Vulnerabilities

 2 via 14 paths

Dependencies

 229

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 2
Status
  • 2
  • 0
  • 0

high severity
new

Improper Authorization

  • Vulnerable module: http-cache-semantics
  • Introduced through: licensee@12.0.2

Detailed paths

  • Introduced through: license-badger@brettz9/license-badger › licensee@12.0.2 › @npmcli/arborist@9.9.2 › npm-registry-fetch@19.1.1 › make-fetch-happen@15.0.6 › http-cache-semantics@4.2.0
  • Introduced through: license-badger@brettz9/license-badger › licensee@12.0.2 › @npmcli/arborist@9.9.2 › pacote@21.5.1 › npm-registry-fetch@19.1.1 › make-fetch-happen@15.0.6 › http-cache-semantics@4.2.0
  • Introduced through: license-badger@brettz9/license-badger › licensee@12.0.2 › @npmcli/arborist@9.9.2 › @npmcli/metavuln-calculator@9.0.3 › pacote@21.5.1 › npm-registry-fetch@19.1.1 › make-fetch-happen@15.0.6 › http-cache-semantics@4.2.0
  • Introduced through: license-badger@brettz9/license-badger › licensee@12.0.2 › @npmcli/arborist@9.9.2 › pacote@21.5.1 › sigstore@4.1.1 › @sigstore/sign@4.1.1 › make-fetch-happen@15.0.6 › http-cache-semantics@4.2.0
  • Introduced through: license-badger@brettz9/license-badger › licensee@12.0.2 › @npmcli/arborist@9.9.2 › @npmcli/metavuln-calculator@9.0.3 › pacote@21.5.1 › sigstore@4.1.1 › @sigstore/sign@4.1.1 › make-fetch-happen@15.0.6 › http-cache-semantics@4.2.0
  • Introduced through: license-badger@brettz9/license-badger › licensee@12.0.2 › @npmcli/arborist@9.9.2 › pacote@21.5.1 › sigstore@4.1.1 › @sigstore/tuf@4.0.2 › tuf-js@4.1.0 › make-fetch-happen@15.0.6 › http-cache-semantics@4.2.0
  • Introduced through: license-badger@brettz9/license-badger › licensee@12.0.2 › @npmcli/arborist@9.9.2 › @npmcli/metavuln-calculator@9.0.3 › pacote@21.5.1 › sigstore@4.1.1 › @sigstore/tuf@4.0.2 › tuf-js@4.1.0 › make-fetch-happen@15.0.6 › http-cache-semantics@4.2.0

Overview

Affected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client max-stale directives. An unauthenticated attacker can request the same URL with a large max-stale value to retrieve cached responses belonging to other users, including Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.

Remediation

There is no fixed version for http-cache-semantics.

References

Improper Authorization vulnerability report

high severity
new

Origin Validation Error

  • Vulnerable module: http-cache-semantics
  • Introduced through: licensee@12.0.2

Detailed paths

  • Introduced through: license-badger@brettz9/license-badger › licensee@12.0.2 › @npmcli/arborist@9.9.2 › npm-registry-fetch@19.1.1 › make-fetch-happen@15.0.6 › http-cache-semantics@4.2.0
  • Introduced through: license-badger@brettz9/license-badger › licensee@12.0.2 › @npmcli/arborist@9.9.2 › pacote@21.5.1 › npm-registry-fetch@19.1.1 › make-fetch-happen@15.0.6 › http-cache-semantics@4.2.0
  • Introduced through: license-badger@brettz9/license-badger › licensee@12.0.2 › @npmcli/arborist@9.9.2 › @npmcli/metavuln-calculator@9.0.3 › pacote@21.5.1 › npm-registry-fetch@19.1.1 › make-fetch-happen@15.0.6 › http-cache-semantics@4.2.0
  • Introduced through: license-badger@brettz9/license-badger › licensee@12.0.2 › @npmcli/arborist@9.9.2 › pacote@21.5.1 › sigstore@4.1.1 › @sigstore/sign@4.1.1 › make-fetch-happen@15.0.6 › http-cache-semantics@4.2.0
  • Introduced through: license-badger@brettz9/license-badger › licensee@12.0.2 › @npmcli/arborist@9.9.2 › @npmcli/metavuln-calculator@9.0.3 › pacote@21.5.1 › sigstore@4.1.1 › @sigstore/sign@4.1.1 › make-fetch-happen@15.0.6 › http-cache-semantics@4.2.0
  • Introduced through: license-badger@brettz9/license-badger › licensee@12.0.2 › @npmcli/arborist@9.9.2 › pacote@21.5.1 › sigstore@4.1.1 › @sigstore/tuf@4.0.2 › tuf-js@4.1.0 › make-fetch-happen@15.0.6 › http-cache-semantics@4.2.0
  • Introduced through: license-badger@brettz9/license-badger › licensee@12.0.2 › @npmcli/arborist@9.9.2 › @npmcli/metavuln-calculator@9.0.3 › pacote@21.5.1 › sigstore@4.1.1 › @sigstore/tuf@4.0.2 › tuf-js@4.1.0 › make-fetch-happen@15.0.6 › http-cache-semantics@4.2.0

Overview

Affected versions of this package are vulnerable to Origin Validation Error via the _varyMatches() function, which fails to properly handle Vary: * (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The Vary: * directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.

Remediation

There is no fixed version for http-cache-semantics.

References

Origin Validation Error vulnerability report