Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-uqy7-83dp-37gd

Summary

Embedded malware in ua-parser-js
The npm package `ua-parser-js` had three versions published with malicious code. Users of affected versions (0.7.29, 0.8.0, 1.0.0) should upgrade as soon as possible and check their systems for suspicious activity. See [this issue](https://github.com/faisalman/ua-parser-js/issues/536) for details as they unfold.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Aliases

alias	CVE-2021-4229

alias	GHSA-pjwm-rvh2-c87w

alias	GMS-2021-1

Fixed_packages

url pkg:npm/ua-parser-js@0.7.30

purl pkg:npm/ua-parser-js@0.7.30

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-5rba-b2bd-nfgv

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/ua-parser-js@0.7.30

url	pkg:npm/ua-parser-js@0.8.1
purl	pkg:npm/ua-parser-js@0.8.1
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:npm/ua-parser-js@0.8.1

url	pkg:npm/ua-parser-js@1.0.1
purl	pkg:npm/ua-parser-js@1.0.1
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:npm/ua-parser-js@1.0.1

Affected_packages

url pkg:npm/ua-parser-js@0.7.29

purl pkg:npm/ua-parser-js@0.7.29

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-uqy7-83dp-37gd

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/ua-parser-js@0.7.29

url pkg:npm/ua-parser-js@0.8.0

purl pkg:npm/ua-parser-js@0.8.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-5rba-b2bd-nfgv

vulnerability	VCID-uqy7-83dp-37gd

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/ua-parser-js@0.8.0

url pkg:npm/ua-parser-js@1.0.0

purl pkg:npm/ua-parser-js@1.0.0

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-uqy7-83dp-37gd

resource_url http://public2.vulnerablecode.io/packages/pkg:npm/ua-parser-js@1.0.0

References

reference_url	https://github.com/faisalman/ua-parser-js
reference_id
reference_type
scores
url	https://github.com/faisalman/ua-parser-js

reference_url	https://github.com/faisalman/ua-parser-js/issues/536
reference_id
reference_type
scores
url	https://github.com/faisalman/ua-parser-js/issues/536

reference_url	https://github.com/faisalman/ua-parser-js/issues/536#issuecomment-949772496
reference_id
reference_type
scores
url	https://github.com/faisalman/ua-parser-js/issues/536#issuecomment-949772496

reference_url	https://us-cert.cisa.gov/ncas/current-activity/2021/10/22/malware-discovered-popular-npm-package-ua-parser-js
reference_id
reference_type
scores
url	https://us-cert.cisa.gov/ncas/current-activity/2021/10/22/malware-discovered-popular-npm-package-ua-parser-js

reference_url	https://www.npmjs.com/package/ua-parser-js
reference_id
reference_type
scores
url	https://www.npmjs.com/package/ua-parser-js

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2021-4229
reference_id	CVE-2021-4229
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2021-4229

reference_url	https://github.com/advisories/GHSA-pjwm-rvh2-c87w
reference_id	GHSA-pjwm-rvh2-c87w
reference_type
scores
url	https://github.com/advisories/GHSA-pjwm-rvh2-c87w

Weaknesses

cwe_id	829
name	Inclusion of Functionality from Untrusted Control Sphere
description	The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

cwe_id	912
name	Hidden Functionality
description	The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-uqy7-83dp-37gd

Vulnerability Instance