From 67ab8141080fe2c7543d572f0af8b071b58c3942 Mon Sep 17 00:00:00 2001 From: LongYinan Date: Fri, 2 Feb 2024 05:53:44 +0000 Subject: [PATCH] chore: bump up nodemailer version to v6.9.9 [SECURITY] (#5780) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit [![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [nodemailer](https://nodemailer.com/) ([source](https://togithub.com/nodemailer/nodemailer)) | [`6.9.7` -> `6.9.9`](https://renovatebot.com/diffs/npm/nodemailer/6.9.7/6.9.9) | [![age](https://developer.mend.io/api/mc/badges/age/npm/nodemailer/6.9.9?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/nodemailer/6.9.9?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/nodemailer/6.9.7/6.9.9?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/nodemailer/6.9.7/6.9.9?slim=true)](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [GHSA-9h6g-pr28-7cqp](https://togithub.com/nodemailer/nodemailer/security/advisories/GHSA-9h6g-pr28-7cqp) ### Summary A ReDoS vulnerability occurs when nodemailer tries to parse img files with the parameter `attachDataUrls` set, causing the stuck of event loop. Another flaw was found when nodemailer tries to parse an attachments with a embedded file, causing the stuck of event loop. ### Details Regex: /^data:((?:[^;]*;)*(?:[^,]*)),(.*)$/ Path: compile -> getAttachments -> _processDataUrl Regex: /(]* src\s*=[\s"']*)(data:([^;]+);[^"'>\s]+)/ Path: _convertDataImages ### PoC https://gist.github.com/francoatmega/890dd5053375333e40c6fdbcc8c58df6 https://gist.github.com/francoatmega/9aab042b0b24968d7b7039818e8b2698 ### Impact ReDoS causes the event loop to stuck a specially crafted evil email can cause this problem. --- ### Release Notes
nodemailer/nodemailer (nodemailer) ### [`v6.9.9`](https://togithub.com/nodemailer/nodemailer/blob/HEAD/CHANGELOG.md#699-2024-02-01) [Compare Source](https://togithub.com/nodemailer/nodemailer/compare/v6.9.8...v6.9.9) ##### Bug Fixes - **security:** Fix issues described in GHSA-9h6g-pr28-7cqp. Do not use eternal matching pattern if only a few occurences are expected ([dd8f5e8](https://togithub.com/nodemailer/nodemailer/commit/dd8f5e8a4ddc99992e31df76bcff9c590035cd4a)) - **tests:** Use native node test runner, added code coverage support, removed grunt ([#​1604](https://togithub.com/nodemailer/nodemailer/issues/1604)) ([be45c1b](https://togithub.com/nodemailer/nodemailer/commit/be45c1b299d012358d69247019391a02734d70af)) ### [`v6.9.8`](https://togithub.com/nodemailer/nodemailer/blob/HEAD/CHANGELOG.md#698-2023-12-30) [Compare Source](https://togithub.com/nodemailer/nodemailer/compare/v6.9.7...v6.9.8) ##### Bug Fixes - **punycode:** do not use native punycode module ([b4d0e0c](https://togithub.com/nodemailer/nodemailer/commit/b4d0e0c7cc4b15bc4d9e287f91d1bcaca87508b0))
--- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/toeverything/AFFiNE). --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index 60ed66ef64..b1b5c163a5 100644 --- a/yarn.lock +++ b/yarn.lock @@ -27969,9 +27969,9 @@ __metadata: linkType: hard "nodemailer@npm:^6.9.7": - version: 6.9.7 - resolution: "nodemailer@npm:6.9.7" - checksum: 10/32b6e6c3f5e0ab6c5fa796934fee397e8b520f6d782fc41d8bd5aaf72a2e757564b8e7e7f7aa02fcf0ba73a83d364bdb923c2dbb76a32ac87a5c628d1bde03df + version: 6.9.9 + resolution: "nodemailer@npm:6.9.9" + checksum: 10/d81f8613c35785aeb60dd0e3ead2c2c0171c709381fde17ada112f5ac635630814ad09492dacaf0fd30158492ed834abb82d9c58b49e9b495e5c675fbc5fffef languageName: node linkType: hard