Skip to content

Bump express to 4.16.2 to address forwarded vulnerability #1198

Closed
Closed
Bump express to 4.16.2 to address forwarded vulnerability#1198
Assignees
shellscape
Labels
severity: 1 (security)type: ci

Description

@tancnle
tancnle
opened on Nov 23, 2017
  • Operating System: MacOS 10.13.1
  • Node Version: 8.9.1
  • NPM Version: 5.5.1
  • webpack Version:
  • webpack-dev-server Version: 2.9.4
  • This is a bug
  • This is a feature request
  • This is a modification request

Our most recent sourceclear scan (https://www.sourceclear.com/) has revealed a vulnerability in forwarded library which can cause regular expression denial of service (ReDoS). A flaw when the x-forwarded-for header is parsed causes the event loop to be blocked. To mitigate this, we need to bump forwarded to 0.1.2.

Dependency tree for express, before:

webpack-dev-server@2.9.4
└─┬ express@4.15.4
  └─┬ proxy-addr@1.1.5
    └── forwarded@0.1.1

after:

webpack-dev-server@2.9.4
└─┬ express@4.16.2
  └─┬ proxy-addr@2.0.2
    └── forwarded@0.1.2

Activity

  1. alexander-akait
    added
    priority: 1 (critical)
    severity: 1 (security)
    on Nov 23, 2017
  2. alexander-akait
    assigned
    shellscape
    on Nov 23, 2017

  3. shellscape commented on Nov 23, 2017

    @shellscape
    shellscape
    on Nov 23, 2017
    Contributor

    @tancnle thanks for checking in. I'd recommend you check out nsp versus sourceclear. NSP is picking up 11 similar vulnerabilities. however, it's important to note that webpack-dev-server is only meant to be run locally, and temporarily for the purpose of debugging. unless you're planning on attacking your own machine, you're not in much danger from the current list.

  4. tancnle commented on Nov 23, 2017

    @tancnle
    tancnle
    on Nov 23, 2017
    Author

    @shellscape Fair point. With that in mind, this is more of less of dependency bumps to keep things up-to-dated. I guess we can close it in favour of larger update later on.

  5. tancnle
    closed this as completedon Nov 23, 2017
  6. shellscape
    reopened this on Nov 23, 2017

  7. shellscape commented on Nov 23, 2017

    @shellscape
    shellscape
    on Nov 23, 2017
    Contributor

    I'm actually going to reopen this so we can track it in a change to come, and make sure you get credit for the original report in the commit 🍻

  8. shellscape
    added
    type: ci
    and removed
    priority: 1 (critical)
    on Nov 23, 2017
  9. shellscape
    closed this as completedin 6b2d7a0on Nov 27, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

severity: 1 (security)type: ci

Type

No type

Fields

Priority

None yet

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions