chatziko / location-guard

Hide your geographic location from websites.
391 stars 65 forks source link

同学,您这个项目引入了161个开源组件,存在7个漏洞,辛苦升级一下 #84

Closed dependasec[bot] closed 2 years ago

dependasec[bot] commented 2 years ago

检测到 chatziko/location-guard 一共引入了161个开源组件,存在7个漏洞

漏洞标题:Elliptic package 输入验证错误漏洞
缺陷组件:elliptic@6.5.1
漏洞编号:CVE-2020-13822
漏洞描述:Elliptic package是一款基于JavaScript的椭圆曲线密码库。
Elliptic package 6.5.2版本(Node.js)中存在安全漏洞。攻击者可利用该漏洞提升权限。
国家漏洞库信息:https://www.cnvd.org.cn/flaw/show/CNVD-2020-36744
影响范围:(∞, 6.5.3)
最小修复版本:6.5.3
缺陷组件引入路径:location-guard@->browserify@16.5.0->crypto-browserify@3.12.0->create-ecdh@4.0.3->elliptic@6.5.1
location-guard@->browserify@16.5.0->crypto-browserify@3.12.0->browserify-sign@4.0.4->elliptic@6.5.1

另外还有7个漏洞,详细报告:https://mofeisec.com/jr?p=a92f43

chatziko commented 2 years ago

npm packages are upgraded now, thanks for reporting.