search

kapseliboi / zawgyi-unicode-converter-pwa

Zawgyi Unicode Converter (Angular PWA) is a progressive web application designed to auto detect and convert Zawgyi-One and standard Myanmar Unicode written in Angular and Typescript.
https://zawgyi-unicode-converter.myanmartools.org
MIT License
0 stars 3 forks source link

CVE-2022-25927 (Medium) detected in ua-parser-js-0.7.31.tgz, ua-parser-js-1.0.2.tgz #30

Open mend-bolt-for-github[bot] opened 1 year ago

mend-bolt-for-github[bot] commented 1 year ago

CVE-2022-25927 - Medium Severity Vulnerability

Vulnerable Libraries - ua-parser-js-0.7.31.tgz, ua-parser-js-1.0.2.tgz

ua-parser-js-0.7.31.tgz

Detect Browser, Engine, OS, CPU, and Device type/model from User-Agent data. Supports browser & node.js environment

Library home page: https://registry.npmjs.org/ua-parser-js/-/ua-parser-js-0.7.31.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/karma/node_modules/ua-parser-js/package.json

Dependency Hierarchy: - karma-6.3.15.tgz (Root Library) - :x: **ua-parser-js-0.7.31.tgz** (Vulnerable Library)

ua-parser-js-1.0.2.tgz

Detect Browser, Engine, OS, CPU, and Device type/model from User-Agent data. Supports browser & node.js environment

Library home page: https://registry.npmjs.org/ua-parser-js/-/ua-parser-js-1.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ua-parser-js/package.json

Dependency Hierarchy: - builders-13.0.2.tgz (Root Library) - browser-sync-2.27.7.tgz - :x: **ua-parser-js-1.0.2.tgz** (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.

Publish Date: 2023-01-25

URL: CVE-2022-25927

CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-01-25

Fix Resolution (ua-parser-js): 0.7.33

Direct dependency fix Resolution (karma): 6.3.16

Fix Resolution (ua-parser-js): 0.7.33

Direct dependency fix Resolution (@nguniversal/builders): 13.1.0

Step up your Open Source Security Game with Mend here