Update all known unknowns

[bmuenzenmeyer]

closes #1501

In all, I hope this better reflects the security environment and communication we are proposing within nodejs/nodejs.org#7990

CVE Severity Assignment

The following table provides severity ratings for Node.js CVEs that were marked as "unknown" and their new severity, based on information from the National Vulnerability Database (NVD). In cases when the their was conflict, NVD was used, not GitHub.

Checked	CVE Number	NVD Link	Severity
✅	CVE-2017-1000381	NVD Link	High (7.5)
✅	CVE-2017-3731	NVD Link	High (7.5)
✅	CVE-2017-3732	NVD Link	Medium (5.9)
✅	CVE-2016-7055	NVD Link	Medium (5.9)
✅	CVE-2016-9551	NVD Link	⁉️ Unknown
✅	CVE-2016-9840	NVD Link	High (8.8)
✅	CVE-2016-5180	NVD Link	Critical (9.8)
✅	CVE-2016-5172	NVD Link	Medium (6.5)
✅	CVE-2016-6304	NVD Link	High (7.5)
✅	CVE-2016-2183	NVD Link	High (7.5)
✅	CVE-2016-6303	NVD Link	Critical (9.8)
✅	CVE-2016-2178	NVD Link	Medium (5.5)
✅	CVE-2016-6306	NVD Link	Medium (5.9)
✅	CVE-2016-5325	NVD Link	Medium (6.1)
✅	CVE-2016-7099	NVD Link	Medium (5.9)
✅	CVE-2016-2107	NVD Link	Medium (5.9)
✅	CVE-2016-2105	NVD Link	High (7.5)
✅	CVE-2016-1669	NVD Link	High (8.8)
✅	CVE-2016-2086	NVD Link	High (7.5)
✅	CVE-2016-2216	NVD Link	High (7.5)
✅	CVE-2016-0797	NVD Link	High (7.5)
✅	CVE-2016-0702	NVD Link	Medium (5.1)
✅	CVE-2015-8027	NVD Link	High (7.5)
✅	CVE-2015-6764	NVD Link	Critical (9.8)
✅	CVE-2015-3193	NVD Link	High (7.5)
✅	CVE-2015-3194	NVD Link	High (7.5)
✅	CVE-2015-7384	NVD Link	High (7.5)
✅	CVE-2017-14849	NVD Link	High (7.5)
✅	CVE-2017-14919	NVD Link	High (7.5)
✅	CVE-2017-15896	NVD Link	Critical (9.1)
✅	CVE-2017-15897	NVD Link	Low (3.1)
✅	CVE-2018-7158	NVD Link	High (7.5)
✅	CVE-2018-7159	NVD Link	Medium (5.3)
✅	CVE-2018-7160	NVD Link	High (8.8)
✅	CVE-2018-7161	NVD Link	High (7.5)
✅	CVE-2018-7162	NVD Link	High (7.5)
✅	CVE-2018-7164	NVD Link	High (7.5)
✅	CVE-2018-7166	NVD Link	High (7.5)
✅	CVE-2018-7167	NVD Link	High (7.5)
✅	CVE-2018-12115	NVD Link	High (7.5)
✅	CVE-2018-12116	NVD Link	High (7.5)
✅	CVE-2018-12120	NVD Link	High (8.1)
✅	CVE-2018-12121	NVD Link	High (7.5)
✅	CVE-2018-12122	NVD Link	High (7.5)
✅	CVE-2018-12123	NVD Link	Medium (4.3)
✅	CVE-2019-5737	NVD Link	High (7.5)
✅	CVE-2019-5739	NVD Link	High (7.5)
✅	CVE-2019-9511	NVD Link	High (7.5)
✅	CVE-2019-9512	NVD Link	High (7.5)
✅	CVE-2019-9513	NVD Link	High (7.5)
✅	CVE-2019-9514	NVD Link	High (7.5)
✅	CVE-2019-9515	NVD Link	High (7.5)
✅	CVE-2019-9516	NVD Link	High (7.5)
✅	CVE-2019-9517	NVD Link	High (7.5)
✅	CVE-2019-9518	NVD Link	High (7.5)
✅	CVE-2019-15604	NVD Link	High (7.5)
✅	CVE-2019-15605	NVD Link	Critical (9.8)
✅	CVE-2019-15606	NVD Link	Critical (9.8)
✅	CVE-2020-1971	NVD Link	Medium (5.9)
✅	CVE-2020-8277	NVD Link	High (7.5)
✅	CVE-2021-22884	NVD Link	High (7.5)
✅	CVE-2021-23840	NVD Link	High (7.5)
✅	CVE-2021-37701	NVD Link	High (8.6)
✅	CVE-2021-37712	NVD Link	High (8.6)
✅	CVE-2021-37713	NVD Link	High (8.6)
✅	CVE-2021-39134	NVD Link	High (7.8)
✅	CVE-2021-39135	NVD Link	High (7.8)
✅	CVE-2023-32002	NVD Link	Critical (9.8)
✅	CVE-2023-32004	NVD Link	High (8.8)
✅	CVE-2023-32558	NVD Link	High (7.5)
✅	CVE-2023-32006	NVD Link	High (7.5)
✅	CVE-2023-32559	NVD Link	High (7.5)
✅	CVE-2023-32005	NVD Link	Medium (5.3)
✅	CVE-2023-32003	NVD Link	Medium (5.3)
✅	CVE-2024-22025	NVD Link	Medium (6.5)

I verified all of these by hand. 13 unknowns remain, mostly because their entries have no CVE listed.

Example

{
  "cve": [],
  "vulnerable": "5.x || 4.x || 6.x",
  "patched": "^5.12.0 || ^4.5.0 || ^6.2.1",
  "ref": "https://github.com/nodejs/node/pull/7562",
  "description": "ignore negative allocation lengths",
  "affectedEnvironments": [
    "all"
  ],
  "severity": "unknown"
}

[bmuenzenmeyer]

I see some CI failures regarding dates, which i did not touch - i'd like advice how to resolve

edit: looks like we allowed it before, like in https://github.com/nodejs/security-wg/pull/1492/checks

I wonder if this logic in vulnValidate is perhaps contradictory

  publish_date: Joi
    .string()
    .regex(/^\d{4}-\d{2}-\d{2}$/)
    .optional()
    .isoDate(),

where the regex is perhaps no longer needed, or the date portion is overkill if the regex is accepted.

[RafaelGSS]

It looks like most (if not all) of the critical-scored CVEs were dealt with as high by the Node.js team back in the day. The reason that NVD is scoring it as CRITICAL is unknown to me. I'd change them to the score Node.js chose.

[RafaelGSS]

You can ignore the valida-vulnerability error. We need to fix it. It's unrelated to your code changes.

[bmuenzenmeyer]

confirmed critical on our blog

[bmuenzenmeyer]

@RafaelGSS I combed through all the critical ratings to either confirm or downgrade to what the blog states. there is the one outstanding question then on 44.json - where perhaps we disagree on how to resolve