A vulnerability was found in Segmentio is-url up to 1.2.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. Upgrading to version 1.2.3 is able to address this issue. The patch is identified as 149550935c63a98c11f27f694a7c4a9479e53794. It is recommended to upgrade the affected component. VDB-220058 is the identifier assigned to this vulnerability.
CVE-2018-25079 - High Severity Vulnerability
Check whether a string is a URL.
Library home page: https://registry.npmjs.org/is-url/-/is-url-1.2.2.tgz
Path to dependency file: /E-voting-using-blockchain/evoting app/src/package.json
Path to vulnerable library: /evoting app/src/node_modules/is-url/package.json
Dependency Hierarchy: - grunt-image-1.5.2.tgz (Root Library) - advpng-bin-3.0.0.tgz - bin-build-2.2.0.tgz - download-4.4.3.tgz - :x: **is-url-1.2.2.tgz** (Vulnerable Library)
Found in HEAD commit: 3c02898f89d78283ce791eb1b53b2b5a667681ad
Found in base branch: master
A vulnerability was found in Segmentio is-url up to 1.2.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. Upgrading to version 1.2.3 is able to address this issue. The patch is identified as 149550935c63a98c11f27f694a7c4a9479e53794. It is recommended to upgrade the affected component. VDB-220058 is the identifier assigned to this vulnerability.
Publish Date: 2023-02-04
URL: CVE-2018-25079
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2018-25079
Release Date: 2023-02-04
Fix Resolution (is-url): 1.2.3
Direct dependency fix Resolution (grunt-image): 2.0.0
Step up your Open Source Security Game with Mend here