🚨 [security] Update mongoose 5.13.8 → 5.13.22 (patch)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ mongoose (5.13.8 → 5.13.22) · Repo · Changelog

Security Advisories 🚨

🚨 Mongoose Prototype Pollution vulnerability

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.3, 6.11.3, and 5.13.20.

🚨 Mongoose Vulnerable to Prototype Pollution in Schema Object

Description

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path() function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack.

Proof of Concept

// poc.js
const mongoose = require('mongoose');
const schema = new mongoose.Schema();
malicious_payload = 'proto.toString'
schema.path(malicious_payload, [String])
x = {}

console.log(x.toString()) // crashed (Denial of service (DoS) attack)

Impact

This vulnerability can be manipulated to exploit other types of attacks, such as Denial of service (DoS), Remote Code Execution, or Property Injection.

🚨 automattic/mongoose vulnerable to Prototype pollution via Schema.path

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path() function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack.

Release Notes

5.13.15 (from changelog)

• fix: backport fix for CVE-2022-2564 #12281 shubanker
• docs: fix broken link from findandmodify method deprecation #11366 laissonsilveira

5.13.14 (from changelog)

• fix(timestamps): avoid setting createdAt on documents that already exist but dont have createdAt #11024
• docs(models): fix up nModified example for 5.x #11055

5.13.13 (from changelog)

• fix: upgrade to [email protected] #10909 gaurav-sharma-gs
• fix: correctly emit end event in before close #10916 iovanom
• fix(index.d.ts): improve ts types for query set #10942 jneal-afs

5.13.12 (from changelog)

• fix(cursor): use stream destroy method on close to prevent emitting duplicate 'close' #10897 iovanom
• fix(index.d.ts): backport streamlining of FilterQuery and DocumentDefinition to avoid "excessively deep and possibly infinite" TS errors #10617

5.13.9 (from changelog)

• fix(populate): avoid setting empty array on lean document when populate result is undefined #10599
• fix(document): make depopulate() handle populated paths underneath document arrays #10592
• fix: peg @types/bson version to 1.x || 4.0.x to avoid stubbed 4.2.x release #10678
• fix(index.d.ts): simplify UpdateQuery to avoid "excessively deep and possibly infinite" errors with extends Document and any #10647
• fix(index.d.ts): allow specifying weights as an IndexOption #10586
• fix: upgrade to mpath v0.8.4 re: security issue #10683

Does any of this look wrong? Please let us know.

⁉️ @​types/bson (downgrade, 4.2.0 → 4.0.5) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ @​types/node (indirect, 16.11.6 → 20.12.7) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ mongodb (indirect, 3.6.11 → 3.7.4) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ mpath (indirect, 0.8.3 → 0.8.4) · Repo · Changelog

Security Advisories 🚨

🚨 Type confusion in mpath

This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['__proto__']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input.

Release Notes

0.8.4 (from changelog)

• fix: throw error if parts contains an element that isn't a string or number #13

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 3 commits:

• chore: release 0.8.4
• fix: throw error if `parts` contains an element that isn't a string or number
• chore: add basic SECURITY.md file

🆕 readable-stream (added, 2.3.8)

🆕 require-at (added, 1.0.6)

🆕 string_decoder (added, 1.1.1)

🆕 undici-types (added, 5.26.5)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 99.17%. Comparing base (d0b3e4d) to head (9b0a081).

Additional details and impacted files

@@           Coverage Diff           @@
##           master      #86   +/-   ##
=======================================
  Coverage   99.17%   99.17%           
=======================================
  Files           6        6           
  Lines         121      121           
=======================================
  Hits          120      120           
  Misses          1        1           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.