OWASP/cve-lite-cli v1.41.1

v1.41.1 - Security fixes for Yarn aliases, cd fix commands and repository registries

on GitHub

Upgrade note. This release contains three security fixes and nothing else. If your project's own .npmrc or .yarnrc.yml points at an internal or plain-HTTP registry, metadata lookups to it are now refused. To use it for a scan, set NPM_CONFIG_REGISTRY, or remove the registry from the project's config and set it in your user-level config (~/.npmrc or ~/.yarnrc.yml); on Windows, use the user-level config. See the corporate proxy docs.

Security

• Yarn classic (v1) projects that install a package through an npm alias, such as "util-lib": "npm:lodash@4.17.20", are now scanned under the real package name. The alias was looked up under a name that does not exist, so a vulnerable package reported "No known vulnerabilities found" and passed --fail-on. Fix commands keep the alias, for example yarn add util-lib@npm:lodash@4.18.1 (GHSA-c8j3-f9pr-q5jg).
• Folder names are now quoted in the copyable cd fix commands printed in the terminal and the HTML report, including override fix commands. A repository folder named with shell syntax could otherwise run a command when the suggestion was pasted (GHSA-5r8q-h59x-3m7v).
• Registry addresses taken from the scanned repository's .npmrc or .yarnrc.yml must now use HTTPS and resolve to public addresses, checked for every connection, and redirects are refused, both for remediation lookups and for the override audit. This also applies when npm or npx passes the repository's registry on to the scanner as npm_config_registry. A repository could otherwise make the scanner send requests to internal addresses (GHSA-2v68-94gw-jr4g).

Validation

• npm test
• npm run build

Contributors

• @alex-powell reported and fixed the Yarn alias issue
• @vianmangal reported and fixed the folder-name and registry issues
• @Nachiket-Roy found the registry issue independently