Vulnerabilities

 3 via 3 paths

Dependencies

 11

Source

 npm
Find a vulnerability free version of dockerode | View dockerode package health on Snyk Advisor

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 2
  • 1
Status
  • 3
  • 0
  • 0

medium severity

Arbitrary Code Injection

  • Vulnerable module: underscore
  • Introduced through: underscore@1.5.2

Detailed paths

  • Introduced through: dockerode@2.0.7 › underscore@1.5.2
    Remediation: Upgrade to dockerode@2.1.0.

Overview

underscore is a JavaScript's functional programming helper library.

Affected versions of this package are vulnerable to Arbitrary Code Injection via the template function, particularly when the variable option is taken from _.templateSettings as it is not sanitized.

PoC

const _ = require('underscore');
_.templateSettings.variable = "a = this.process.mainModule.require('child_process').execSync('touch HELLO')";
const t = _.template("")();

Remediation

Upgrade underscore to version 1.13.0-2, 1.12.1 or higher.

References

Arbitrary Code Injection vulnerability report

medium severity

Information Exposure

  • Vulnerable module: follow-redirects
  • Introduced through: docker-modem@0.1.23

Detailed paths

  • Introduced through: dockerode@2.0.7 › docker-modem@0.1.23 › follow-redirects@0.0.3
    Remediation: Upgrade to dockerode@2.2.8.

Overview

Affected versions of this package are vulnerable to Information Exposure by leaking the cookie header to a third party site in the process of fetching a remote URL with the cookie in the request body. If the response contains a location header, it will follow the redirect to another URL of a potentially malicious actor, to which the cookie would be exposed.

Remediation

Upgrade follow-redirects to version 1.14.7 or higher.

References

Information Exposure vulnerability report

low severity

Information Exposure

  • Vulnerable module: follow-redirects
  • Introduced through: docker-modem@0.1.23

Detailed paths

  • Introduced through: dockerode@2.0.7 › docker-modem@0.1.23 › follow-redirects@0.0.3
    Remediation: Upgrade to dockerode@2.2.8.

Overview

Affected versions of this package are vulnerable to Information Exposure due a leakage of the Authorization header from the same hostname during HTTPS to HTTP redirection. An attacker who can listen in on the wire (or perform a MITM attack) will be able to receive the Authorization header due to the usage of the insecure HTTP protocol which does not verify the hostname the request is sending to.

Remediation

Upgrade follow-redirects to version 1.14.8 or higher.

References

Information Exposure vulnerability report