Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WS-2019-0425 (Medium) detected in mocha-2.2.5.js #132

Open
mend-bolt-for-github bot opened this issue Sep 15, 2022 · 0 comments
Open

WS-2019-0425 (Medium) detected in mocha-2.2.5.js #132

mend-bolt-for-github bot opened this issue Sep 15, 2022 · 0 comments
Labels
security vulnerability Security vulnerability detected by WhiteSource

Comments

@mend-bolt-for-github
Copy link

WS-2019-0425 - Medium Severity Vulnerability

Vulnerable Library - mocha-2.2.5.js

simple, flexible, fun test framework

Library home page: https://cdnjs.cloudflare.com/ajax/libs/mocha/2.2.5/mocha.js

Path to dependency file: /node_modules/js-base64/.attic/test-moment/index.html

Path to vulnerable library: /node_modules/js-base64/.attic/test-moment/index.html

Dependency Hierarchy:

  • mocha-2.2.5.js (Vulnerable Library)

Found in HEAD commit: 9291825bff1e01bb64535f99d7badac198ddbca0

Found in base branch: dev

Vulnerability Details

Mocha is vulnerable to ReDoS attack. If the stack trace in utils.js begins with a large error message, and full-trace is not enabled, utils.stackTraceFilter() will take exponential run time.

Publish Date: 2019-01-24

URL: WS-2019-0425

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-01-24

Fix Resolution: v6.0.0


Step up your Open Source Security Game with Mend here

@mend-bolt-for-github mend-bolt-for-github bot added the security vulnerability Security vulnerability detected by WhiteSource label Sep 15, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
security vulnerability Security vulnerability detected by WhiteSource
Projects
None yet
Development

No branches or pull requests

0 participants