search

SharonKoch / Wiki_Demo

Wiki.js | A modern and powerful wiki app built on Node.js
https://js.wiki
GNU Affero General Public License v3.0
1 stars 0 forks source link

cheerio-1.0.0-rc.5.tgz: 2 vulnerabilities (highest severity is: 7.5) #4

Open mend-for-github-com[bot] opened 9 months ago

mend-for-github-com[bot] commented 9 months ago
Vulnerable Library - cheerio-1.0.0-rc.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/css-select/node_modules/nth-check/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (cheerio version) Remediation Possible**
CVE-2021-3803 High 7.5 nth-check-2.0.0.tgz Transitive 1.0.0 ✅
CVE-2021-33587 High 7.5 css-what-4.0.0.tgz Transitive 1.0.0 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-3803 ### Vulnerable Library - nth-check-2.0.0.tgz

Parses and compiles CSS nth-checks to highly optimized functions.

Library home page: https://registry.npmjs.org/nth-check/-/nth-check-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/css-select/node_modules/nth-check/package.json

Dependency Hierarchy: - cheerio-1.0.0-rc.5.tgz (Root Library) - cheerio-select-tmp-0.1.1.tgz - css-select-3.1.2.tgz - :x: **nth-check-2.0.0.tgz** (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

### Vulnerability Details

nth-check is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3803

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2021-09-17

Fix Resolution (nth-check): 2.0.1

Direct dependency fix Resolution (cheerio): 1.0.0

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2021-33587 ### Vulnerable Library - css-what-4.0.0.tgz

a CSS selector parser

Library home page: https://registry.npmjs.org/css-what/-/css-what-4.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/cheerio-select-tmp/node_modules/css-what/package.json,/node_modules/css-select/node_modules/css-what/package.json

Dependency Hierarchy: - cheerio-1.0.0-rc.5.tgz (Root Library) - cheerio-select-tmp-0.1.1.tgz - :x: **css-what-4.0.0.tgz** (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

### Vulnerability Details

The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.

Publish Date: 2021-05-28

URL: CVE-2021-33587

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33587

Release Date: 2021-05-28

Fix Resolution (css-what): 5.0.1

Direct dependency fix Resolution (cheerio): 1.0.0

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.