Generated on Apr 21, 2024 via pnpm

Npm

passport-saml-encrypted 0.0.2

A Passport strategy for handling encrypted SAML authentication responses

passport

saml

saml2.0

encryption

authentication

sso

Package summary

issues

licenses

Package created

1 Feb 2014

Version published

2 Feb 2014

Maintainers

Total deps

Direct deps

License

BSD-2-Clause

Issues

6 critical severity issues

critical

ejs@0.8.8

ejs template injection vulnerability

Recommendation: Upgrade to version 3.1.7 or later

via: xml-encryption@0.3.5

xmldom@0.1.16

xmldom allows multiple root nodes in a DOM

Recommendation: None

via: xml-crypto@0.0.22 & others

ejs@0.8.8

ejs is vulnerable to remote code execution due to weak input validation

Recommendation: Upgrade to version 2.5.5 or later

via: xml-encryption@0.3.5

ejs@0.8.8

Package has no specified license

Recommendation: Check the package code and files for license information

via: xml-encryption@0.3.5

node-forge@0.2.24

Package has no specified license

Recommendation: Check the package code and files for license information

via: xml-encryption@0.3.5

pause@0.0.1

Package has no specified license

Recommendation: Check the package code and files for license information

via: passport@0.2.2

Collapse

Expand

12 high severity issues

high

xml-crypto@0.0.22

xml-crypto's HMAC-SHA1 signatures can bypass validation via key confusion

Recommendation: Upgrade to version 2.0.0 or later

via: xml-crypto@0.0.22

ejs@0.8.8

ejs vulnerable to DoS due to weak input validation

Recommendation: Upgrade to version 2.5.5 or later

via: xml-encryption@0.3.5

node-forge@0.2.24

Prototype Pollution in node-forge

Recommendation: Upgrade to version 0.10.0 or later

via: xml-encryption@0.3.5

node-forge@0.2.24

Improper Verification of Cryptographic Signature in node-forge

Recommendation: Upgrade to version 1.3.0 or later

via: xml-encryption@0.3.5

node-forge@0.2.24

Improper Verification of Cryptographic Signature in node-forge

Recommendation: Upgrade to version 1.3.0 or later

via: xml-encryption@0.3.5

xml-crypto@0.0.22

Package uses an invalid SPDX license ("MIT License")

Recommendation: Validate that the package complies with your license policy

via: xml-crypto@0.0.22

xpath@0.0.5

Package uses an invalid SPDX license ("MIT License")

Recommendation: Validate that the package complies with your license policy

via: xml-encryption@0.3.5 & others

xmldom-fork-fixed@0.0.1

Package uses an invalid SPDX license ("LGPL")

Recommendation: Validate that the package complies with your license policy

via: xml-crypto@0.0.22

xmldom@0.1.16

Package uses an invalid SPDX license ("LGPL")

Recommendation: Validate that the package complies with your license policy

via: xml-crypto@0.0.22

ejs@0.8.8

Deprecated package

via: xml-encryption@0.3.5

xmldom@0.1.16

Deprecated package

via: xml-crypto@0.0.22

xmldom@0.1.31

Deprecated package

via: xml-encryption@0.3.5 & others

Collapse

Expand

8 moderate severity issues

moderate

node-forge@0.2.24

Improper Verification of Cryptographic Signature in `node-forge`

Recommendation: Upgrade to version 1.3.0 or later

via: xml-encryption@0.3.5

xmldom@0.1.16

Misinterpretation of malicious XML input

Recommendation: Upgrade to version 0.5.0 or later

via: xml-crypto@0.0.22 & others

ejs@0.8.8

mde ejs vulnerable to XSS

Recommendation: Upgrade to version 2.5.5 or later

via: xml-encryption@0.3.5

passport@0.2.2

Passport vulnerable to session regeneration when a users logs in or out

Recommendation: Upgrade to version 0.6.0 or later

via: passport@0.2.2

node-forge@0.2.24

Open Redirect in node-forge

Recommendation: Upgrade to version 1.0.0 or later

via: xml-encryption@0.3.5

xmldom@0.1.16

Misinterpretation of malicious XML input

Recommendation: None

via: xml-crypto@0.0.22 & others

xml2js@0.4.23

xml2js is vulnerable to prototype pollution

Recommendation: Upgrade to version 0.5.0 or later

via: xml2js@0.4.23

pause@0.0.1

Package has no specified source code repository

via: passport@0.2.2

Collapse

Expand

7 low severity issues

low

node-forge@0.2.24

Prototype Pollution in node-forge debug API.

Recommendation: Upgrade to version 1.0.0 or later

via: xml-encryption@0.3.5

node-forge@0.2.24

Prototype Pollution in node-forge util.setPath API

Recommendation: Upgrade to version 0.10.0 or later

via: xml-encryption@0.3.5

node-forge@0.2.24

URL parsing in node-forge could lead to undesired behavior.

Recommendation: Upgrade to version 1.0.0 or later

via: xml-encryption@0.3.5

xml-crypto@0.0.22

Package uses a license that is not OSI approved ("MIT License")

Recommendation: Read and validate the license terms

via: xml-crypto@0.0.22

xpath@0.0.5

Package uses a license that is not OSI approved ("MIT License")

Recommendation: Read and validate the license terms

via: xml-encryption@0.3.5 & others

xmldom-fork-fixed@0.0.1

Package uses a license that is not OSI approved ("LGPL")

Recommendation: Read and validate the license terms

via: xml-crypto@0.0.22

xmldom@0.1.16

Package uses a license that is not OSI approved ("LGPL")

Recommendation: Read and validate the license terms

via: xml-crypto@0.0.22

Collapse

Expand

Licenses

MIT License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

sublicense

private-use

Cannot

hold-liable

Must

include-copyright

include-license

7 Packages, Including:

async@0.2.10

passport-strategy@1.0.0

passport@0.2.2

xml-encryption@0.3.5

xml2js@0.4.23

xmlbuilder@11.0.1

xpath.js@1.1.0

N/A

3 Packages, Including:

ejs@0.8.8

node-forge@0.2.24

pause@0.0.1

MIT License

Invalid

Not OSI Approved

2 Packages, Including:

xml-crypto@0.0.22

xpath@0.0.5

LGPL

Invalid

Not OSI Approved

2 Packages, Including:

xmldom-fork-fixed@0.0.1

xmldom@0.1.16

BSD 2-Clause "Simplified" License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

place-warranty

Cannot

hold-liable

Must

include-copyright

include-license

1 Packages, Including:

passport-saml-encrypted@0.0.2

ISC License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

Cannot

hold-liable

Must

include-copyright

include-license

1 Packages, Including:

sax@1.3.0

(LGPL-2.0 or MIT)

Permissive

1 Packages, Including:

xmldom@0.1.31

Direct Dependencies

All Dependencies CSV

ⓘ This is a list of passport-saml-encrypted 's direct dependencies. Data on all dependencies, including transitive ones, is available via CSV download.

Name	Version	Size	License	Type	Vulnerabilities
passport	0.2.2	11.94 kB	MIT	prod	1 2
xml-crypto	0.0.22	59.51 kB	MIT License	prod	1 5 2 3
xml-encryption	0.3.5	9.59 kB	MIT	prod	5 7 5 4
xml2js	0.4.23	12.64 kB	MIT	prod	1
xmldom	0.1.31	19.5 kB	(LGPL-2.0 or MIT)	prod	1 1 2
xpath	0.0.5	21.36 kB	MIT License	prod	1 1