CVE-2022-25883 (Medium) detected in multiple libraries

[mend-for-github-com]

CVE-2022-25883 - Medium Severity Vulnerability

Vulnerable Libraries - semver-7.0.0.tgz, semver-7.3.2.tgz, semver-7.3.8.tgz, semver-5.7.1.tgz, semver-6.3.0.tgz

semver-7.0.0.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-7.0.0.tgz

Dependency Hierarchy:

• @osd/pm-1.0.0.tgz (Root Library)
  • preset-env-7.16.11.tgz
    • core-js-compat-3.21.1.tgz
      • ❌ semver-7.0.0.tgz (Vulnerable Library)

semver-7.3.2.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-7.3.2.tgz

Dependency Hierarchy:

• ems-client-7.10.0.tgz (Root Library)
  • ❌ semver-7.3.2.tgz (Vulnerable Library)

semver-7.3.8.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-7.3.8.tgz

Dependency Hierarchy:

• eslint-plugin-3.10.1.tgz (Root Library)
  • ❌ semver-7.3.8.tgz (Vulnerable Library)

semver-5.7.1.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-5.7.1.tgz

Dependency Hierarchy:

• ❌ semver-5.7.1.tgz (Vulnerable Library)

semver-6.3.0.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-6.3.0.tgz

Dependency Hierarchy:

• @osd/pm-1.0.0.tgz (Root Library)
  • preset-env-7.16.11.tgz
    • babel-plugin-polyfill-corejs2-0.3.1.tgz
      • ❌ semver-6.3.0.tgz (Vulnerable Library)

Found in HEAD commit: cba076465f44b6a819e3cff7986ff4cd21a66371

Found in base branch: main

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-06-21

Fix Resolution: 7.5.2

[ananzh]

Analysis

semver is integrated across numerous packages, each possessing a unique range of APIs. As we prepare to increment to a major new version of semver, it becomes essential to assess the potential implications of the resulting breaking changes. Below is an overview of the semver versions currently in use by different packages and the corresponding API usage for each package. We only focus on 5.x and 6.x and don't perform an API comparison between the different 7.x versions as there are no breaking changes between the lower 7.x versions and the target version 7.5.3.

• semver 5.x

Package	API	Notes
[email protected]	semver.satisfies	No changes in the usage or function of satisfies between versions 5.7.1 and 7.5.3
[email protected]	semver.satisfies	No changes in the usage or function of satisfies between versions 5.7.1 and 7.5.3
[email protected]	semver.intersect,csemver.satisfies,csemver.validRange, semver.inc, semver.prerelease	The function inc has changed but should not affect usage. No major changes in the other APIs
enzyme-adapter-utils@^1.14.0	semver.intersect,csemver.satisfies,csemver.validRange, semver.inc, semver.prerelease	The function inc has changed but should not affect usage. No major changes in the other APIs
[email protected]	semver.satisfies, semver.validRange	No changes in the usage or function of satisfies and validRange between versions 5.7.1 and 7.5.3

• semver 6.x

Packages	API	Notes
[email protected]	semver.satisfies	There are no changes in the satisfies function from [email protected] to [email protected].
[email protected]	semver.lt, semver.major, semver.validRange, semver.intersects, semver.Range	There are no changes in the lt , major, validRange and intersects function from [email protected] to [email protected]. There are significant changes in the Range class from [email protected] to [email protected], like change in class definition, the addition of includePrerelease option, improved range string parsing and error handling. The Range object is not directly used in eslint-plugin-node . However, the getConfiguredNodeVersion function and getSemverRange function might return an instance of the Range class. Therefore it seems not create any breaking changes.
[email protected]	semver.inc, semver.major, semver.valid, semver.compare, semver.satisfies, semver.ltr	Only the inc function has changed, but it doesn't affect eslint usage because extra optional arguments are not used in this case.
[email protected]	semver.lt	lt function is the same in both versions, no issues for migration.
[email protected]	semver.satisfies, semver.gt, semver.gte, semver.lt, semver.validRange	All used functions maintain the same functionality, no issues for migration.
@babel/[email protected]	semver.valid, semver.lt, semver.gt, semver.satisfies, semver.coerce, semver.intersects, semver.parse, semver.inc, semver.gte, semver.clean	All used functions except semver.parse maintain the same functionality. semver.parse has an additional throwErrors flag in 7.5.3, but it doesn't affect the current usage in @babel/[email protected] because the flag is not used.
[email protected]	semver.coerce, semver.satisfies, semver.major	All used functions maintain the same functionality, no issues for migration.
@babel/[email protected]	semver.lt, semver.gt, semver.valid, semver.satisfies, semver.intersects, semver.clean, semver.major, semver.minor, semver.patch	All used functions maintain the same functionality, no issues for migration.
@babel/[email protected]	Same as @babel/[email protected]	Same as @babel/[email protected]
@babel/[email protected]	Same as @babel/[email protected]	Same as @babel/[email protected]
[email protected]	semver.SemVer, semver.gte, semver.valid	The SemVer class has changed in 7.5.3, but it doesn't affect elastic-apm-http-client because only the major property is used, which is parsed the same way in both versions.

• [email protected]

  • core-js-compat

• [email protected]

  • @elastic/ems-client

• [email protected]

  • @typescript-eslint/typescript-estree
  • @typescript-eslint/eslint-plugin
  • @microsoft/api-extractor
  • sass-loader
  • meow
  • postcss-loader
  • @npmcli/fs
  • css-loader
  • superagent
  • @rushstack/node-core-library
  • jest-snapshot
  • @typescript-eslint/utils
  • node-gyp
  • make-fetch-happen

In conclusion, while there have been changes to the semver library between versions 5.x/6.x and 7.5.3, it appears that none of these changes should break the libraries we are using, given their current usage of the semver functions.