Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Security upgrade @angular-devkit/build-angular from 13.0.4 to 13.1.0 #75

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Security upgrade @angular-devkit/build-angular from 13.0.4 to 13.1.0 #75

wants to merge 1 commit into from

Conversation

acn-tesch
Copy link

snyk-top-banner

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

  • packages/node/base/package.json
  • packages/node/base/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

Issue Score
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-CROSSSPAWN-8303230		   170  

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

@snyk-bot
fix: packages/node/base/package.json & packages/node/base/package-loc…
500c97f 
…k.json to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230
@acn-tesch
Copy link
Author

Logo
Checkmarx One – Scan Summary & Details – 2c238f2d-75f3-4f03-80a1-511f5a9f11d9

New Issues

Severity Issue Source File / Package Checkmarx Insight
HIGH Aurora With Disabled at Rest Encryption /rds.tf: 49 Amazon Aurora does not have encryption for data at rest enabled. To prevent such a scenario, update the attribute 'StorageEncrypted' to 'true'.
HIGH Aurora With Disabled at Rest Encryption /rds.tf: 113 Amazon Aurora does not have encryption for data at rest enabled. To prevent such a scenario, update the attribute 'StorageEncrypted' to 'true'.
HIGH Aurora With Disabled at Rest Encryption /rds.tf: 65 Amazon Aurora does not have encryption for data at rest enabled. To prevent such a scenario, update the attribute 'StorageEncrypted' to 'true'.
HIGH Aurora With Disabled at Rest Encryption /rds.tf: 1 Amazon Aurora does not have encryption for data at rest enabled. To prevent such a scenario, update the attribute 'StorageEncrypted' to 'true'.
HIGH Aurora With Disabled at Rest Encryption /rds.tf: 97 Amazon Aurora does not have encryption for data at rest enabled. To prevent such a scenario, update the attribute 'StorageEncrypted' to 'true'.
HIGH Aurora With Disabled at Rest Encryption /rds.tf: 81 Amazon Aurora does not have encryption for data at rest enabled. To prevent such a scenario, update the attribute 'StorageEncrypted' to 'true'.
HIGH Aurora With Disabled at Rest Encryption /rds.tf: 17 Amazon Aurora does not have encryption for data at rest enabled. To prevent such a scenario, update the attribute 'StorageEncrypted' to 'true'.
HIGH Aurora With Disabled at Rest Encryption /rds.tf: 130 Amazon Aurora does not have encryption for data at rest enabled. To prevent such a scenario, update the attribute 'StorageEncrypted' to 'true'.
HIGH Aurora With Disabled at Rest Encryption /rds.tf: 33 Amazon Aurora does not have encryption for data at rest enabled. To prevent such a scenario, update the attribute 'StorageEncrypted' to 'true'.
HIGH CVE-2023-42282 Npm-ip-1.1.5 Vulnerable Package
HIGH CVE-2023-45133 Npm-@babel/traverse-7.16.5 Vulnerable Package
HIGH CVE-2023-45133 Npm-@babel/traverse-7.8.6 Vulnerable Package
HIGH CVE-2024-27088 Npm-es5-ext-0.10.53 Vulnerable Package
HIGH CVE-2024-27351 Python-Django-1.2 Vulnerable Package
HIGH CVE-2024-29180 Npm-webpack-dev-middleware-5.2.2 Vulnerable Package
HIGH CVE-2024-29415 Npm-ip-1.1.5 Vulnerable Package
HIGH CVE-2024-37890 Npm-ws-8.2.3 Vulnerable Package
HIGH CVE-2024-37890 Npm-ws-7.4.6 Vulnerable Package
HIGH CVE-2024-37890 Npm-ws-7.5.6 Vulnerable Package
HIGH CVE-2024-38355 Npm-socket.io-4.4.0 Vulnerable Package
HIGH CVE-2024-38875 Python-Django-1.2 Vulnerable Package
HIGH CVE-2024-39330 Python-Django-1.2 Vulnerable Package
HIGH CVE-2024-39614 Python-Django-1.2 Vulnerable Package
HIGH CVE-2024-4068 Npm-braces-2.3.2 Vulnerable Package
HIGH CVE-2024-4068 Npm-braces-3.0.2 Vulnerable Package
HIGH CVE-2024-41989 Python-Django-1.2 Vulnerable Package
HIGH CVE-2024-41990 Python-Django-1.2 Vulnerable Package
HIGH CVE-2024-41991 Python-Django-1.2 Vulnerable Package
HIGH CVE-2024-42005 Python-Django-1.2 Vulnerable Package
HIGH CVE-2024-45296 Npm-path-to-regexp-0.1.7 Vulnerable Package
HIGH CVE-2024-45296 Npm-path-to-regexp-1.8.0 Vulnerable Package
HIGH CVE-2024-45590 Npm-body-parser-1.19.0 Vulnerable Package
HIGH CVE-2024-47178 Npm-basic-auth-connect-1.0.0 Vulnerable Package
HIGH Cx22d7540f-80c2 Npm-angular-1.8-1.8.2 Vulnerable Package
HIGH Cx7d3bd13f-4c2a Npm-angular-1.8-1.8.2 Vulnerable Package
HIGH Cxdd90df0b-e1ac Npm-angular-1.8-1.8.2 Vulnerable Package
HIGH Cxeaf4b44b-15c8 Npm-angular-mocks-1.8-1.8.2 Vulnerable Package
HIGH Passwords And Secrets - Generic Access Key /lambda.tf: 45 Query to find passwords and secrets in infrastructure code.
HIGH Passwords And Secrets - Generic Access Key /providers.tf: 10 Query to find passwords and secrets in infrastructure code.
HIGH Passwords And Secrets - Generic Password /sql.tf: 50 Query to find passwords and secrets in infrastructure code.
HIGH Passwords And Secrets - Generic Password /instance.tf: 11 Query to find passwords and secrets in infrastructure code.
HIGH Passwords And Secrets - Generic Password /instance.tf: 45 Query to find passwords and secrets in infrastructure code.
HIGH Sensitive Port Is Exposed To Entire Network /ec2.tf: 83 A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
HIGH Sensitive Port Is Exposed To Entire Network /ec2.tf: 83 A sensitive port, such as port 23 or port 110, is open for the whole network in either TCP or UDP protocol
MEDIUM CVE-2023-26159 Npm-follow-redirects-1.14.6 Vulnerable Package
MEDIUM CVE-2023-44270 Npm-postcss-8.4.4 Vulnerable Package
MEDIUM CVE-2023-44270 Npm-postcss-7.0.39 Vulnerable Package
MEDIUM CVE-2024-25710 Maven-org.apache.commons:commons-compress-1.20 Vulnerable Package
MEDIUM CVE-2024-25710 Maven-org.apache.commons:commons-compress-1.15 Vulnerable Package
MEDIUM CVE-2024-28849 Npm-follow-redirects-1.14.6 Vulnerable Package
MEDIUM CVE-2024-28863 Npm-tar-4.4.19 Vulnerable Package
MEDIUM CVE-2024-28863 Npm-tar-6.1.11 Vulnerable Package
MEDIUM CVE-2024-29041 Npm-express-4.17.1 Vulnerable Package
MEDIUM CVE-2024-37168 Npm-@grpc/grpc-js-1.4.4 Vulnerable Package
MEDIUM CVE-2024-38820 Maven-org.springframework:spring-core-5.3.0 Vulnerable Package
MEDIUM CVE-2024-38999 Npm-requirejs-2.3.6 Vulnerable Package
MEDIUM CVE-2024-39329 Python-Django-1.2 Vulnerable Package
MEDIUM CVE-2024-4067 Npm-micromatch-3.1.10 Vulnerable Package
MEDIUM CVE-2024-4067 Npm-micromatch-4.0.4 Vulnerable Package
MEDIUM CVE-2024-43788 Npm-webpack-5.65.0 Vulnerable Package
MEDIUM CVE-2024-43796 Npm-express-4.17.1 Vulnerable Package
MEDIUM CVE-2024-43799 Npm-send-0.17.1 Vulnerable Package
MEDIUM CVE-2024-43800 Npm-serve-static-1.14.1 Vulnerable Package
MEDIUM CVE-2024-45231 Python-Django-1.2 Vulnerable Package
MEDIUM CVE-2024-47068 Npm-rollup-1.11.3 Vulnerable Package
MEDIUM CVE-2024-47068 Npm-rollup-2.59.0 Vulnerable Package
MEDIUM CVE-2024-47764 Npm-cookie-0.4.1 Vulnerable Package
MEDIUM CVE-2024-47764 Npm-cookie-0.4.0 Vulnerable Package
MEDIUM Unpinned Actions Full Length Commit SHA /pull_request.yaml: 14 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
MEDIUM Unpinned Actions Full Length Commit SHA /semgrep.yml: 14 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
MEDIUM Unpinned Actions Full Length Commit SHA /build.yaml: 15 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
MEDIUM Unpinned Actions Full Length Commit SHA /pull_request.yaml: 14 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
MEDIUM Unpinned Actions Full Length Commit SHA /semgrep.yml: 14 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
MEDIUM Unpinned Actions Full Length Commit SHA /build.yaml: 15 Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps...
LOW CVE-2024-4128 Npm-firebase-tools-9.23.1 Vulnerable Package
LOW IAM Access Analyzer Not Enabled /logging.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /application_gateway.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /big_data.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /gke.tf: 6 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /instance.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /bucket.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /resource_group.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /roles.tf: 3 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /rds.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /trail.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /key_vault.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /es.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /storage.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /random.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /elb.tf: 2 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /iam.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /security_center.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /instances.tf: 3 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /ec2.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /gcs.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /networking.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /aks.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /eks.tf: 19 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /s3.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /sql.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /compartment.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /db-app.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /lambda.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /networks.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /kms.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /policies.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /ecr.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /rds.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /app_service.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /mssql.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW IAM Access Analyzer Not Enabled /neptune.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions

Fixed Issues

Severity Issue Source File / Package
HIGH Cx6b921f00-d395 Npm-vm2-3.9.5
HIGH Cxf6e7f2c1-dc59 Npm-yauzl-2.10.0
HIGH S3 Bucket SSE Disabled /ec2.tf: 271
HIGH S3 Bucket SSE Disabled /s3.tf: 65
HIGH S3 Bucket SSE Disabled /s3.tf: 89
HIGH S3 Bucket SSE Disabled /s3.tf: 42
HIGH S3 Bucket SSE Disabled /s3.tf: 1
HIGH S3 Bucket Without Enabled MFA Delete /ec2.tf: 271
HIGH S3 Bucket Without Enabled MFA Delete /s3.tf: 1
HIGH S3 Bucket Without Enabled MFA Delete /s3.tf: 42
MEDIUM CVE-2007-2379 Npm-jquery-3.6.0
MEDIUM CVE-2014-6071 Npm-jquery-3.6.0
LOW CVE-2023-2251 Npm-yaml-1.10.2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@acn-tesch @snyk-bot