Update dependency tunnel-agent to ~0.6.0 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
tunnel-agent	~0.4.1 → ~0.6.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Memory Exposure in tunnel-agent

GHSA-xc7v-wxcw-j472

More information

Details

Versions of tunnel-agent before 0.6.0 are vulnerable to memory exposure.

This is exploitable if user supplied input is provided to the auth value and is a number.

Proof-of-concept:

require('request')({
  method: 'GET',
  uri: 'http://www.example.com',
  tunnel: true,
  proxy:{
    protocol: 'http:',
    host:'127.0.0.1',
    port:8080,
    auth:USERSUPPLIEDINPUT // number
  }
});

Recommendation

Update to version 0.6.0 or later.

Severity

Medium

References

• https://github.com/request/tunnel-agent/commit/9ca95ec7219daface8a6fc2674000653de0922c0
• https://www.npmjs.com/advisories/598
• https://gist.github.com/ChALkeR/fd6b2c445834244e7d440a043f9d2ff4
• https://github.com/advisories/GHSA-xc7v-wxcw-j472

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

mikeal/tunnel-agent (tunnel-agent)

v0.6.0

Compare Source

v0.5.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request