DoS vulnerability from dicer@0.2.5

Question

DoS vulnerability from dicer@0.2.5

mrded opened this issue 3 years ago · 15 comments

Hello,

Snyk is reporting a vulnerability in this repo, that is coming from the Dicer library:

Issues with no direct upgrade or patch:
  ✗ Denial of Service (DoS) [High Severity][https://snyk.io/vuln/SNYK-JS-DICER-2311764] in dicer@0.2.5
    introduced by multer@1.4.4 > busboy@0.2.14 > dicer@0.2.5
  No upgrade or patch available

Updating busboy@^1.0.0 drops the dependency on dicer (where the vuln comes from).

Thanks

mrded commented 3 years ago

#1096

Answer 1 · 2022-05-23T09:51:34.000Z

Better solution: #1097

Answer 2 · 2022-05-26T06:56:32.000Z

@mrded Thanks for raising this PR 1097. Request the team to merge this soon. As github is also reporting a high vulnerability which will get fixed with this busboy version upgrade. GHSA-wm7h-9275-46v2

Answer 3 · 2022-05-26T06:59:36.000Z

High Crash in HeaderParser in dicer

Package dicer

Patched in No patch available

Dependency of multer

Path multer > busboy > dicer

Answer 4 · 2022-06-06T15:54:33.000Z

We need that fix, i don't like Severity: high, a warning is fine not red notifications.

Answer 5 · 2022-06-15T07:29:41.000Z

I need this

Answer 6 · 2022-06-15T09:41:11.000Z

This is fixed in version 1.4.5-lts.1. That version has a breaking change in that it's not compatible with older versions of Node.js anymore. If anyone can contribute a backwards-compatible patch we could release that as 1.4.5 without the -lts.1 postfix.

Answer 7 · 2022-06-15T16:12:27.000Z

Thank you it works.

Answer 8 · 2022-06-16T02:01:37.000Z

What versions of Node are compatible?

Answer 9 · 2022-06-16T07:32:58.000Z

What versions of Node are compatible?

v10.16.0 or newer

Answer 10 · 2022-06-21T05:52:07.000Z

i've upgraded all my projects to 16 lts

…

________________________________ From: Linus Unnebäck ***@***.***> Sent: Thursday, June 16, 2022 10:33 To: expressjs/multer ***@***.***> Cc: victorKariuki ***@***.***>; Comment ***@***.***> Subject: Re: [expressjs/multer] DoS vulnerability from ***@***.*** (Issue #1095) What versions of Node are compatible? v10.16.0 or newer — Reply to this email directly, view it on GitHub<#1095 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ATTZYI52BNNIQIE56WDBTMDVPLKDNANCNFSM5WP4UIOQ>. You are receiving this because you commented.Message ID: ***@***.***>

Answer 11 · 2022-06-30T14:31:22.000Z

This is fixed in version 1.4.5-lts.1. That version has a breaking change in that it's not compatible with older versions of Node.js anymore. If anyone can contribute a backwards-compatible patch we could release that as 1.4.5 without the -lts.1 postfix.

Has this been done or we should do npm i multer@1.4.5-lts.1?

Answer 12 · 2022-07-06T11:20:16.000Z

@LinusU perhaps a good reason to release it as 2.0 to indicate a breaking change (removing support for older node versions)?

Answer 13 · 2022-09-09T07:56:59.000Z

Is any way to resolve this issue?

Answer 14 · 2022-10-30T14:48:07.000Z

@bryanph there is already another 2.0 release line with multiple releases

@ZhaoKunLong @ashish1497 yes, npm i multer@1.4.5-lts.1 should fix this 👍