search

billmcchesney1 / hadoop

Mirror of Apache Hadoop
Apache License 2.0
0 stars 0 forks source link

WS-2017-0247 (Low) detected in ms-0.6.2.tgz, ms-0.7.1.tgz - autoclosed #12

Closed mend-for-github-com[bot] closed 2 years ago

mend-for-github-com[bot] commented 3 years ago

WS-2017-0247 - Low Severity Vulnerability

Vulnerable Libraries - ms-0.6.2.tgz, ms-0.7.1.tgz

ms-0.6.2.tgz

Tiny ms conversion utility

Library home page: https://registry.npmjs.org/ms/-/ms-0.6.2.tgz

Path to dependency file: hadoop/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-ui/src/main/webapp/package.json

Path to vulnerable library: hadoop/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-ui/src/main/webapp/node_modules/socket.io-pure/node_modules/ms/package.json,hadoop/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-ui/src/main/webapp/node_modules/leek/node_modules/debug/node_modules/ms/package.json,hadoop/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-ui/src/main/webapp/node_modules/engine.io-pure/node_modules/ms/package.json,hadoop/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-ui/src/main/webapp/node_modules/socket.io-adapter/node_modules/ms/package.json,hadoop/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-ui/src/main/webapp/node_modules/engine.io-client-pure/node_modules/ms/package.json

Dependency Hierarchy: - testem-0.9.11.tgz (Root Library) - socket.io-pure-1.3.12.tgz - debug-2.1.0.tgz - :x: **ms-0.6.2.tgz** (Vulnerable Library)

ms-0.7.1.tgz

Tiny ms conversion utility

Library home page: https://registry.npmjs.org/ms/-/ms-0.7.1.tgz

Path to dependency file: hadoop/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-ui/src/main/webapp/package.json

Path to vulnerable library: hadoop/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-ui/src/main/webapp/node_modules/npm/node_modules/node-gyp/node_modules/path-array/node_modules/array-index/node_modules/debug/node_modules/ms/package.json,hadoop/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-ui/src/main/webapp/node_modules/tiny-lr/node_modules/ms/package.json

Dependency Hierarchy: - ember-cli-1.13.14.tgz (Root Library) - npm-2.14.10.tgz - node-gyp-3.0.3.tgz - path-array-1.0.0.tgz - array-index-0.1.1.tgz - debug-2.2.0.tgz - :x: **ms-0.7.1.tgz** (Vulnerable Library)

Found in HEAD commit: 6dcd8400219941dcbd7fb0f6b980cc2c6a2a6b0a

Found in base branch: trunk

Vulnerability Details

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS).

Publish Date: 2017-04-12

URL: WS-2017-0247

CVSS 2 Score Details (3.4)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://github.com/vercel/ms/pull/89

Release Date: 2017-04-12

Fix Resolution: 2.1.1

mend-for-github-com[bot] commented 2 years ago

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.