search

rsoreq / terragoat

TerraGoat is Bridgecrew's "Vulnerable by Design" Terraform repository. TerraGoat is a learning and training project that demonstrates how common configuration errors can find their way into production cloud environments.
https://www.bridgecrew.io/
Apache License 2.0
0 stars 0 forks source link

api-extractor-7.18.19.tgz: 1 vulnerabilities (highest severity is: 8.7) #27

Open mend-for-github-com[bot] opened 5 days ago

mend-for-github-com[bot] commented 5 days ago
Vulnerable Library - api-extractor-7.18.19.tgz

Path to dependency file: /packages/node/base/package.json

Path to vulnerable library: /packages/node/base/node_modules/validator/package.json

Found in HEAD commit: d42725f4065c555d9b0a227fdb42ad5e87b8d984

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (api-extractor version) Remediation Possible** Reachability
CVE-2021-3765 High 8.7 Not Defined 0.1% validator-8.2.0.tgz Transitive 7.19.2 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-3765 ### Vulnerable Library - validator-8.2.0.tgz

String validation and sanitization

Library home page: https://registry.npmjs.org/validator/-/validator-8.2.0.tgz

Path to dependency file: /packages/node/base/package.json

Path to vulnerable library: /packages/node/base/node_modules/validator/package.json

Dependency Hierarchy: - api-extractor-7.18.19.tgz (Root Library) - node-core-library-3.43.2.tgz - z-schema-3.18.4.tgz - :x: **validator-8.2.0.tgz** (Vulnerable Library)

Found in HEAD commit: d42725f4065c555d9b0a227fdb42ad5e87b8d984

Found in base branch: master

### Vulnerability Details

validator.js is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-11-02

URL: CVE-2021-3765

### Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

### CVSS 4 Score Details (8.7)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A

For more information on CVSS4 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-qgmg-gppg-76g5

Release Date: 2021-11-02

Fix Resolution (validator): 13.7.0

Direct dependency fix Resolution (@microsoft/api-extractor): 7.19.2

In order to enable automatic remediation, please create workflow rules

In order to enable automatic remediation for this issue, please create workflow rules