Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bulk vulnerability fix - Lockfile fix #268

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

debricked[bot]
Copy link

@debricked debricked bot commented Aug 31, 2021

Bulk vulnerability fix - Lockfile fix

This pull request will update your transitive dependencies within the allowed version intervals provided by your direct dependencies.

Fixed vulnerabilities:

CVE–2020–28500
CVE–2021–23337
CVE–2021–23364
CVE–2021–23343
CVE–2021–27515
CVE–2020–7793
CVE–2021–27292
CVE–2021–21366
CVE–2021–29060
CVE–2021–33502
  • Description

    GitHub

    ReDoS in normalize-url

    The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

    NVD

    The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

  • CVSS details - 7.5

     

    CVSS3 metrics
    Attack Vector Network
    Attack Complexity Low
    Privileges Required None
    User interaction None
    Scope Unchanged
    Confidentiality None
    Integrity None
    Availability High
  • References

        Release v6.0.1 · sindresorhus/normalize-url · GitHub
        NVD - CVE-2021-33502
        ReDoS in normalize-url · CVE-2021-33502 · GitHub Advisory Database · GitHub

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more at Debricked

 

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants