WS-2018-0083 Medium Severity Vulnerability detected by WhiteSource

[mend-bolt-for-github]

WS-2018-0083 - Medium Severity Vulnerability

Vulnerable Library - protobufjs-5.0.2.tgz

Protocol Buffers for JavaScript. Finally.

path: /tmp/git/listo-firebase/firebase/functions/node_modules/grpc/node_modules/protobufjs/package.json

Library home page: https://registry.npmjs.org/protobufjs/-/protobufjs-5.0.2.tgz

Dependency Hierarchy:

• datastore-1.3.4.tgz (Root Library)
  • google-gax-0.14.5.tgz
    • grpc-1.7.3.tgz
      • ❌ protobufjs-5.0.2.tgz (Vulnerable Library)

Vulnerability Details

Versions of protobufjs before 6.8.6 are vulnerable to denial of service when parsing crafted invalid *.proto files.

Publish Date: 2018-04-25

URL: WS-2018-0083

CVSS 2 Score Details (5.0)

Base Score Metrics not available

---

Step up your Open Source Security Game with WhiteSource here