search

lesjoursfr / gdpr-consent

GDPR banner to comply with the European cookie law. Inspired by tarteaucitronjs.
MIT License
8 stars 4 forks source link

WS-2020-0341 (High) detected in front-matter-2.1.2.tgz - autoclosed #149

Closed mend-bolt-for-github[bot] closed 3 years ago

mend-bolt-for-github[bot] commented 3 years ago

WS-2020-0341 - High Severity Vulnerability

Vulnerable Library - front-matter-2.1.2.tgz

Extract YAML front matter from a string

Library home page: https://registry.npmjs.org/front-matter/-/front-matter-2.1.2.tgz

Path to dependency file: gdpr-consent/package.json

Path to vulnerable library: gdpr-consent/node_modules/front-matter/package.json

Dependency Hierarchy: - sass-lint-1.13.1.tgz (Root Library) - :x: **front-matter-2.1.2.tgz** (Vulnerable Library)

Found in HEAD commit: 4ec31cba6a050fd1e1159f9efa5d328b3a4efb23

Found in base branch: master

Vulnerability Details

Arbitrary Code Execution vulnerability was found in front-matter before 4.0.1. Caused by the default usage of the function yaml.load().

Publish Date: 2020-05-13

URL: WS-2020-0341

CVSS 3 Score Details (9.4)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/jxson/front-matter/issues/65

Release Date: 2020-05-13

Fix Resolution: front-matter - 4.0.1

Step up your Open Source Security Game with WhiteSource here

mend-bolt-for-github[bot] commented 3 years ago

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.