search

eldorplus / laravel-elixir-clean-unofficial

Laravel Elixir Cleanning Extension
1 stars 0 forks source link

CVE-2017-16032 (Medium) detected in brace-expansion-1.1.6.tgz - autoclosed #139

Closed mend-bolt-for-github[bot] closed 3 years ago

mend-bolt-for-github[bot] commented 3 years ago

CVE-2017-16032 - Medium Severity Vulnerability

Vulnerable Library - brace-expansion-1.1.6.tgz

Brace expansion as known from sh/bash

Library home page: https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.6.tgz

Path to dependency file: laravel-elixir-clean-unofficial/package.json

Path to vulnerable library: laravel-elixir-clean-unofficial/node_modules/brace-expansion

Dependency Hierarchy: - gulp-3.9.1.tgz (Root Library) - vinyl-fs-0.3.14.tgz - glob-stream-3.1.18.tgz - minimatch-2.0.10.tgz - :x: **brace-expansion-1.1.6.tgz** (Vulnerable Library)

Found in HEAD commit: ad004d8380ed05404f972ceefd6529e3a89c49b1

Found in base branch: master

Vulnerability Details

brace-expansion before 1.1.7 are vulnerable to a regular expression denial of service.

Publish Date: 2020-07-21

URL: CVE-2017-16032

CVSS 3 Score Details (5.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: High - Privileges Required: Low - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/338

Release Date: 2020-07-21

Fix Resolution: v1.1.7

Step up your Open Source Security Game with WhiteSource here

mend-bolt-for-github[bot] commented 3 years ago

:information_source: This issue was automatically closed by WhiteSource because it is a duplicate of an existing issue: #141

mend-bolt-for-github[bot] commented 3 years ago

:information_source: This issue was automatically closed by WhiteSource because it is a duplicate of an existing issue: #141

mend-bolt-for-github[bot] commented 3 years ago

:information_source: This issue was automatically closed by WhiteSource because it is a duplicate of an existing issue: #141

mend-bolt-for-github[bot] commented 3 years ago

:information_source: This issue was automatically closed by WhiteSource because it is a duplicate of an existing issue: #141