You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Path to dependency file: /hadoop-yarn-project/hadoop-yarn/hadoop-yarn-ui/src/main/webapp/package.json
Path to vulnerable library: /hadoop-yarn-project/hadoop-yarn/hadoop-yarn-ui/src/main/webapp/node_modules/leek/node_modules/request/node_modules/bl/package.json
bl before version 0.9.5 and version 1.0.1 are vulnerable to memory exposure. "bl.append(number)" in the affected bl versions passes a number to buffer constructor, appending a chunk of uninitialized memory
mend-for-github-combot
changed the title
WS-2018-0074 (Medium) detected in bl-0.9.4.tgz
WS-2018-0074 (Medium) detected in bl-0.9.4.tgz - autoclosed
Jun 16, 2023
mend-for-github-combot
changed the title
WS-2018-0074 (Medium) detected in bl-0.9.4.tgz - autoclosed
WS-2018-0074 (Medium) detected in bl-0.9.4.tgz
Jun 21, 2023
mend-for-github-combot
changed the title
WS-2018-0074 (Medium) detected in bl-0.9.4.tgz
WS-2018-0074 (Medium) detected in bl-0.9.4.tgz - autoclosed
Apr 19, 2024
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
WS-2018-0074 - Medium Severity Vulnerability
Vulnerable Library - bl-0.9.4.tgz
Buffer List: collect buffers and access with a standard readable Buffer interface, streamable too!
Library home page: https://registry.npmjs.org/bl/-/bl-0.9.4.tgz
Path to dependency file: /hadoop-yarn-project/hadoop-yarn/hadoop-yarn-ui/src/main/webapp/package.json
Path to vulnerable library: /hadoop-yarn-project/hadoop-yarn/hadoop-yarn-ui/src/main/webapp/node_modules/leek/node_modules/request/node_modules/bl/package.json
Dependency Hierarchy:
Found in HEAD commit: 6dcd8400219941dcbd7fb0f6b980cc2c6a2a6b0a
Found in base branch: trunk
Vulnerability Details
bl before version 0.9.5 and version 1.0.1 are vulnerable to memory exposure. "bl.append(number)" in the affected bl versions passes a number to buffer constructor, appending a chunk of uninitialized memory
Publish Date: 2018-04-25
URL: WS-2018-0074
CVSS 3 Score Details (6.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2018-01-27
Fix Resolution (bl): 0.9.5
Direct dependency fix Resolution (ember-cli): 1.13.15
The text was updated successfully, but these errors were encountered: