search

hisptz / function-analytics

GNU Lesser General Public License v3.0
0 stars 3 forks source link

WS-2018-0590 (High) detected in diff-1.4.0.tgz #67

Open mend-bolt-for-github[bot] opened 5 years ago

mend-bolt-for-github[bot] commented 5 years ago

WS-2018-0590 - High Severity Vulnerability

Vulnerable Library - diff-1.4.0.tgz

A javascript text diff implementation.

Library home page: https://registry.npmjs.org/diff/-/diff-1.4.0.tgz

Path to dependency file: /function-analytics/package.json

Path to vulnerable library: /tmp/git/function-analytics/node_modules/disparity/node_modules/diff/package.json

Dependency Hierarchy: - documentation-11.0.0.tgz (Root Library) - disparity-2.0.0.tgz - :x: **diff-1.4.0.tgz** (Vulnerable Library)

Found in HEAD commit: 0e27d936a36ea039704d027e5394e4e897a09c5b

Vulnerability Details

A vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.

Publish Date: 2019-06-11

URL: WS-2018-0590

CVSS 2 Score Details (7.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://github.com/kpdecker/jsdiff/commit/2aec4298639bf30fb88a00b356bf404d3551b8c0

Release Date: 2019-06-11

Fix Resolution: 3.5.0

Step up your Open Source Security Game with WhiteSource here

issue-label-bot[bot] commented 5 years ago

Issue-Label Bot is automatically applying the label bug to this issue, with a confidence of 0.98. Please mark this comment with :thumbsup: or :thumbsdown: to give our bot feedback!

Links: app homepage, dashboard and code for this bot.