Bulk vulnerability fix - Lockfile fix #268
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Bulk vulnerability fix - Lockfile fix
This pull request will update your transitive dependencies within the allowed version intervals provided by your direct dependencies.
Fixed vulnerabilities:
CVE–2020–28500
Description
NVD
CVSS details - 5.3
References
CONFIRM
perf: improve performance of
toNumber
,trim
andtrimEnd
on large input strings by falsyvalues · Pull Request #5065 · lodash/lodash · GitHubFebruary 2021 Lodash Vulnerabilities in NetApp Products | NetApp Product Security
Improve performance of
toNumber
,trim
andtrimEnd
on large inpu… · lodash/lodash@c4847eb · GitHubCVE–2021–23337
Description
Improper Neutralization of Special Elements used in a Command ('Command Injection')
GitHub
NVD
CVSS details - 7.2
References
MISC
February 2021 Lodash Vulnerabilities in NetApp Products | NetApp Product Security
lodash/lodash.js at ddfd9b11a0126db2302cb70ec9973b66baec0975 · lodash/lodash · GitHub
NVD - CVE-2021-23337
Prevent command injection through
_.template
'svariable
option · lodash/lodash@3469357 · GitHubCommand Injection in lodash · CVE-2021-23337 · GitHub Advisory Database · GitHub
CVE–2021–23364
Description
GitHub
NVD
CVSS details - 5.3
References
Fix unsafe regexp · browserslist/browserslist@c091916 · GitHub
Fix ReDoS by yetingli · Pull Request #593 · browserslist/browserslist · GitHub
MISC
Regular Expression Denial of Service in browserslist · CVE-2021-23364 · GitHub Advisory Database · GitHub
browserslist/index.js at e82f32d1d4100d6bc79ea0b6b6a2d281a561e33c · browserslist/browserslist · GitHub
NVD - CVE-2021-23364
CVE–2021–23343
Description
NVD
CVSS details - 7.5
References
ReDoS in path-parse · Issue #8 · jbgutierrez/path-parse · GitHub
Pony Mail!
fixed regexes to avoid ReDoS attacks by jeffrey-pinyan-ithreat · Pull Request #10 · jbgutierrez/path-parse · GitHub
CVE–2021–27515
Description
GitHub
NVD
CVSS details - 5.3
References
[security] More backslash fixes (#197) · unshiftio/url-parse@d1e7e88 · GitHub
Comparing 1.4.7...1.5.0 · unshiftio/url-parse · GitHub
[security] More backslash fixes by 3rd-Eden · Pull Request #197 · unshiftio/url-parse · GitHub
MISC
NVD - CVE-2021-27515
Path traversal in url-parse · CVE-2021-27515 · GitHub Advisory Database · GitHub
CVE–2020–7793
Description
Uncontrolled Resource Consumption
NVD
CVSS details - 7.5
References
Fix ReDoS vulnerabilities reported by Snyk · faisalman/ua-parser-js@6d1f26d · GitHub
GitHub - faisalman/ua-parser-js: UAParser.js - Detect Browser, Engine, OS, CPU, and Device type/model from User-Agent data. Supports browser & node.js environment.
GitHub - faisalman/ua-parser-js: UAParser.js - Detect Browser, Engine, OS, CPU, and Device type/model from User-Agent data. Supports browser & node.js environment.
CVE–2021–27292
Description
GitHub
NVD
CVSS details - 7.5
References
cve-2021-27292 · GitHub
Fix several exponential/cubic complexity regexes found by Ben Caller/… · pygments/pygments@2e7e8c4 · GitHub
Fix potential ReDoS vulnerability as reported by Doyensec · faisalman/ua-parser-js@809439e · GitHub
Regular Expression Denial of Service (ReDoS) in ua-parser-js · CVE-2021-27292 · GitHub Advisory Database · GitHub
NVD - CVE-2021-27292
CVE–2021–21366
Description
Interpretation Conflict
GitHub
NVD
CVSS details - 4.3
References
Merge pull request from GHSA-h6q6-9hqw-rwfv · xmldom/xmldom@d4201b9 · GitHub
Release 0.5.0 · xmldom/xmldom · GitHub
Misinterpretation of malicious XML input · Advisory · xmldom/xmldom · GitHub
xmldom - npm
NVD - CVE-2021-21366
GitHub - xmldom/xmldom: A pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.
Misinterpretation of malicious XML input · CVE-2021-21366 · GitHub Advisory Database · GitHub
xmldom/LICENSE at dc429ae2ebd09e2fa3380c4a9b292d1164898f02 · xmldom/xmldom · GitHub
Issues · xmldom/xmldom · GitHub
GitHub - jindw/xmldom: A PURE JS W3C Standard based(XML DOM Level2 CORE) DOMParser and XMLSerializer.
Issues · xmldom/xmldom · GitHub
CVE–2021–29060
Description
Allocation of Resources Without Limits or Throttling
GitHub
NVD
CVSS details - 5.3
References
SaveResults/color-string.js at main · yetingli/SaveResults · GitHub
PoCs/Color-String.md at main · yetingli/PoCs · GitHub
fix ReDos in hwb() parser (low-severity) · Qix-/color-string@0789e21 · GitHub
color-string - npm
GitHub - Qix-/color-string: Parser and generator for CSS color strings
Regular Expression Denial of Service (ReDOS) · CVE-2021-29060 · GitHub Advisory Database · GitHub
GitHub - Qix-/color-string: Parser and generator for CSS color strings
NVD - CVE-2021-29060
CVE–2021–33502
Description
GitHub
NVD
CVSS details - 7.5
References
Release v6.0.1 · sindresorhus/normalize-url · GitHub
NVD - CVE-2021-33502
ReDoS in normalize-url · CVE-2021-33502 · GitHub Advisory Database · GitHub
Related information
📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more at Debricked