WS-2017-0247 (Low) detected in ms-0.7.1.tgz, ms-0.7.2.tgz

[mend-bolt-for-github[bot]]

WS-2017-0247 - Low Severity Vulnerability

Vulnerable Libraries - ms-0.7.1.tgz, ms-0.7.2.tgz

ms-0.7.1.tgz

Tiny ms conversion utility

Library home page: https://registry.npmjs.org/ms/-/ms-0.7.1.tgz

Path to dependency file: /Turismo-Torrevieja/package.json

Path to vulnerable library: /tmp/git/Turismo-Torrevieja/node_modules/socket.io-parser/node_modules/ms/package.json

Dependency Hierarchy: - karma-1.7.1.tgz (Root Library) - socket.io-1.7.3.tgz - socket.io-parser-2.3.1.tgz - debug-2.2.0.tgz - :x: **ms-0.7.1.tgz** (Vulnerable Library)

ms-0.7.2.tgz

Tiny milisecond conversion utility

Library home page: https://registry.npmjs.org/ms/-/ms-0.7.2.tgz

Path to dependency file: /Turismo-Torrevieja/package.json

Path to vulnerable library: /tmp/git/Turismo-Torrevieja/node_modules/socket.io-client/node_modules/ms/package.json

Dependency Hierarchy: - karma-1.7.1.tgz (Root Library) - socket.io-1.7.3.tgz - engine.io-1.8.3.tgz - debug-2.3.3.tgz - :x: **ms-0.7.2.tgz** (Vulnerable Library)

Found in HEAD commit: 5fe809a2e7cf19f24da932e71d58c622ec363c70

Vulnerability Details

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS).

Publish Date: 2017-05-15

URL: WS-2017-0247

CVSS 2 Score Details (3.4)

Base Score Metrics not available

Suggested Fix

Type: Change files

Origin: https://github.com/zeit/ms/commit/305f2ddcd4eff7cc7c518aca6bb2b2d2daad8fef

Release Date: 2017-04-12

Fix Resolution: Replace or update the following file: index.js

---

Step up your Open Source Security Game with WhiteSource here