Skip to content

Commit cc7a377

Browse files
marco-ippolitomarco-ippolito
committed
chore: remove indirect node dependencies
1 parent e9862c2 commit cc7a377

File tree

2 files changed

+78
-41
lines changed

2 files changed

+78
-41
lines changed

‎tools/eol_cve/eol-cve.csv‎

Lines changed: 0 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,4 @@
11
cve,vulnerable,patched,affectedEOL
2-
CVE-2017-1000381,"8.x || 7.x || 4.x || 6.x || 5.x","^8.1.4 || ^7.10.1 || ^4.8.4 || ^6.11.1","5.x || 7.x"
3-
CVE-2017-3731,"4.x || 5.x || 6.x || 7.x","^4.7.3 || ^6.9.5 || ^7.5.0",5.x
4-
CVE-2017-3732,"4.x || 5.x || 6.x || 7.x","^4.7.3 || ^6.9.5 || ^7.5.0",5.x
5-
CVE-2016-7055,"4.x || 5.x || 6.x || 7.x","^4.7.3 || ^6.9.5 || ^7.5.0",5.x
6-
CVE-2016-9551,^7.1.0,^7.2.0,5.x
7-
CVE-2016-9840,"4.x || 5.x || 6.x || 7.x","^4.8.2 || ^6.10.2 || ^7.6.0",5.x
8-
CVE-2016-9841,"4.x || 5.x || 6.x || 7.x","^4.8.2 || ^6.10.2 || ^7.6.0",5.x
9-
CVE-2016-9842,"4.x || 5.x || 6.x || 7.x","^4.8.2 || ^6.10.2 || ^7.6.0",5.x
10-
CVE-2016-9843,"4.x || 5.x || 6.x || 7.x","^4.8.2 || ^6.10.2 || ^7.6.0",5.x
11-
CVE-2016-5172,6.x,^6.9.0,5.x
12-
CVE-2016-6304,"6.x || 5.x || 4.x","^6.7.0 || ^4.6.0",5.x
13-
CVE-2016-2183,"6.x || 5.x || 4.x","^6.7.0 || ^4.6.0",5.x
14-
CVE-2016-6303,"6.x || 5.x || 4.x","^6.7.0 || ^4.6.0",5.x
15-
CVE-2016-2178,"6.x || 5.x || 4.x","^6.7.0 || ^4.6.0",5.x
16-
CVE-2016-6306,"6.x || 5.x || 4.x","^6.7.0 || ^4.6.0",5.x
172
CVE-2016-5325,"6.x || 4.x || 5.x","^6.7.0 || ^4.6.0",5.x
183
CVE-2016-7099,"6.x || 4.x || 5.x","^6.7.0 || ^4.6.0",5.x
194
CVE-2017-14849,8.5.0,^8.6.0,"5.x || 7.x"
@@ -35,14 +20,6 @@ CVE-2018-12122,"6.x || 8.x || 10.x || 11.x","^6.15.0 || ^8.14.0 || ^10.14.0 || ^
3520
CVE-2018-12123,"6.x || 8.x || 10.x || 11.x","^6.15.0 || ^8.14.0 || ^10.14.0 || ^11.3.0","4.x || 5.x || 7.x || 9.x"
3621
CVE-2019-5737,"6.x || 8.x || 10.x || 11.x","^6.17.0 || ^8.15.1 || ^10.15.2 || ^11.10.1","4.x || 5.x || 7.x || 9.x"
3722
CVE-2019-5739,6.x,^6.17.0,"4.x || 5.x"
38-
CVE-2019-9511,"8.x || 10.x || 12.x","^8.16.1 || ^10.16.3 || ^12.8.1","4.x || 5.x || 6.x || 7.x || 9.x || 11.x"
39-
CVE-2019-9512,"8.x || 10.x || 12.x","^8.16.1 || ^10.16.3 || ^12.8.1","4.x || 5.x || 6.x || 7.x || 9.x || 11.x"
40-
CVE-2019-9513,"8.x || 10.x || 12.x","^8.16.1 || ^10.16.3 || ^12.8.1","4.x || 5.x || 6.x || 7.x || 9.x || 11.x"
41-
CVE-2019-9514,"8.x || 10.x || 12.x","^8.16.1 || ^10.16.3 || ^12.8.1","4.x || 5.x || 6.x || 7.x || 9.x || 11.x"
42-
CVE-2019-9515,"8.x || 10.x || 12.x","^8.16.1 || ^10.16.3 || ^12.8.1","4.x || 5.x || 6.x || 7.x || 9.x || 11.x"
43-
CVE-2019-9516,"8.x || 10.x || 12.x","^8.16.1 || ^10.16.3 || ^12.8.1","4.x || 5.x || 6.x || 7.x || 9.x || 11.x"
44-
CVE-2019-9517,"8.x || 10.x || 12.x","^8.16.1 || ^10.16.3 || ^12.8.1","4.x || 5.x || 6.x || 7.x || 9.x || 11.x"
45-
CVE-2019-9518,"8.x || 10.x || 12.x","^8.16.1 || ^10.16.3 || ^12.8.1","4.x || 5.x || 6.x || 7.x || 9.x || 11.x"
4623
CVE-2019-15604,"10.x || 12.x || 13.x","^10.19.0 || ^12.15.0 || ^13.8.0","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 11.x"
4724
CVE-2019-15605,"10.x || 12.x || 13.x","^10.19.0 || ^12.15.0 || ^13.8.0","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 11.x"
4825
CVE-2019-15606,"10.x || 12.x || 13.x","^10.19.0 || ^12.15.0 || ^13.8.0","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 11.x"
@@ -52,33 +29,20 @@ CVE-2020-8252,"10.x || 12.x || 14.x","^10.22.1 || ^12.18.4 || ^14.9.0","4.x || 5
5229
CVE-2020-8277," 12.x || 14.x || 15.x"," ^12.19.1 || ^14.15.1 || 15.2.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 11.x || 13.x"
5330
CVE-2020-8265,"10.x || 12.x || 14.x || 15.x","^10.23.1 || ^12.20.1 || ^14.15.4 || ^15.5.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 11.x || 13.x"
5431
CVE-2020-8287,"10.x || 12.x || 14.x || 15.x","^10.23.1 || ^12.20.1 || ^14.15.4 || ^15.5.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 11.x || 13.x"
55-
CVE-2020-1971,"10.x || 12.x || 14.x || 15.x","^10.23.1 || ^12.20.1 || ^14.15.4 || ^15.5.0","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 11.x || 13.x"
5632
CVE-2021-22883," 10.x || 12.x || 14.x || 15.x"," ^10.24.0 || ^12.21.0 || ^14.16.0 || ^15.10.0","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 11.x || 13.x"
5733
CVE-2021-22884," 10.x || 12.x || 14.x || 15.x"," ^10.24.0 || ^12.21.0 || ^14.16.0 || ^15.10.0","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 11.x || 13.x"
58-
CVE-2021-23840," 10.x || 12.x || 14.x || 15.x"," ^10.24.0 || ^12.21.0 || ^14.16.0 || ^15.10.0","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 11.x || 13.x"
59-
CVE-2021-3450," 10.x || 12.x || 14.x || 15.x"," ^10.24.1 || ^12.22.1 || ^14.16.1 || ^15.14.0","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 11.x || 13.x"
60-
CVE-2021-3449," 10.x || 12.x || 14.x || 15.x"," ^10.24.1 || ^12.22.1 || ^14.16.1 || ^15.14.0","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 11.x || 13.x"
61-
CVE-2020-7774," 10.x || 12.x || 14.x"," ^10.24.1 || ^12.22.1 || ^14.16.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 11.x || 13.x"
6234
CVE-2021-22930," 12.x || 14.x || 16.x"," ^12.22.4 || ^14.17.4 || ^16.6.0","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x || 15.x"
6335
CVE-2021-22921," 12.x || 14.x || 16.x"," ^12.22.2 || ^14.17.2 || ^16.4.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x || 15.x"
64-
CVE-2021-27290, 12.x, ^12.22.2,"4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x"
65-
CVE-2021-23362, 12.x, ^12.22.2,"4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x"
6636
CVE-2021-22918," 12.x || 14.x || 16.x"," ^12.22.2 || ^14.17.2 || ^16.4.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x || 15.x"
6737
CVE-2021-22931,"12.x || 14.x || 16.x","^12.22.5 || ^14.17.5 || ^16.6.2","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x || 15.x"
6838
CVE-2021-22940,"12.x || 14.x || 16.x","^12.22.5 || ^14.17.5 || ^16.6.2","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x || 15.x"
6939
CVE-2021-22939,"12.x || 14.x || 16.x","^12.22.5 || ^14.17.5 || ^16.6.2","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x || 15.x"
70-
CVE-2021-37701," 12.x || 14.x"," ^12.22.6 || ^14.17.6","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x"
71-
CVE-2021-37712," 12.x || 14.x"," ^12.22.6 || ^14.17.6","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x"
72-
CVE-2021-37713," 12.x || 14.x"," ^12.22.6 || ^14.17.6","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x"
73-
CVE-2021-39134," 12.x || 14.x"," ^12.22.6 || ^14.17.6","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x"
74-
CVE-2021-39135," 12.x || 14.x"," ^12.22.6 || ^14.17.6","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x"
7540
CVE-2021-22959,"12.x || 14.x || 16.x"," ^12.22.7 || ^14.18.1 || ^16.11.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x || 15.x"
7641
CVE-2021-22960,"12.x || 14.x || 16.x"," ^12.22.7 || ^14.18.1 || ^16.11.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x || 15.x"
7742
CVE-2021-44531,"12.x || 14.x || 16.x || 17.x","^12.22.9 || ^14.18.3 || ^16.13.2 || ^17.3.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x || 15.x"
7843
CVE-2021-44532,"12.x || 14.x || 16.x || 17.x","^12.22.9 || ^14.18.3 || ^16.13.2 || ^17.3.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x || 15.x"
7944
CVE-2021-44533,"12.x || 14.x || 16.x || 17.x","^12.22.9 || ^14.18.3 || ^16.13.2 || ^17.3.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x || 15.x"
8045
CVE-2022-21824,"12.x || 14.x || 16.x || 17.x","^12.22.9 || ^14.18.3 || ^16.13.2 || ^17.3.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x || 15.x"
81-
CVE-2022-0778,"12.x || 14.x || 16.x || 17.x","^12.22.11 || ^14.19.1 || ^16.14.2 || ^17.7.2","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 13.x || 15.x"
8246
CVE-2022-32215,"14.x || 16.x || 18.x","^14.20.1 || ^16.17.1 || ^18.9.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 15.x || 17.x"
8347
CVE-2022-32214,"14.x || 16.x || 18.x","^14.20.0 || ^16.20.0 || ^18.5.0","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 15.x || 17.x"
8448
CVE-2022-32212,"14.x || 16.x || 18.x","^14.20.1 || ^16.17.1 || ^18.9.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 15.x || 17.x"
@@ -90,8 +54,6 @@ CVE-2022-35255,18.x,^18.9.1,"4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 1
9054
CVE-2022-43548,"14.x || 16.x || 18.x || 19.x","^14.21.1 || ^16.18.1 || ^18.12.1 || ^19.0.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 15.x || 17.x"
9155
CVE-2023-23918,"14.x || 16.x || 18.x || 19.x","^14.21.3 || ^16.19.1 || ^18.14.1 || ^19.6.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 15.x || 17.x"
9256
CVE-2023-23919,"14.x || 16.x || 18.x || 19.x","^14.21.3 || ^16.19.1 || ^18.14.1 || ^19.2.0","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 15.x || 17.x"
93-
CVE-2023-23936,"14.x || 16.x || 18.x || 19.x","^14.21.3 || ^16.19.1 || ^18.14.1 || ^19.6.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 15.x || 17.x"
94-
CVE-2023-24807,"14.x || 16.x || 18.x || 19.x","^14.21.3 || ^16.19.1 || ^18.14.1 || ^19.6.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 15.x || 17.x"
9557
CVE-2023-23920,"14.x || 16.x || 18.x || 19.x","^14.21.3 || ^16.19.1 || ^18.14.1 || ^19.6.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 15.x || 17.x"
9658
CVE-2023-30581,"16.x || 18.x || 20.x","^16.20.1 || ^18.16.1 || ^20.3.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 14.x || 15.x || 17.x || 19.x"
9759
CVE-2023-30582,20.x,^20.3.1,"4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 14.x || 15.x || 17.x || 19.x"
@@ -110,8 +72,6 @@ CVE-2023-32006,"16.x || 18.x || 20.x","^16.20.2 || ^18.17.1 || ^20.5.1","4.x ||
11072
CVE-2023-32559,"16.x || 18.x || 20.x","^16.20.2 || ^18.17.1 || ^20.5.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 14.x || 15.x || 17.x || 19.x"
11173
CVE-2023-32005,20.x,^20.5.1,"4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 14.x || 15.x || 17.x || 19.x"
11274
CVE-2023-32003,20.x,^20.5.1,"4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 14.x || 15.x || 17.x || 19.x"
113-
CVE-2023-45143,"18.x || 20.x","^18.18.2 || ^20.8.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 14.x || 15.x || 16.x || 17.x || 19.x"
114-
CVE-2023-44487,"18.x || 20.x","^18.18.2 || ^20.8.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 14.x || 15.x || 16.x || 17.x || 19.x"
11575
CVE-2023-39331,20.x,^20.8.1,"4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 14.x || 15.x || 16.x || 17.x || 19.x"
11676
CVE-2023-39332,20.x,^20.8.1,"4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 14.x || 15.x || 16.x || 17.x || 19.x"
11777
CVE-2023-38552,"18.x || 20.x","^18.18.2 || ^20.8.1","4.x || 5.x || 6.x || 7.x || 8.x || 9.x || 10.x || 11.x || 12.x || 13.x || 14.x || 15.x || 16.x || 17.x || 19.x"

‎tools/eol_cve/index.js‎

Lines changed: 78 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ const { format } = require('fast-csv');
44
const { resolve } = require('path');
55
const semver = require('semver');
66
const nv = require('@pkgjs/nv');
7+
const { setTimeout } = require('node:timers/promises');
78

89
const csvStream = format({ headers: true });
910
const filePath = resolve(__dirname, 'eol-cve.csv');
@@ -14,6 +15,73 @@ const MINIMUM_VERSION = 4;
1415

1516
const RELEASE_SCHEDULE_JSON = 'https://raw.githubusercontent.com/nodejs/Release/main/schedule.json';
1617

18+
const NVD_API_URL = "https://services.nvd.nist.gov/rest/json/cves/2.0";
19+
20+
const VALID_REFERENCES = [
21+
{
22+
url: 'nodejs.org/en/blog/vulnerability',
23+
source: '[email protected]'
24+
},
25+
{
26+
url: 'nodejs.org/en/blog/vulnerability',
27+
source: '[email protected]'
28+
},
29+
{
30+
url: 'nodejs.org/en/blog/vulnerability',
31+
source: '[email protected]'
32+
},
33+
{
34+
url: 'hackerone.com/reports/',
35+
source: '[email protected]'
36+
}, {
37+
url: 'www.openwall.com/lists/oss-security/',
38+
source: '[email protected]'
39+
}
40+
]
41+
42+
async function isNodeCVE(cveId) {
43+
const queryParams = new URLSearchParams({
44+
cveId: cveId,
45+
});
46+
47+
const response = await fetch(`${NVD_API_URL}?${queryParams.toString()}`, {
48+
headers: {
49+
'apiKey': process.env.NVD_TOKEN,
50+
}
51+
});
52+
if (!response.ok) {
53+
console.error(
54+
`Error fetching data: ${response.status} ${response.statusText}`,
55+
);
56+
process.exit(1);
57+
}
58+
const data = await response.json();
59+
60+
const { vulnerabilities } = data;
61+
if (!vulnerabilities?.length) {
62+
return false;
63+
}
64+
65+
const { cve } = vulnerabilities.at(0);
66+
const { references } = cve;
67+
68+
if (references?.length) {
69+
// Try to identify if the CVE is related to Node.js
70+
// by checking the references
71+
for (const reference of references) {
72+
const { url, source } = reference;
73+
for (const validReference of VALID_REFERENCES) {
74+
const { url: validUrl, source: validSource } = validReference;
75+
if (url.includes(validUrl) && source === validSource) {
76+
return true;
77+
}
78+
}
79+
}
80+
}
81+
82+
return false;
83+
}
84+
1785
async function fetchReleasesSchedule() {
1886
try {
1987
const response = await fetch(RELEASE_SCHEDULE_JSON);
@@ -69,6 +137,15 @@ async function run() {
69137

70138
// Each vulnerability can have multiple CVEs
71139
for (const cve of vuln.cve) {
140+
if (!await isNodeCVE(cve)) {
141+
continue;
142+
}
143+
// Otherwise NVD will block us
144+
// Rate limit is 50 requests per 30 second with token
145+
// and 5 requests per 30 seconds without token
146+
const timeout = process.env.NVD_TOKEN ? 750 : 5000;
147+
await setTimeout(timeout);
148+
72149
const last = getLastAffectedVersion(vuln.vulnerable);
73150
// Skip 0.x and 4.x versions
74151
if (last <= MINIMUM_VERSION) continue;
@@ -96,7 +173,7 @@ async function run() {
96173
return releaseDate > eol;
97174
});
98175

99-
if(releaseMajors.length === 0) continue;
176+
if (releaseMajors.length === 0) continue;
100177

101178
// Write into the format v4.x || v5.x || v6.x
102179
const missing = releaseMajors.map((n) => `${n}.x`).join(' || ');

0 commit comments

Comments
 (0)