search

orientechnologies / orientjs

The official fast, lightweight node.js client for OrientDB
http://orientdb.com
Other
326 stars 67 forks source link

DoS vulnerability in dependency #428

Open isaactzab opened 4 years ago

isaactzab commented 4 years ago

The package orientjs > yargs > os-locale > mem has a DoS vulnerability.

From npm audit

                       === npm audit security report ===                        
┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Denial of Service                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ mem                                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.0.0                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ orientjs                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ orientjs > yargs > os-locale > mem                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1084                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 1 low severity vulnerability in 2546 scanned packages
  1 vulnerability requires manual review. See the full report for details.
isaactzab commented 4 years ago

Recomendation: Update "yargs": "^11.0.0" to "yargs": "^13.3.0"