.org/ini/-/ini-1.3.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ini/package.json

Dependency Hierarchy:

  • grunt-html-build-0.7.1.tgz (Root Library)
    • js-beautify-1.13.0.tgz
      • config-chain-1.1.12.tgz
        • ini-1.3.5.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

Publish Date: 2020-12-11

URL: CVE-2020-7788

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 1.2%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788

Release Date: 2020-12-11

Fix Resolution: v1.3.6

grunt-1.3.0.tgz: 3 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - grunt-1.3.0.tgz

The JavaScript Task Runner

Library home page: https://registry.npmjs.org/grunt/-/grunt-1.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt/package.json

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (grunt version) Remediation Possible** Reachability
CVE-2022-3517 High 7.5 Not Defined 0.2% minimatch-3.0.4.tgz Transitive N/A*
CVE-2022-1537 High 7.0 Not Defined 0.0% grunt-1.3.0.tgz Direct 1.5.3
CVE-2022-0436 Medium 5.5 Not Defined 0.1% grunt-1.3.0.tgz Direct 1.5.1

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-3517

Vulnerable Library - minimatch-3.0.4.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/minimatch/package.json

Dependency Hierarchy:

  • grunt-1.3.0.tgz (Root Library)
    • minimatch-3.0.4.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

Publish Date: 2022-10-17

URL: CVE-2022-3517

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.2%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-10-17

Fix Resolution: minimatch - 3.0.5

CVE-2022-1537

Vulnerable Library - grunt-1.3.0.tgz

The JavaScript Task Runner

Library home page: https://registry.npmjs.org/grunt/-/grunt-1.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt/package.json

Dependency Hierarchy:

  • grunt-1.3.0.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.

Publish Date: 2022-05-10

URL: CVE-2022-1537

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

CVSS 3 Score Details (7.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/0179c3e5-bc02-4fc9-8491-a1a319b51b4d/

Release Date: 2022-05-10

Fix Resolution: 1.5.3

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-0436

Vulnerable Library - grunt-1.3.0.tgz

The JavaScript Task Runner

Library home page: https://registry.npmjs.org/grunt/-/grunt-1.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt/package.json

Dependency Hierarchy:

  • grunt-1.3.0.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2.

Publish Date: 2022-04-12

URL: CVE-2022-0436

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-j383-35pm-c5h4

Release Date: 2022-04-12

Fix Resolution: 1.5.1

⛑️ Automatic Remediation will be attempted for this issue.


⛑️Automatic Remediation will be attempted for this issue.

grunt-karma-4.0.0.tgz: 1 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - grunt-karma-4.0.0.tgz

grunt plugin for karma test runner

Library home page: https://registry.npmjs.org/grunt-karma/-/grunt-karma-4.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-karma/package.json

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (grunt-karma version) Remediation Possible** Reachability
CVE-2022-37602 Critical 9.8 Not Defined 0.3% grunt-karma-4.0.0.tgz Direct N/A

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-37602

Vulnerable Library - grunt-karma-4.0.0.tgz

grunt plugin for karma test runner

Library home page: https://registry.npmjs.org/grunt-karma/-/grunt-karma-4.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-karma/package.json

Dependency Hierarchy:

  • grunt-karma-4.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js.

Publish Date: 2022-10-14

URL: CVE-2022-37602

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.3%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

geoip-lite-1.4.2.tgz: 1 vulnerabilities (highest severity is: 7.8)

Vulnerable Library - geoip-lite-1.4.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-bower-task/node_modules/async/package.json,/node_modules/grunt-contrib-clean/node_modules/async/package.json,/node_modules/portscanner/node_modules/async/package.json,/node_modules/geoip-lite/node_modules/async/package.json,/node_modules/archiver/node_modules/async/package.json,/node_modules/grunt-contrib-watch/node_modules/async/package.json,/node_modules/grunt-contrib-less/node_modules/async/package.json

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (geoip-lite version) Remediation Possible** Reachability
CVE-2021-43138 High 7.8 Not Defined 0.2% async-2.6.3.tgz Transitive 1.4.5

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-43138

Vulnerable Library - async-2.6.3.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-2.6.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-bower-task/node_modules/async/package.json,/node_modules/grunt-contrib-clean/node_modules/async/package.json,/node_modules/portscanner/node_modules/async/package.json,/node_modules/geoip-lite/node_modules/async/package.json,/node_modules/archiver/node_modules/async/package.json,/node_modules/grunt-contrib-watch/node_modules/async/package.json,/node_modules/grunt-contrib-less/node_modules/async/package.json

Dependency Hierarchy:

  • geoip-lite-1.4.2.tgz (Root Library)
    • async-2.6.3.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

Publish Date: 2022-04-06

URL: CVE-2021-43138

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.2%

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138

Release Date: 2022-04-06

Fix Resolution (async): 2.6.4

Direct dependency fix Resolution (geoip-lite): 1.4.5

⛑️ Automatic Remediation will be attempted for this issue.


⛑️Automatic Remediation will be attempted for this issue.

Not working on safari on iOS

Not working on safari iPhone, I tested the http://opentokrtc.com also, found out there is another link for safari, what are the changes in that? so that I can get my build also working on safari.
As it's not working right now, wanted to see what additional things I need to take care for safari.

Q: Scalable Video

👋 Hello,

Before I start, I can not find a repository to post my question... Sorry about that.

We are building a video-call app for large groups. As OT documentation mentioned, to increase the quality and experience suggested approach is scalable video. The documentation says; When you use vp8 with chrome or safari you will be able to use the scalable-video feature by calling the setPreferredResolution. We have experienced an unexpected behavior; when we call the setPreferredResolution function through the subscriber the desired resolution applied between 2 seconds or 40 seconds or never. We did not expect from the OT Media Router to reduce the video size exactly what we desired. It fits the best option and its ok. But, as I mentioned sometimes it increases the quality of 1080x720 even we set the quality as 320x180 with setPreferredResolution function of subscriber.

Here is the sample code pieces to help us;

How we get the camera and microphone;

export const createMicrophoneAndCameraTracks = (options = {}) => {
  return new Promise((resolve, reject) => {
    const publisher = OT.initPublisher(null, {
      insertDefaultUI: false,
      publishVideo: true,
      publishAudio: true,
      width: 1280,
      height: 720,
      ...options,
    });

    publisher.on({
      accessDenied: reject,
      videoElementCreated: () => { return resolve(publisher); },
    });
  });
};

How we subscribe to a stream;

 session.subscribe(stream, null, {
      insertDefaultUI: false,
      preferredResolution: { width: 160, height: 90 },
    });
// rest of bussines logic

How we set the who has high-quality video or not

async selectStream(streamId) {
  this.selectedStreamId = streamId;

    session.streams.forEach((stream) => {
      const [subscriber] = session.getSubscribersForStream(stream);

      if (!subscriber) return;

      if (stream.streamId === streamId) {
        subscriber.setPreferredResolution(null);
      } else {
        subscriber.setPreferredResolution({ width: 160, height: 90 });
      }
    });
},

We think there is no problem with the code. We actually expect instant change (increasing or increasing.) in video quality when we call the setPreferredResolution.

Also, the article by opentok says

Note that Scalable Video is a publisher's property. Default platform behavior is designed to avoid the use of Simulcast for 1-1 (1-participant) calls. So a publisher will publish in Simulcast only if there are >2 connections in the sessions.

but there is no information about that in the documentation. This is valid?

Thanks for your all answers.

google-auth-library-6.1.3.tgz: 6 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - google-auth-library-6.1.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (google-auth-library version) Remediation Possible** Reachability
CVE-2022-24772 High 7.5 Not Defined 0.1% node-forge-0.10.0.tgz Transitive 6.1.4
CVE-2022-24771 High 7.5 Not Defined 0.1% node-forge-0.10.0.tgz Transitive 6.1.4
WS-2022-0008 Medium 6.6 Not Defined node-forge-0.10.0.tgz Transitive 6.1.4
CVE-2022-0235 Medium 6.1 Not Defined 0.4% node-fetch-2.6.1.tgz Transitive 6.1.4
CVE-2022-0122 Medium 6.1 Not Defined 0.1% node-forge-0.10.0.tgz Transitive 6.1.4
CVE-2022-24773 Medium 5.3 Not Defined 0.1% node-forge-0.10.0.tgz Transitive 6.1.4

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-24772

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

  • google-auth-library-6.1.3.tgz (Root Library)
    • gtoken-5.1.0.tgz
      • google-p12-pem-3.0.3.tgz
        • node-forge-0.10.0.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24772

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24772

Release Date: 2022-03-18

Fix Resolution (node-forge): 1.3.0

Direct dependency fix Resolution (google-auth-library): 6.1.4

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-24771

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

  • google-auth-library-6.1.3.tgz (Root Library)
    • gtoken-5.1.0.tgz
      • google-p12-pem-3.0.3.tgz
        • node-forge-0.10.0.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24771

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24771

Release Date: 2022-03-18

Fix Resolution (node-forge): 1.3.0

Direct dependency fix Resolution (google-auth-library): 6.1.4

⛑️ Automatic Remediation will be attempted for this issue.

WS-2022-0008

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

  • google-auth-library-6.1.3.tgz (Root Library)
    • gtoken-5.1.0.tgz
      • google-p12-pem-3.0.3.tgz
        • node-forge-0.10.0.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

The forge.debug API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.

Publish Date: 2022-01-08

URL: WS-2022-0008

Threat Assessment

Exploit Maturity: Not Defined

EPSS:

CVSS 3 Score Details (6.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5rrq-pxf6-6jx5

Release Date: 2022-01-08

Fix Resolution (node-forge): 1.0.0

Direct dependency fix Resolution (google-auth-library): 6.1.4

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-0235

Vulnerable Library - node-fetch-2.6.1.tgz

A light-weight module that brings window.fetch to node.js

Library home page: https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-fetch/package.json

Dependency Hierarchy:

  • google-auth-library-6.1.3.tgz (Root Library)
    • gaxios-4.0.1.tgz
      • node-fetch-2.6.1.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Publish Date: 2022-01-16

URL: CVE-2022-0235

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.4%

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r683-j2x4-v87g

Release Date: 2022-01-16

Fix Resolution (node-fetch): 2.6.7

Direct dependency fix Resolution (google-auth-library): 6.1.4

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-0122

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

  • google-auth-library-6.1.3.tgz (Root Library)
    • gtoken-5.1.0.tgz
      • google-p12-pem-3.0.3.tgz
        • node-forge-0.10.0.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

forge is vulnerable to URL Redirection to Untrusted Site
Mend Note: Converted from WS-2022-0007, on 2022-11-07.

Publish Date: 2022-01-06

URL: CVE-2022-0122

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gf8q-jrpm-jvxq

Release Date: 2022-01-06

Fix Resolution (node-forge): 1.0.0

Direct dependency fix Resolution (google-auth-library): 6.1.4

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-24773

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

  • google-auth-library-6.1.3.tgz (Root Library)
    • gtoken-5.1.0.tgz
      • google-p12-pem-3.0.3.tgz
        • node-forge-0.10.0.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check DigestInfo for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24773

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24773

Release Date: 2022-03-18

Fix Resolution (node-forge): 1.3.0

Direct dependency fix Resolution (google-auth-library): 6.1.4

⛑️ Automatic Remediation will be attempted for this issue.


⛑️Automatic Remediation will be attempted for this issue.

ENOENT: no such file or directory, open 'C:\home\site\wwwroot\otrtc_\pipe\88cfa211-9d55-4f5f-b21e-a293c1bf5ea0.pid'

When starting server.js on windows azure app service the following error is thrown:

[LOG] 2021-01-21T16:02:06.500Z - OpenTokRTC Main: Setting up process. Run as a daemon: false Logfile: undefined
OpenTokRTC server started on port \\.\pipe\88cfa211-9d55-4f5f-b21e-a293c1bf5ea0
[LOG] 2021-01-21T16:02:06.761Z - OpenTokRTC Main: api.yml file read
[LOG] 2021-01-21T16:02:06.791Z - HTTP Server App: Starting process
[LOG] 2021-01-21T16:02:06.807Z - HTTP Server App: Loading implementation module: serverMethods.js
[LOG] 2021-01-21T16:02:12.995Z - HTTP Server App: Implementation module ( serverMethods.js ) read!
[LOG] 2021-01-21T16:02:13.729Z - HTTP Server App: Setting shared directory /shared/js handler to C:\home\site\wwwroot\node_modules\swagger-boilerplate\lib\shared
[LOG] 2021-01-21T16:02:13.779Z - HTTP Server App: Using middleware:  setSecurityHeaders true
[LOG] 2021-01-21T16:02:13.789Z - HTTP Server App: Using middleware:  configReady true
[LOG] 2021-01-21T16:02:13.789Z - HTTP Server App: Using middleware:  securityHeaders true
[LOG] 2021-01-21T16:02:13.805Z - HTTP Server App: Using middleware:  iframingOptions true
[LOG] 2021-01-21T16:02:13.821Z - HTTP Server App: Using middleware:  featureEnabled true
[LOG] 2021-01-21T16:02:13.883Z - OpenTokRTC Main: Starting  server at \\.\pipe\88cfa211-9d55-4f5f-b21e-a293c1bf5ea0 , static path:  ./web
[LOG] 2021-01-21T16:02:13.883Z - OpenTokRTC Main: Configuration handler set! To reload the configuration just do a kill -SIGHUP
[ERROR] 2021-01-21T16:02:14.336Z - OpenTokRTC Main: Got an uncaught exception: [Error: ENOENT: no such file or directory, open 'C:\home\site\wwwroot\otrtc_\pipe\88cfa211-9d55-4f5f-b21e-a293c1bf5ea0.pid'] {
  errno: -4058,
  code: 'ENOENT',
  syscall: 'open',
  path: 'C:\\home\\site\\wwwroot\\otrtc_\\pipe\\88cfa211-9d55-4f5f-b21e-a293c1bf5ea0.pid'
} Error: ENOENT: no such file or directory, open 'C:\home\site\wwwroot\otrtc_\pipe\88cfa211-9d55-4f5f-b21e-a293c1bf5ea0.pid'

App seems to run withoput problems, but how to solve this error?

grunt-autoprefixer-3.0.4.tgz: 3 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - grunt-autoprefixer-3.0.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/postcss/package.json

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (grunt-autoprefixer version) Remediation Possible** Reachability
CVE-2021-23382 High 7.5 Not Defined 0.2% postcss-4.1.16.tgz Transitive N/A*
WS-2018-0590 High 7.1 Not Defined diff-1.3.2.tgz Transitive N/A*
CVE-2023-44270 Medium 5.3 Not Defined 0.1% postcss-4.1.16.tgz Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-23382

Vulnerable Library - postcss-4.1.16.tgz

Tool for transforming CSS with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-4.1.16.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/postcss/package.json

Dependency Hierarchy:

  • grunt-autoprefixer-3.0.4.tgz (Root Library)
    • postcss-4.1.16.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*\s* sourceMappingURL=(.*).

Publish Date: 2021-04-26

URL: CVE-2021-23382

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.2%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23382

Release Date: 2021-04-26

Fix Resolution: postcss - 8.2.13

WS-2018-0590

Vulnerable Library - diff-1.3.2.tgz

A javascript text diff implementation.

Library home page: https://registry.npmjs.org/diff/-/diff-1.3.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/diff/package.json

Dependency Hierarchy:

  • grunt-autoprefixer-3.0.4.tgz (Root Library)
    • diff-1.3.2.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

A vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.

Publish Date: 2018-03-05

URL: WS-2018-0590

Threat Assessment

Exploit Maturity: Not Defined

EPSS:

CVSS 3 Score Details (7.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-03-05

Fix Resolution: 3.5.0

CVE-2023-44270

Vulnerable Library - postcss-4.1.16.tgz

Tool for transforming CSS with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-4.1.16.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/postcss/package.json

Dependency Hierarchy:

  • grunt-autoprefixer-3.0.4.tgz (Root Library)
    • postcss-4.1.16.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.

Publish Date: 2023-09-29

URL: CVE-2023-44270

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-7fh5-64p2-3v2j

Release Date: 2023-09-29

Fix Resolution: postcss - 8.4.31

grunt-terser-1.0.0.tgz: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - grunt-terser-1.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/terser/package.json

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (grunt-terser version) Remediation Possible** Reachability
CVE-2022-25858 High 7.5 Not Defined 0.2% terser-4.8.0.tgz Transitive 2.0.0

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-25858

Vulnerable Library - terser-4.8.0.tgz

JavaScript parser, mangler/compressor and beautifier toolkit for ES6+

Library home page: https://registry.npmjs.org/terser/-/terser-4.8.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/terser/package.json

Dependency Hierarchy:

  • grunt-terser-1.0.0.tgz (Root Library)
    • terser-4.8.0.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.

Publish Date: 2022-07-15

URL: CVE-2022-25858

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.2%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25858

Release Date: 2022-07-15

Fix Resolution (terser): 4.8.1

Direct dependency fix Resolution (grunt-terser): 2.0.0

⛑️ Automatic Remediation will be attempted for this issue.


⛑️Automatic Remediation will be attempted for this issue.

BUG: Closing invite dialog results in pre-call mask covering call screen

Note: This bug wasn't reproducible 100% of the time. It affected me around 60% of the times I tried.
Steps to reproduce:

  1. Join a call
  2. Open the Invite Dialog
  3. Close the Invite Dialog

Expected Result: Dialog closes, call screen is visible
Actual Result: Call screen is covered by pre-call screen. Call is still in session.

image
image

grunt-cli-1.3.2.tgz: 4 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - grunt-cli-1.3.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/braces/package.json

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (grunt-cli version) Remediation Possible** Reachability
CVE-2024-4068 High 7.5 Not Defined 0.0% braces-2.3.2.tgz Transitive N/A*
CVE-2022-38900 High 7.5 Not Defined 0.4% decode-uri-component-0.2.0.tgz Transitive 1.4.0
CVE-2021-23343 High 7.5 Not Defined 0.3% path-parse-1.0.6.tgz Transitive 1.4.0
CVE-2024-4067 Medium 5.3 Not Defined 0.0% micromatch-3.1.10.tgz Transitive 1.4.0

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-4068

Vulnerable Library - braces-2.3.2.tgz

Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.

Library home page: https://registry.npmjs.org/braces/-/braces-2.3.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/braces/package.json

Dependency Hierarchy:

  • grunt-cli-1.3.2.tgz (Root Library)
    • liftoff-2.5.0.tgz
      • findup-sync-2.0.0.tgz
        • micromatch-3.1.10.tgz
          • braces-2.3.2.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

The NPM package braces, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
Mend Note: After conducting a further research, it was concluded that CVE-2024-4068 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of braces should follow the fix recommendation as noted.

Publish Date: 2024-05-14

URL: CVE-2024-4068

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2024-05-13

Fix Resolution: braces - 3.0.3

CVE-2022-38900

Vulnerable Library - decode-uri-component-0.2.0.tgz

A better decodeURIComponent

Library home page: https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/decode-uri-component/package.json

Dependency Hierarchy:

  • grunt-cli-1.3.2.tgz (Root Library)
    • liftoff-2.5.0.tgz
      • findup-sync-2.0.0.tgz
        • micromatch-3.1.10.tgz
          • snapdragon-0.8.2.tgz
            • source-map-resolve-0.5.3.tgz
              • decode-uri-component-0.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

Publish Date: 2022-11-28

URL: CVE-2022-38900

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.4%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-w573-4hg7-7wgq

Release Date: 2022-11-28

Fix Resolution (decode-uri-component): 0.2.1

Direct dependency fix Resolution (grunt-cli): 1.4.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-23343

Vulnerable Library - path-parse-1.0.6.tgz

Node.js path.parse() ponyfill

Library home page: https://registry.npmjs.org/path-parse/-/path-parse-1.0.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/path-parse/package.json

Dependency Hierarchy:

  • grunt-cli-1.3.2.tgz (Root Library)
    • liftoff-2.5.0.tgz
      • resolve-1.19.0.tgz
        • path-parse-1.0.6.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

Publish Date: 2021-05-04

URL: CVE-2021-23343

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.3%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-05-04

Fix Resolution (path-parse): 1.0.7

Direct dependency fix Resolution (grunt-cli): 1.4.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-4067

Vulnerable Library - micromatch-3.1.10.tgz

Glob matching for javascript/node.js. A drop-in replacement and faster alternative to minimatch and multimatch.

Library home page: https://registry.npmjs.org/micromatch/-/micromatch-3.1.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/micromatch/package.json

Dependency Hierarchy:

  • grunt-cli-1.3.2.tgz (Root Library)
    • liftoff-2.5.0.tgz
      • findup-sync-2.0.0.tgz
        • micromatch-3.1.10.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

The NPM package micromatch is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in micromatch.braces() in index.js because the pattern .* will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching.
Mend Note: After conducting a further research, it was concluded that CVE-2024-4067 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of micromatch should follow the fix recommendation as noted.

Publish Date: 2024-05-14

URL: CVE-2024-4067

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2024-05-14

Fix Resolution (micromatch): 4.0.6

Direct dependency fix Resolution (grunt-cli): 1.4.0

⛑️ Automatic Remediation will be attempted for this issue.


⛑️Automatic Remediation will be attempted for this issue.

Error deploying on Heroku

Hello,

I have this error when deploying master branch to Heroku :

-----> Node.js app detected
       
-----> Creating runtime environment
       
       NPM_CONFIG_LOGLEVEL=error
       NODE_ENV=production
       NODE_MODULES_CACHE=true
       NODE_VERBOSE=false
       
-----> Installing binaries
       engines.node (package.json):  8.0.x
       engines.npm (package.json):   2.14.x
       
       Resolving node version 8.0.x...
       Downloading and installing node 8.0.0...
       Bootstrapping npm 2.14.x (replacing 5.0.0)...
       npm 2.14.x installed
       
-----> Installing dependencies
       Installing node modules (package.json + package-lock)
       
       > [email protected] postinstall /tmp/build_b5ba7a2b/node_modules/ejs
       > node ./postinstall.js
       
       
       > [email protected] postinstall /tmp/build_b5ba7a2b/node_modules/geckodriver
       > node index.js
       
       /tmp/build_b5ba7a2b/node_modules/geckodriver/node_modules/tar/node_modules/mkdirp/lib/opts-arg.js:7
           opts = { mode: 0o777, fs, ...opts }
                                     ^^^
       
       SyntaxError: Unexpected token ...
           at createScript (vm.js:74:10)
           at Object.runInThisContext (vm.js:116:10)
           at Module._compile (module.js:533:28)
           at Object.Module._extensions..js (module.js:580:10)
           at Module.load (module.js:503:32)
           at tryModuleLoad (module.js:466:12)
           at Function.Module._load (module.js:458:3)
           at Module.require (module.js:513:17)
           at require (internal/module.js:11:18)
           at Object.<anonymous> (/tmp/build_b5ba7a2b/node_modules/geckodriver/node_modules/tar/node_modules/mkdirp/index.js:1:79)
       
       > [email protected] install /tmp/build_b5ba7a2b/node_modules/wdio/node_modules/fibers
       > node build.js || nodejs build.js
       
       `linux-x64-57-glibc` exists; testing
       Binary is fine; exiting
       
       > [email protected] install /tmp/build_b5ba7a2b/node_modules/wdio-mocha-framework/node_modules/wdio-sync/node_modules/fibers
       > node build.js || nodejs build.js
       
       `linux-x64-57` exists; testing
       Binary is fine; exiting
       
       > [email protected] postinstall /tmp/build_b5ba7a2b/node_modules/wdio-sauce-service/node_modules/sauce-connect-launcher
       > node scripts/install.js || nodejs scripts/install.js
       
       
       > [email protected] install /tmp/build_b5ba7a2b/node_modules/grunt-contrib-compress/node_modules/iltorb
       > node ./scripts/install.js || node-gyp rebuild
       
       info looking for cached prebuild @ /tmp/npmcache.9zIvU/_prebuilds/488314-iltorb-v2.4.5-node-v57-linux-x64.tar.gz
       http request GET https://github.com/nstepien/iltorb/releases/download/v2.4.5/iltorb-v2.4.5-node-v57-linux-x64.tar.gz
       http 200 https://github.com/nstepien/iltorb/releases/download/v2.4.5/iltorb-v2.4.5-node-v57-linux-x64.tar.gz
       info downloading to @ /tmp/npmcache.9zIvU/_prebuilds/488314-iltorb-v2.4.5-node-v57-linux-x64.tar.gz.2896-81c8d8dee5563.tmp
       info renaming to @ /tmp/npmcache.9zIvU/_prebuilds/488314-iltorb-v2.4.5-node-v57-linux-x64.tar.gz
       info unpacking @ /tmp/npmcache.9zIvU/_prebuilds/488314-iltorb-v2.4.5-node-v57-linux-x64.tar.gz
       info unpack resolved to /tmp/build_b5ba7a2b/node_modules/grunt-contrib-compress/node_modules/iltorb/build/bindings/iltorb.node
       info unpack required /tmp/build_b5ba7a2b/node_modules/grunt-contrib-compress/node_modules/iltorb/build/bindings/iltorb.node successfully
       info install Successfully installed iltorb binary!
       
       > [email protected] postinstall /tmp/build_b5ba7a2b/node_modules/karma/node_modules/core-js
       > node -e "try{require('./postinstall')}catch(e){}"
       
       
       > [email protected] postinstall /tmp/build_b5ba7a2b/node_modules/wdio-mocha-framework/node_modules/babel-runtime/node_modules/core-js
       > node -e "try{require('./postinstall')}catch(e){}"
       
       
       > [email protected] postinstall /tmp/build_b5ba7a2b/node_modules/wdio/node_modules/webdriverio/node_modules/babel-runtime/node_modules/core-js
       > node -e "try{require('./postinstall')}catch(e){}"
       
       npm ERR! Linux 4.4.0-1077-aws
       npm ERR! argv "/tmp/build_b5ba7a2b/.heroku/node/bin/node" "/tmp/build_b5ba7a2b/.heroku/node/bin/npm" "install" "--production=false" "--unsafe-perm" "--userconfig" "/tmp/build_b5ba7a2b/.npmrc"
       npm ERR! node v8.0.0
       npm ERR! npm  v2.14.22
       npm ERR! code ELIFECYCLE
       
       npm ERR! [email protected] postinstall: `node index.js`
       npm ERR! Exit status 1
       npm ERR! 
       npm ERR! Failed at the [email protected] postinstall script 'node index.js'.
       npm ERR! This is most likely a problem with the geckodriver package,
       npm ERR! not with npm itself.
       npm ERR! Tell the author that this fails on your system:
       npm ERR!     node index.js
       npm ERR! You can get information on how to open an issue for this project with:
       npm ERR!     npm bugs geckodriver
       npm ERR! Or if that isn't available, you can get their info via:
       npm ERR! 
       npm ERR!     npm owner ls geckodriver
       npm ERR! There is likely additional logging output above.
       
       npm ERR! Please include the following file with any support request:
       npm ERR!     /tmp/build_b5ba7a2b/npm-debug.log
-----> Build failed
       
       We're sorry this build is failing! You can troubleshoot common issues here:
       https://devcenter.heroku.com/articles/troubleshooting-node-deploys
       
       If you're stuck, please submit a ticket so we can help:
       https://help.heroku.com/
       
       Love,
       Heroku
       
 !     Push rejected, failed to compile Node.js app.
 !     Push failed

How to change the audio style

I've been trying to change the audio style for a few days.

I would like to tinker with the color and how it behaves, I needed to know which event triggers that greenish transform in the corner.

image below:

image

I would like to know which event triggers this green corner css.
I searched the javascript files and didn't find it and I would like at least one direction on how I can change its color. I looked at the site's documentation but it's not intuitive to find. I ask for help.

Do I need to find where I change the color of the event and where it fires on which line, file?
I need this setting to be for all users in the room.

express-4.17.1.tgz: 2 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - express-4.17.1.tgz

Fast, unopinionated, minimalist web framework

Library home page: https://registry.npmjs.org/express/-/express-4.17.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/express/package.json

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (express version) Remediation Possible** Reachability
CVE-2022-24999 High 7.5 Not Defined 1.9% qs-6.7.0.tgz Transitive 4.17.2
CVE-2024-29041 Medium 6.1 Not Defined 0.0% express-4.17.1.tgz Direct 4.19.0

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-24999

Vulnerable Library - qs-6.7.0.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.7.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/body-parser/node_modules/qs/package.json,/node_modules/express/node_modules/qs/package.json

Dependency Hierarchy:

  • express-4.17.1.tgz (Root Library)
    • qs-6.7.0.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).

Publish Date: 2022-11-26

URL: CVE-2022-24999

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 1.9%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999

Release Date: 2022-11-26

Fix Resolution (qs): 6.7.3

Direct dependency fix Resolution (express): 4.17.2

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-29041

Vulnerable Library - express-4.17.1.tgz

Fast, unopinionated, minimalist web framework

Library home page: https://registry.npmjs.org/express/-/express-4.17.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/express/package.json

Dependency Hierarchy:

  • express-4.17.1.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode using encodeurl on the contents before passing it to the location header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is res.location() but this is also called from within res.redirect(). The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.

Publish Date: 2024-03-25

URL: CVE-2024-29041

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rv95-896h-c2vc

Release Date: 2024-03-25

Fix Resolution: 4.19.0

⛑️ Automatic Remediation will be attempted for this issue.


⛑️Automatic Remediation will be attempted for this issue.

No video source error when cycling video on Android 11

Opentok.js version: 2.18.4

When trying to use the cycleVideo() method, I get an error for devices using Android 11.

The error is shown on the print is thrown by a similar code as this one:

         async switchCam() {
             if (publisher) {
                 try {
                     const newCamDevice = await publisher.cycleVideo();
                 } catch (err) {
                     console.error(err.message);
                 }
             }
         }

image

Maybe related to: opentok/opentok-android-sdk-samples#324

The same code works on:

  • Motorola Z (android 9)
  • Motorola Edge (android 10)
  • Galaxy S10 (android 10)
  • Xiaomi 9T (android 10)

The permissions were granted on all devices. It doesn't work on:

  • Pixel 3a (android 11)
  • Pixel 4a (android 11)

grunt-contrib-watch-1.1.0.tgz: 1 vulnerabilities (highest severity is: 7.8) - autoclosed

Vulnerable Library - grunt-contrib-watch-1.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-bower-task/node_modules/async/package.json,/node_modules/grunt-contrib-clean/node_modules/async/package.json,/node_modules/portscanner/node_modules/async/package.json,/node_modules/geoip-lite/node_modules/async/package.json,/node_modules/archiver/node_modules/async/package.json,/node_modules/grunt-contrib-watch/node_modules/async/package.json,/node_modules/grunt-contrib-less/node_modules/async/package.json

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in Remediation Available
CVE-2021-43138 High 7.8 async-2.6.3.tgz Transitive N/A

Details

CVE-2021-43138

Vulnerable Library - async-2.6.3.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-2.6.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-bower-task/node_modules/async/package.json,/node_modules/grunt-contrib-clean/node_modules/async/package.json,/node_modules/portscanner/node_modules/async/package.json,/node_modules/geoip-lite/node_modules/async/package.json,/node_modules/archiver/node_modules/async/package.json,/node_modules/grunt-contrib-watch/node_modules/async/package.json,/node_modules/grunt-contrib-less/node_modules/async/package.json

Dependency Hierarchy:

  • grunt-contrib-watch-1.1.0.tgz (Root Library)
    • async-2.6.3.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

Publish Date: 2022-04-06

URL: CVE-2021-43138

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138

Release Date: 2022-04-06

Fix Resolution: async - v3.2.2

npm install fails with npm version 6.14.8 and node v12.19.0 at [email protected]

Scenario: npm install with the subject versions
Issue:

npm ERR! code ELIFECYCLE
npm ERR! errno 1
npm ERR! [email protected] install: `node build.js || nodejs build.js`
npm ERR! Exit status 1
npm ERR!
npm ERR! Failed at the [email protected] install script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.

npm ERR! A complete log of this run can be found in:
npm ERR!     C:\Users\<obfuscated>\AppData\Roaming\npm-cache\_logs\2020-11-05T19_34_37_378Z-debug.log

Attachment:
npm install log file
2020-11-05T19_11_48_919Z-debug.zip

Root cause:
Incompatible versions of Node. (?)

Potential Solution:
Of course it is easy for me to ask "Please update your repo to support the latest version of NodeJS" - while I know what the pain could be. Its your call.
When I am ready, I could contribute :)

grunt-mocha-test-0.13.3.tgz: 1 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - grunt-mocha-test-0.13.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/minimist/package.json

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (grunt-mocha-test version) Remediation Possible** Reachability
CVE-2021-44906 Critical 9.8 Not Defined 3.5% minimist-1.2.5.tgz Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-44906

Vulnerable Library - minimist-1.2.5.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/minimist/package.json

Dependency Hierarchy:

  • grunt-mocha-test-0.13.3.tgz (Root Library)
    • mkdirp-0.5.5.tgz
      • minimist-1.2.5.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: 2022-03-17

URL: CVE-2021-44906

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 3.5%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-xvch-5gv4-984h

Release Date: 2022-03-17

Fix Resolution: minimist - 0.2.4,1.2.6

grunt-gitinfo-0.1.9.tgz: 1 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - grunt-gitinfo-0.1.9.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/getobject/package.json

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (grunt-gitinfo version) Remediation Possible** Reachability
CVE-2020-28282 Critical 9.8 Not Defined 0.8% getobject-0.1.0.tgz Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2020-28282

Vulnerable Library - getobject-0.1.0.tgz

get.and.set.deep.objects.easily = true

Library home page: https://registry.npmjs.org/getobject/-/getobject-0.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/getobject/package.json

Dependency Hierarchy:

  • grunt-gitinfo-0.1.9.tgz (Root Library)
    • getobject-0.1.0.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

Prototype pollution vulnerability in 'getobject' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.

Publish Date: 2020-12-29

URL: CVE-2020-28282

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.8%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/package/getobject

Release Date: 2020-12-29

Fix Resolution: getobject - 1.0.0

Heroku server

Is it possible to connect this rtc with my heroku server to generate and get the sessions?
How? Thanks

ejs-3.1.5.tgz: 3 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - ejs-3.1.5.tgz

Embedded JavaScript templates

Library home page: https://registry.npmjs.org/ejs/-/ejs-3.1.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ejs/package.json

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (ejs version) Remediation Possible** Reachability
WS-2021-0153 Critical 9.8 Not Defined ejs-3.1.5.tgz Direct 3.1.6
CVE-2022-29078 Critical 9.8 Not Defined 41.7% ejs-3.1.5.tgz Direct 3.1.7
CVE-2024-33883 High 8.8 Not Defined 0.1% ejs-3.1.5.tgz Direct ejs - 3.1.10

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

WS-2021-0153

Vulnerable Library - ejs-3.1.5.tgz

Embedded JavaScript templates

Library home page: https://registry.npmjs.org/ejs/-/ejs-3.1.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ejs/package.json

Dependency Hierarchy:

  • ejs-3.1.5.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

Arbitrary Code Injection vulnerability was found in ejs before 3.1.6. Caused by filename which isn't sanitized for display.

Publish Date: 2021-01-22

URL: WS-2021-0153

Threat Assessment

Exploit Maturity: Not Defined

EPSS:

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-01-22

Fix Resolution: 3.1.6

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-29078

Vulnerable Library - ejs-3.1.5.tgz

Embedded JavaScript templates

Library home page: https://registry.npmjs.org/ejs/-/ejs-3.1.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ejs/package.json

Dependency Hierarchy:

  • ejs-3.1.5.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).

Publish Date: 2022-04-25

URL: CVE-2022-29078

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 41.7%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29078~

Release Date: 2022-04-25

Fix Resolution: 3.1.7

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-33883

Vulnerable Library - ejs-3.1.5.tgz

Embedded JavaScript templates

Library home page: https://registry.npmjs.org/ejs/-/ejs-3.1.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ejs/package.json

Dependency Hierarchy:

  • ejs-3.1.5.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.

Publish Date: 2024-04-28

URL: CVE-2024-33883

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-33883

Release Date: 2024-04-28

Fix Resolution: ejs - 3.1.10

⛑️ Automatic Remediation will be attempted for this issue.


⛑️Automatic Remediation will be attempted for this issue.

grunt-bower-task-0.5.0.tgz: 6 vulnerabilities (highest severity is: 9.1)

Vulnerable Library - grunt-bower-task-0.5.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-bower-task/node_modules/lodash/package.json

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (grunt-bower-task version) Remediation Possible** Reachability
CVE-2019-10744 Critical 9.1 Not Defined 2.1% lodash-0.10.0.tgz Transitive 0.6.0
CVE-2020-8203 High 7.4 Not Defined 1.7% lodash-0.10.0.tgz Transitive 0.6.0
CVE-2021-23337 High 7.2 Not Defined 0.6% lodash-0.10.0.tgz Transitive 0.6.0
CVE-2019-1010266 Medium 6.5 Not Defined 0.4% lodash-0.10.0.tgz Transitive 0.6.0
CVE-2018-16487 Medium 5.6 Not Defined 0.1% lodash-0.10.0.tgz Transitive 0.6.0
CVE-2020-28500 Medium 5.3 Not Defined 0.2% lodash-0.10.0.tgz Transitive 0.6.0

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2019-10744

Vulnerable Library - lodash-0.10.0.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-0.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-bower-task/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-bower-task-0.5.0.tgz (Root Library)
    • lodash-0.10.0.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 2.1%

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-26

Fix Resolution (lodash): 4.17.12

Direct dependency fix Resolution (grunt-bower-task): 0.6.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-8203

Vulnerable Library - lodash-0.10.0.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-0.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-bower-task/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-bower-task-0.5.0.tgz (Root Library)
    • lodash-0.10.0.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 1.7%

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-07-15

Fix Resolution (lodash): 4.17.9

Direct dependency fix Resolution (grunt-bower-task): 0.6.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-23337

Vulnerable Library - lodash-0.10.0.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-0.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-bower-task/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-bower-task-0.5.0.tgz (Root Library)
    • lodash-0.10.0.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.6%

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-35jh-r3h4-6jhm

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (grunt-bower-task): 0.6.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2019-1010266

Vulnerable Library - lodash-0.10.0.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-0.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-bower-task/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-bower-task-0.5.0.tgz (Root Library)
    • lodash-0.10.0.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.4%

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-07-17

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (grunt-bower-task): 0.6.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2018-16487

Vulnerable Library - lodash-0.10.0.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-0.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-bower-task/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-bower-task-0.5.0.tgz (Root Library)
    • lodash-0.10.0.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/380873

Release Date: 2019-02-01

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (grunt-bower-task): 0.6.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-28500

Vulnerable Library - lodash-0.10.0.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-0.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt-bower-task/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-bower-task-0.5.0.tgz (Root Library)
    • lodash-0.10.0.tgz (Vulnerable Library)

Found in HEAD commit: 7c898c0839317ea7989d15935972aa4dc520b907

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Mend Note: After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.

Publish Date: 2021-02-15

URL: CVE-2020-28500

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.2%

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (grunt-bower-task): 0.6.0

⛑️ Automatic Remediation will be attempted for this issue.


⛑️Automatic Remediation will be attempted for this issue.

Bug with iframe

Hi i install app on heroku and do all you say :

I want to load my iframe into my site www.xxxxxx.com from iframe https://XXXXXXXX.herokuapp.com"

// Do we want to allow being used inside an iframe?
E.ALLOW_IFRAMING = { envVar: 'ALLOW_IFRAMING', jsonPath: 'allowIframing', defaultValue: 'always' };

but in rtcApp.js
// Note that since the server forbids loading the content on an iframe this should not execute.
// But it doesn't hurt either
if (window.top !== window.self && !window.iframing_allowed) {
// If we're being loaded inside an iframe just hijack the top level window and go back to
// the index page.
window.top.document.location = '/index.html';
}

I don t understand what i must to do exactly

I got JS error
rtcApp.js:62 Uncaught DOMException: Blocked a frame with origin "https://XXXXXXXX.herokuapp.com" from accessing a cross-origin frame.
at startApp (https://XXXXXXXX.herokuapp.com/js/rtcApp.js:62:16)

Thanks for your help

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.