tiny-json-http missing SSL certificate validation

Description

brianleroux tiny-json-http version all versions since commit 9b8e74a232bba4701844e07bcba794173b0238a8 (Oct 29 2016) contains a Missing SSL certificate validation vulnerability in The libraries core functionality is affected. that can result in Exposes the user to man-in-the-middle attacks.

Recommendation

Update the tiny-json-http package to the latest compatible version. Followings are version details:

• Affected version(s): >= 1.0.1, < 7.0.0
• Patched version(s): 7.0.0

References

• GHSA-7h42-5vj2-cq39
• CVE-2018-1000096
• CWE-295
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A7

Related Issues

• Improper Certificate Validation in xmlhttprequest-ssl - CVE-2021-31597
• Missing Origin Validation in parcel-bundler - parcel-bundler - CVE-2018-14731
• Missing Origin Validation in browserify-hmr - CVE-2018-14730
• Improper Input Validation in Deap - CVE-2018-3749

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

tiny-json-http