fix(security): remediate qs vulnerability CVE-2022-24999

Mass-upgraded the following dependencies throughout the project to get rid of the vulnerability in qs' older versions: 1. `express` 2. `body-parser` GitHub Cacti Security Advisories: 1. https://github.com/hyperledger/cacti/security/dependabot/279 2. https://github.com/hyperledger/cacti/security/dependabot/278 3. https://github.com/hyperledger/cacti/security/dependabot/274 CVE ID: CVE-2022-24999 GHSA ID: GHSA-hrpp-h998-j3pp [skip ci] Signed-off-by: Peter Somogyvari <[email protected]>
hyperledger-cacti · Oct 18, 2023 · 536b6b1 · 536b6b1
1 parent 55c7d3d
commit 536b6b1
Show file tree

Hide file tree

Showing 47 changed files with 224 additions and 708 deletions.
diff --git a/examples/cactus-example-carbon-accounting-backend/package.json b/examples/cactus-example-carbon-accounting-backend/package.json
@@ -74,7 +74,7 @@
     "web3-utils": "1.6.1"
   },
   "devDependencies": {
-    "@types/express": "4.17.13",
+    "@types/express": "4.17.19",
     "@types/fs-extra": "9.0.13",
     "@types/json-stable-stringify": "1.0.34",
     "@types/uuid": "8.3.4",

diff --git a/examples/cactus-example-carbon-accounting-business-logic-plugin/package.json b/examples/cactus-example-carbon-accounting-business-logic-plugin/package.json
@@ -65,13 +65,13 @@
     "@hyperledger/cactus-plugin-ledger-connector-xdai": "2.0.0-alpha.2",
     "async-exit-hook": "2.0.1",
     "axios": "0.21.4",
-    "express": "4.17.1",
+    "express": "4.18.2",
     "openapi-types": "9.1.0",
     "typescript-optional": "2.0.1",
     "uuid": "8.3.2"
   },
   "devDependencies": {
-    "@types/express": "4.17.13",
+    "@types/express": "4.17.19",
     "@types/ssh2": "0.5.47",
     "@types/uuid": "8.3.4"
   },

diff --git a/examples/cactus-example-cbdc-bridging-backend/package.json b/examples/cactus-example-cbdc-bridging-backend/package.json
@@ -89,7 +89,7 @@
     "@types/chai": "^4.3.1",
     "@types/crypto-js": "4.1.1",
     "@types/cucumber": "^4.0.4",
-    "@types/express": "4.17.13",
+    "@types/express": "4.17.19",
     "@types/express-jwt": "6.0.2",
     "@types/fs-extra": "9.0.13",
     "@types/node": "^10.17.60",

diff --git a/examples/cactus-example-discounted-asset-trade/package.json b/examples/cactus-example-discounted-asset-trade/package.json
@@ -25,14 +25,14 @@
     "@hyperledger/cactus-verifier-client": "2.0.0-alpha.2",
     "@types/node": "14.18.54",
     "axios": "0.24.0",
-    "body-parser": "1.19.2",
+    "body-parser": "1.20.2",
     "cookie-parser": "1.4.6",
     "debug": "3.1.0",
     "elliptic": "6.5.4",
     "escape-html": "1.0.3",
     "ethereumjs-common": "1.5.2",
     "ethereumjs-tx": "2.1.2",
-    "express": "4.16.4",
+    "express": "4.18.2",
     "fabric-ca-client": "2.2.19",
     "fabric-network": "2.2.19",
     "http-errors": "1.6.3",
@@ -48,7 +48,7 @@
   "devDependencies": {
     "@types/elliptic": "6.4.14",
     "@types/escape-html": "1.0.1",
-    "@types/express": "4.17.13",
+    "@types/express": "4.17.19",
     "@types/jsonwebtoken": "9.0.2",
     "@types/jsrsasign": "10.5.8"
   }

diff --git a/examples/cactus-example-electricity-trade/package.json b/examples/cactus-example-electricity-trade/package.json
@@ -22,13 +22,13 @@
     "@hyperledger/cactus-plugin-ledger-connector-ethereum": "2.0.0-alpha.2",
     "@hyperledger/cactus-verifier-client": "2.0.0-alpha.2",
     "@types/node": "14.18.54",
-    "body-parser": "1.19.2",
+    "body-parser": "1.20.2",
     "cookie-parser": "1.4.6",
     "debug": "3.1.0",
     "escape-html": "1.0.3",
     "ethereumjs-common": "1.5.2",
     "ethereumjs-tx": "2.1.2",
-    "express": "4.16.4",
+    "express": "4.18.2",
     "fabric-ca-client": "2.2.19",
     "fabric-network": "2.2.19",
     "http-errors": "1.6.3",
@@ -44,7 +44,7 @@
   },
   "devDependencies": {
     "@types/escape-html": "1.0.1",
-    "@types/express": "4.17.13",
+    "@types/express": "4.17.19",
     "@typescript-eslint/eslint-plugin": "4.33.0",
     "@typescript-eslint/parser": "4.33.0",
     "eslint": "7.32.0",

diff --git a/examples/cactus-example-supply-chain-backend/package.json b/examples/cactus-example-supply-chain-backend/package.json
@@ -66,7 +66,7 @@
     "async-exit-hook": "2.0.1",
     "axios": "0.21.4",
     "dotenv": "16.0.0",
-    "express": "4.17.3",
+    "express": "4.18.2",
     "express-jwt": "8.4.1",
     "fabric-network": "2.2.19",
     "jose": "4.9.2",
@@ -77,7 +77,7 @@
     "web3-core": "1.6.1"
   },
   "devDependencies": {
-    "@types/express": "4.17.13",
+    "@types/express": "4.17.19",
     "@types/uuid": "8.3.4"
   },
   "engines": {

diff --git a/examples/cactus-example-supply-chain-business-logic-plugin/package.json b/examples/cactus-example-supply-chain-business-logic-plugin/package.json
@@ -66,13 +66,13 @@
     "@hyperledger/cactus-plugin-ledger-connector-quorum": "2.0.0-alpha.2",
     "async-exit-hook": "2.0.1",
     "axios": "0.21.4",
-    "express": "4.17.3",
+    "express": "4.18.2",
     "openapi-types": "9.1.0",
     "typescript-optional": "2.0.1",
     "uuid": "8.3.2"
   },
   "devDependencies": {
-    "@types/express": "4.17.13",
+    "@types/express": "4.17.19",
     "@types/ssh2": "0.5.47",
     "@types/uuid": "8.3.4"
   },

diff --git a/examples/cactus-example-tcs-huawei/package.json b/examples/cactus-example-tcs-huawei/package.json
@@ -16,13 +16,13 @@
     "@hyperledger/cactus-core-api": "2.0.0-alpha.2",
     "@hyperledger/cactus-verifier-client": "2.0.0-alpha.2",
     "@types/node": "14.18.54",
-    "body-parser": "1.19.2",
+    "body-parser": "1.20.2",
     "cookie-parser": "1.4.6",
     "debug": "2.6.9",
     "escape-html": "1.0.3",
     "ethereumjs-common": "1.5.2",
     "ethereumjs-tx": "2.1.2",
-    "express": "4.16.4",
+    "express": "4.18.2",
     "fabric-ca-client": "2.2.19",
     "fabric-network": "2.2.19",
     "http-errors": "1.6.3",
@@ -37,10 +37,10 @@
     "xmlhttprequest": "1.8.0"
   },
   "devDependencies": {
-    "@types/body-parser": "1.19.2",
+    "@types/body-parser": "1.19.3",
     "@types/cookie-parser": "1.4.2",
     "@types/escape-html": "1.0.1",
-    "@types/express": "4.17.13",
+    "@types/express": "4.17.19",
     "@typescript-eslint/eslint-plugin": "4.33.0",
     "@typescript-eslint/parser": "4.33.0",
     "eslint": "7.32.0",

diff --git a/examples/test-run-transaction/package.json b/examples/test-run-transaction/package.json
@@ -15,13 +15,13 @@
   },
   "dependencies": {
     "@types/node": "14.18.54",
-    "body-parser": "1.19.2",
+    "body-parser": "1.20.2",
     "cookie-parser": "1.4.6",
     "debug": "2.6.9",
     "escape-html": "1.0.3",
     "ethereumjs-common": "1.5.2",
     "ethereumjs-tx": "2.1.2",
-    "express": "4.16.4",
+    "express": "4.18.2",
     "fabric-ca-client": "2.2.19",
     "fabric-network": "2.2.19",
     "http-errors": "1.6.3",

diff --git a/examples/test-run-transaction/supply-chain-app-stub/package.json b/examples/test-run-transaction/supply-chain-app-stub/package.json
@@ -4,17 +4,17 @@
   "description": "",
   "main": "index.js",
   "dependencies": {
-    "body-parser": "1.19.2",
+    "body-parser": "1.20.2",
     "cors": "2.8.5",
-    "express": "4.17.3",
+    "express": "4.18.2",
     "moment": "2.29.4",
     "ts-node": "10.9.1",
     "typescript": "4.9.5",
     "helmet": "4.6.0"
   },
   "devDependencies": {
     "@types/cors": "2.8.12",
-    "@types/express": "4.17.13"
+    "@types/express": "4.17.19"
   },
   "scripts": {
     "start": "node app/app.js",

diff --git a/extensions/cactus-plugin-htlc-coordinator-besu/package.json b/extensions/cactus-plugin-htlc-coordinator-besu/package.json
@@ -65,7 +65,7 @@
     "@hyperledger/cactus-plugin-ledger-connector-besu": "2.0.0-alpha.2",
     "@hyperledger/cactus-test-plugin-htlc-eth-besu-erc20": "2.0.0-alpha.2",
     "axios": "0.21.4",
-    "body-parser": "1.19.0",
+    "body-parser": "1.20.2",
     "fast-safe-stringify": "2.1.1",
     "joi": "14.3.1",
     "openapi-types": "7.0.1",
@@ -77,8 +77,8 @@
   "devDependencies": {
     "@hyperledger/cactus-plugin-keychain-memory": "2.0.0-alpha.2",
     "@hyperledger/cactus-test-tooling": "2.0.0-alpha.2",
-    "@types/express": "4.17.8",
-    "express": "4.17.3",
+    "@types/express": "4.17.19",
+    "express": "4.18.2",
     "socket.io": "4.5.4",
     "web3-eth-abi": "4.0.3",
     "web3-utils": "4.0.3"

diff --git a/extensions/cactus-plugin-object-store-ipfs/package.json b/extensions/cactus-plugin-object-store-ipfs/package.json
@@ -66,8 +66,8 @@
   },
   "devDependencies": {
     "@hyperledger/cactus-test-tooling": "2.0.0-alpha.2",
-    "@types/express": "4.17.13",
-    "express": "4.17.1",
+    "@types/express": "4.17.19",
+    "express": "4.18.2",
     "ipfs-core-types": "0.6.1",
     "multiformats": "9.4.9"
   },

diff --git a/packages/cactus-cmd-api-server/package.json b/packages/cactus-cmd-api-server/package.json
@@ -67,12 +67,12 @@
     "async-exit-hook": "2.0.1",
     "axios": "0.21.4",
     "bluebird": "3.7.2",
-    "body-parser": "1.20.1",
+    "body-parser": "1.20.2",
     "compression": "1.7.4",
     "convict": "6.2.4",
     "convict-format-with-validator": "6.2.0",
     "cors": "2.8.5",
-    "express": "4.17.3",
+    "express": "4.18.2",
     "express-http-proxy": "1.6.2",
     "express-jwt": "8.4.1",
     "express-openapi-validator": "5.0.4",
@@ -100,7 +100,7 @@
     "@types/compression": "1.7.1",
     "@types/convict": "6.1.1",
     "@types/cors": "2.8.12",
-    "@types/express": "4.17.13",
+    "@types/express": "4.17.19",
     "@types/express-http-proxy": "1.6.2",
     "@types/google-protobuf": "3.15.5",
     "@types/json-stable-stringify": "1.0.34",

diff --git a/packages/cactus-cmd-socketio-server/package.json b/packages/cactus-cmd-socketio-server/package.json
@@ -45,14 +45,14 @@
     "@hyperledger/cactus-common": "2.0.0-alpha.2",
     "@hyperledger/cactus-core-api": "2.0.0-alpha.2",
     "@types/node": "14.18.54",
-    "body-parser": "1.19.2",
+    "body-parser": "1.20.2",
     "config": "3.3.7",
     "cookie-parser": "1.4.5",
     "debug": "3.1.0",
     "escape-html": "1.0.3",
     "ethereumjs-common": "1.5.2",
     "ethereumjs-tx": "2.1.2",
-    "express": "4.16.4",
+    "express": "4.18.2",
     "fabric-network": "2.2.19",
     "http-errors": "1.6.3",
     "js-yaml": "3.14.1",

diff --git a/packages/cactus-core-api/package.json b/packages/cactus-core-api/package.json
@@ -65,7 +65,7 @@
   "devDependencies": {
     "@grpc/grpc-js": "1.9.5",
     "@grpc/proto-loader": "0.7.8",
-    "@types/express": "4.17.13",
+    "@types/express": "4.17.19",
     "@types/google-protobuf": "3.15.5",
     "grpc-tools": "1.12.4",
     "grpc_tools_node_protoc_ts": "5.3.3",

diff --git a/packages/cactus-core/package.json b/packages/cactus-core/package.json
@@ -52,14 +52,14 @@
   "dependencies": {
     "@hyperledger/cactus-common": "2.0.0-alpha.2",
     "@hyperledger/cactus-core-api": "2.0.0-alpha.2",
-    "express": "4.17.3",
+    "express": "4.18.2",
     "express-jwt-authz": "2.4.1",
     "express-openapi-validator": "5.0.4",
     "safe-stable-stringify": "2.4.3",
     "typescript-optional": "2.0.1"
   },
   "devDependencies": {
-    "@types/express": "4.17.13",
+    "@types/express": "4.17.19",
     "uuid": "8.3.2"
   },
   "engines": {

diff --git a/packages/cactus-plugin-consortium-manual/package.json b/packages/cactus-plugin-consortium-manual/package.json
@@ -59,16 +59,16 @@
     "@hyperledger/cactus-core": "2.0.0-alpha.2",
     "@hyperledger/cactus-core-api": "2.0.0-alpha.2",
     "axios": "0.21.4",
-    "body-parser": "1.19.0",
-    "express": "4.17.3",
+    "body-parser": "1.20.2",
+    "express": "4.18.2",
     "jose": "4.9.2",
     "json-stable-stringify": "1.0.1",
     "prom-client": "13.2.0",
     "typescript-optional": "2.0.1",
     "uuid": "8.3.2"
   },
   "devDependencies": {
-    "@types/express": "4.17.13",
+    "@types/express": "4.17.19",
     "@types/json-stable-stringify": "1.0.33",
     "@types/uuid": "8.3.4"
   },

diff --git a/packages/cactus-plugin-htlc-eth-besu-erc20/package.json b/packages/cactus-plugin-htlc-eth-besu-erc20/package.json
@@ -65,13 +65,13 @@
     "@hyperledger/cactus-core-api": "2.0.0-alpha.2",
     "@hyperledger/cactus-plugin-ledger-connector-besu": "2.0.0-alpha.2",
     "axios": "0.21.4",
-    "express": "4.17.1",
+    "express": "4.18.2",
     "joi": "17.9.1",
     "openapi-types": "9.1.0",
     "typescript-optional": "2.0.1"
   },
   "devDependencies": {
-    "@types/express": "4.17.13"
+    "@types/express": "4.17.19"
   },
   "engines": {
     "node": ">=10",

diff --git a/packages/cactus-plugin-htlc-eth-besu/package.json b/packages/cactus-plugin-htlc-eth-besu/package.json
@@ -76,7 +76,7 @@
     "bn.js": "5.2.1",
     "dotenv": "16.0.3",
     "ethers": "6.3.0",
-    "express": "4.17.1",
+    "express": "4.18.2",
     "joi": "17.9.1",
     "openapi-types": "9.1.0",
     "typescript-optional": "2.0.1",
@@ -85,7 +85,7 @@
   "devDependencies": {
     "@hyperledger/cactus-plugin-keychain-memory": "2.0.0-alpha.2",
     "@hyperledger/cactus-test-tooling": "2.0.0-alpha.2",
-    "@types/express": "4.17.13",
+    "@types/express": "4.17.19",
     "ds-test": "https://github.com/dapphub/ds-test.git#e282159d5170298eb2455a6c05280ab5a73a4ef0",
     "forge-std": "https://github.com/foundry-rs/forge-std.git#66bf4e2c92cf507531599845e8d5a08cc2e3b5bb"
   },

diff --git a/packages/cactus-plugin-keychain-aws-sm/package.json b/packages/cactus-plugin-keychain-aws-sm/package.json
@@ -66,9 +66,9 @@
   },
   "devDependencies": {
     "@hyperledger/cactus-test-tooling": "2.0.0-alpha.2",
-    "@types/express": "4.17.13",
+    "@types/express": "4.17.19",
     "@types/request": "2.48.7",
-    "express": "4.17.3",
+    "express": "4.18.2",
     "internal-ip": "6.2.0",
     "openapi-types": "9.1.0"
   },

diff --git a/packages/cactus-plugin-keychain-azure-kv/package.json b/packages/cactus-plugin-keychain-azure-kv/package.json
@@ -71,9 +71,9 @@
   },
   "devDependencies": {
     "@hyperledger/cactus-test-tooling": "2.0.0-alpha.2",
-    "@types/express": "4.17.13",
+    "@types/express": "4.17.19",
     "@types/request": "2.48.7",
-    "express": "4.17.1",
+    "express": "4.18.2",
     "internal-ip": "6.2.0",
     "openapi-types": "9.1.0"
   },

diff --git a/packages/cactus-plugin-keychain-google-sm/package.json b/packages/cactus-plugin-keychain-google-sm/package.json
@@ -65,9 +65,9 @@
   },
   "devDependencies": {
     "@hyperledger/cactus-test-tooling": "2.0.0-alpha.2",
-    "@types/express": "4.17.13",
+    "@types/express": "4.17.19",
     "@types/request": "2.48.7",
-    "express": "4.17.1",
+    "express": "4.18.2",
     "internal-ip": "6.2.0",
     "openapi-types": "9.1.0"
   },

diff --git a/packages/cactus-plugin-keychain-memory-wasm/package.json b/packages/cactus-plugin-keychain-memory-wasm/package.json
@@ -64,12 +64,12 @@
     "@hyperledger/cactus-core": "2.0.0-alpha.2",
     "@hyperledger/cactus-core-api": "2.0.0-alpha.2",
     "axios": "0.21.4",
-    "express": "4.17.1",
+    "express": "4.18.2",
     "prom-client": "13.2.0",
     "uuid": "8.3.2"
   },
   "devDependencies": {
-    "@types/express": "4.17.13",
+    "@types/express": "4.17.19",
     "cpy-cli": "4.2.0",
     "del-cli": "4.0.1"
   },