High Vulnerability in d3-color < v3.1.0 #1799

ben-coble-sp · 2022-09-29T18:52:08Z

Describe the bug
A clear and concise description of what the bug is.

d3-color has a high vulnerability prior to v3.1.0. Ngx-charts should upgrade d3-color to v3.1.0 to resolve the issue. GHSA-36jr-mh4h-2g58.

To Reproduce
Steps to reproduce the behavior:

Run npm audit . d3-color will get the high vulnerability.

Expected behavior
A clear and concise description of what you expected to happen.

Upgrading to v3.1.0 will remove the vulnerability when running npm audit.

Screenshots
If applicable, add screenshots to help explain your problem.

Demo
Provide an online demo (stackblitz, codesandbox, or similar) where the issue can be reproduced

ngx-charts version
Specify the version of ngx-charts where this bug is present

All versions below v20.1.0 or any new versions that have d3-color below v3.1.0.

Additional context
Add any other context about the problem here.

Github advisory GHSA-36jr-mh4h-2g58

The text was updated successfully, but these errors were encountered:

yazharasu · 2022-10-14T04:45:04Z

Any update on this?

batebobo · 2022-11-02T14:33:33Z

As far as I can see there is an open PR about this by dependabot - #1800. Any reasons not to merge?

moritz89 · 2022-11-08T09:48:43Z

Additionally packages such as

d3-interpolate
d3-scale
d3-transition
d3-brush

should also be updated as they also have dependencies on d3-color

anthonyattard · 2022-11-09T21:17:21Z

Getting this message as well. Hopefully this will be resolved soon as there is already #1800

Faulkner368 · 2022-11-23T13:59:33Z

I am also getting this as well and as mentioned above the dependencies also depend on the affected d3-color. The PR is approved already, hopefully will get merged soon ? #1800

marjan-georgiev · 2022-12-06T20:35:05Z

Fixed in 20.1.2

jlquijada · 2022-12-13T16:47:36Z

Maybe I'm missing something here about the solution applied:

In package.json I have this:

    "dependencies": {
        "@angular/cdk": "^15.0.2",
        "@angular/cli": "^15.0.3",
        "@angular/common": "^15.0.3",
        "@angular/compiler": "^15.0.3",
        "@angular/core": "^15.0.3",
        "@angular/forms": "^15.0.3",
...
        "@swimlane/ngx-charts": "^20.1.2",
...
    },
    "devDependencies": {
...
        "@types/d3": "^7.4.0",
...
    }

And I still get the 6 high severity vulnerabilities when running npm i -f.

When I run the audit fix, it reports them again, and does not fix anything. Obviously the proposed --force solution would install a very old version of ngx-charts, so it would be not desirable.

npm audit fix

up to date, audited 1288 packages in 6s

166 packages are looking for funding
run npm fund for details

npm audit report

d3-color <3.1.0
Severity: high
d3-color vulnerable to ReDoS - GHSA-36jr-mh4h-2g58
fix available via npm audit fix --force
Will install @swimlane/ngx-charts@6.1.0, which is a breaking change
node_modules/d3-color
d3-interpolate 0.1.3 - 2.0.1
Depends on vulnerable versions of d3-color
node_modules/d3-interpolate
@swimlane/ngx-charts >=7.0.0
Depends on vulnerable versions of d3-brush
Depends on vulnerable versions of d3-interpolate
Depends on vulnerable versions of d3-scale
Depends on vulnerable versions of d3-transition
node_modules/@swimlane/ngx-charts
d3-brush 0.1.0 - 2.1.0
Depends on vulnerable versions of d3-interpolate
Depends on vulnerable versions of d3-transition
node_modules/d3-brush
d3-scale 0.1.5 - 3.3.0
Depends on vulnerable versions of d3-interpolate
node_modules/d3-scale
d3-transition 0.0.7 - 2.0.0
Depends on vulnerable versions of d3-color
Depends on vulnerable versions of d3-interpolate
node_modules/d3-transition

6 high severity vulnerabilities

To address issues that do not require attention, run:
npm audit fix

To address all issues (including breaking changes), run:
npm audit fix --force

3MR1T00 · 2023-01-16T12:45:45Z

This is because they updated d3-color which is direct dependency of @swimlane/ngx-charts

"@swimlane/ngx-charts": {
      "version": "20.1.2",
      "resolved": "https://registry.npmjs.org/@swimlane/ngx-charts/-/ngx-charts-20.1.2.tgz",
      "integrity": "sha512-9uetDtBg++v96R9Nwgf8mvSu+6149FMQEm/jlpbcquUozfC5l+hO9i88tG3REOxnkGS10snGOCVUcPPY03nbxQ==",
      "requires": {
        "d3-array": "^2.9.1",
        "d3-brush": "^2.1.0",
        "d3-color": "^3.1.0", <<<<<<<<<<<<<<<<< 
        "d3-format": "^2.0.0",
        "d3-hierarchy": "^2.0.0",
        "d3-interpolate": "^2.0.1",
        "d3-scale": "^3.2.3",
        "d3-selection": "^2.0.0",
        "d3-shape": "^2.0.0",
        "d3-time-format": "^3.0.0",
        "d3-transition": "^2.0.0",
        "rfdc": "^1.3.0",
        "tslib": "^2.0.0"
      }
    }

But even in @swimlane/ngx-charts v20.1.2, d3-interpolate as well as d3-transition in their place are still depending on vulnerable d3-color version

"d3-transition": {
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/d3-transition/-/d3-transition-2.0.0.tgz",
      "integrity": "sha512-42ltAGgJesfQE3u9LuuBHNbGrI/AJjNL2OAUdclE70UE6Vy239GCBEYD38uBPoLeNsOhFStGpPI0BAOV+HMxog==",
      "requires": {
        "d3-color": "1 - 2",
        "d3-dispatch": "1 - 2",
        "d3-ease": "1 - 2",
        "d3-interpolate": "1 - 2",
        "d3-timer": "1 - 2"
      },
      "dependencies": {
        "d3-color": {
          "version": "2.0.0", <<<<<<<<<<<<<<<<<<<<<<<<<
          "resolved": "https://registry.npmjs.org/d3-color/-/d3-color-2.0.0.tgz",
          "integrity": "sha512-SPXi0TSKPD4g9tw0NMZFnR95XVgUZiBH+uUTqQuDu1OsE2zomHU7ho0FISciaPvosimixwHFl3WHLGabv6dDgQ=="
        }
      }
    }

"d3-interpolate": {
      "version": "2.0.1",
      "resolved": "https://registry.npmjs.org/d3-interpolate/-/d3-interpolate-2.0.1.tgz",
      "integrity": "sha512-c5UhwwTs/yybcmTpAVqwSFl6vrQ8JZJoT5F7xNFK9pymv5C0Ymcc9/LIJHtYIggg/yS9YHw8i8O8tgb9pupjeQ==",
      "requires": {
        "d3-color": "1 - 2"
      },
      "dependencies": {
        "d3-color": {
          "version": "2.0.0", <<<<<<<<<<<<<<<<<<<<<<<<
          "resolved": "https://registry.npmjs.org/d3-color/-/d3-color-2.0.0.tgz",
          "integrity": "sha512-SPXi0TSKPD4g9tw0NMZFnR95XVgUZiBH+uUTqQuDu1OsE2zomHU7ho0FISciaPvosimixwHFl3WHLGabv6dDgQ=="
        }
      }
    }

as @moritz89 stated, nested dependencies must be updated too

daiscog · 2023-02-06T13:35:35Z

Fixed in 20.1.2

@marjan-georgiev Can this be reopened? The issue is not fixed in 20.1.2. Installing 20.1.2 will still result in d3-color version 2.0.0 also being installed as it's a transitive dependency of other d3-* libs that @swimlane/ngx-charts depend on.

As described by @3MR1T00 above, the other d3 dependencies also need to be bumped to versions that depend on the fixed version of d3-color to completely fix the issue.

aitmouhou · 2023-02-10T15:40:08Z

The problem is still present in the version 20.1.2
deps.dev

kraighamady · 2023-02-14T20:29:56Z

It's Baaaaaack! Please update v20.1.2 as this is still an issue

samueldmeyer · 2023-02-15T18:31:01Z

The continuing problem has been reported as #1830

sushmeex · 2023-03-28T04:43:08Z

Facing similar issue in our project, we are the latest ngx charts and d3 versions

hubertstrk · 2023-03-28T20:41:02Z

same issue getting the same messages

diogogasparr · 2023-04-28T10:11:55Z

Still finding vulnerabilities issues (d3 dependency) in 20.1.2

dse-copsfs · 2023-05-15T14:59:35Z

Still finding vulnerabilities issues (d3 dependency) in 20.1.2

# npm audit report

d3-color  <3.1.0
Severity: high
d3-color vulnerable to ReDoS - https://github.com/advisories/GHSA-36jr-mh4h-2g58
fix available via `npm audit fix --force`
Will install @swimlane/ngx-charts@6.1.0, which is a breaking change
node_modules/d3-interpolate/node_modules/d3-color
  d3-interpolate  0.1.3 - 2.0.1
  Depends on vulnerable versions of d3-color
  node_modules/d3-interpolate
    d3-scale  0.1.5 - 3.3.0
    Depends on vulnerable versions of d3-interpolate
    node_modules/d3-scale
      @swimlane/ngx-charts  >=7.0.0
      Depends on vulnerable versions of d3-scale
      node_modules/@swimlane/ngx-charts

@marjan-georgiev, could you please reopen this task, so it can be visible and fixed?

queejie · 2023-05-30T14:13:50Z

Unfortunately, it is still an issue with 20.3.0, despite some tweaks to it:

# npm audit report

d3-color  <3.1.0
Severity: high
d3-color vulnerable to ReDoS - https://github.com/advisories/GHSA-36jr-mh4h-2g58
fix available via `npm audit fix --force`
Will install @swimlane/ngx-charts@12.1.0, which is a breaking change
node_modules/@swimlane/ngx-charts/node_modules/d3-interpolate/node_modules/d3-color
node_modules/d3-brush/node_modules/d3-color
node_modules/d3-transition/node_modules/d3-color
  d3-interpolate  0.1.3 - 2.0.1
  Depends on vulnerable versions of d3-color
  node_modules/@swimlane/ngx-charts/node_modules/d3-interpolate
  node_modules/d3-brush/node_modules/d3-interpolate
  node_modules/d3-transition/node_modules/d3-interpolate
    @swimlane/ngx-charts  >=7.0.0
    Depends on vulnerable versions of d3-brush
    Depends on vulnerable versions of d3-interpolate
    Depends on vulnerable versions of d3-scale
    Depends on vulnerable versions of d3-transition
    node_modules/@swimlane/ngx-charts
    d3-scale  0.1.5 - 3.3.0
    Depends on vulnerable versions of d3-interpolate
    node_modules/@swimlane/ngx-charts/node_modules/d3-scale
    d3-transition  0.0.7 - 2.0.0
    Depends on vulnerable versions of d3-color
    Depends on vulnerable versions of d3-interpolate
    node_modules/d3-transition
      d3-brush  0.1.0 - 2.1.0
      Depends on vulnerable versions of d3-interpolate
      Depends on vulnerable versions of d3-transition
      node_modules/d3-brush

6 high severity vulnerabilities

B0rrA · 2023-06-05T21:53:00Z

This problem persists on latest version 20.3.1

=== npm audit security report ===

┌──────────────────────────────────────────────────────────────────────────────┐
│ Manual Review │
│ Some vulnerabilities require your attention to resolve │
│ │
│ Visit https://go.npm.me/audit-guide for additional guidance │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High │ d3-color vulnerable to ReDoS │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ d3-color │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=3.1.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @swimlane/ngx-charts │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ @swimlane/ngx-charts > d3-interpolate > d3-color │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ GHSA-36jr-mh4h-2g58 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High │ d3-color vulnerable to ReDoS │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ d3-color │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=3.1.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @swimlane/ngx-charts │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ @swimlane/ngx-charts > d3-brush > d3-interpolate > d3-color │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ GHSA-36jr-mh4h-2g58 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High │ d3-color vulnerable to ReDoS │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ d3-color │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=3.1.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @swimlane/ngx-charts │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ @swimlane/ngx-charts > d3-brush > d3-transition > │
│ │ d3-interpolate > d3-color │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ GHSA-36jr-mh4h-2g58 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High │ d3-color vulnerable to ReDoS │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ d3-color │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=3.1.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @swimlane/ngx-charts │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ @swimlane/ngx-charts > d3-transition > d3-color │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ GHSA-36jr-mh4h-2g58 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High │ d3-color vulnerable to ReDoS │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ d3-color │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=3.1.0 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @swimlane/ngx-charts │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ @swimlane/ngx-charts > d3-brush > d3-transition > d3-color │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ GHSA-36jr-mh4h-2g58

ben-coble-sp added the Bug label Sep 29, 2022

This was referenced Nov 7, 2022

"d3-color": "^2.0.0" is causing high Dependency alert #1809

Closed

Update vulnerable d3-color package and other d3 packages #1805

Closed

PhilFlash mentioned this issue Nov 11, 2022

Update tsconfig and package for Angular 14, suppress cloneDeep #1813

Open

9 tasks

marjan-georgiev closed this as completed Dec 6, 2022

PhilFlash mentioned this issue Mar 28, 2023

Update tsconfig and package for Angular 14.x and 15.x, update d3 packages, suppress rfdc #1846

Open

9 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

High Vulnerability in d3-color < v3.1.0 #1799

High Vulnerability in d3-color < v3.1.0 #1799

ben-coble-sp commented Sep 29, 2022 •

edited

Loading

yazharasu commented Oct 14, 2022

batebobo commented Nov 2, 2022

moritz89 commented Nov 8, 2022

anthonyattard commented Nov 9, 2022

Faulkner368 commented Nov 23, 2022 •

edited

Loading

marjan-georgiev commented Dec 6, 2022 •

edited

Loading

jlquijada commented Dec 13, 2022 •

edited

Loading

3MR1T00 commented Jan 16, 2023 •

edited

Loading

daiscog commented Feb 6, 2023

aitmouhou commented Feb 10, 2023

kraighamady commented Feb 14, 2023

samueldmeyer commented Feb 15, 2023

sushmeex commented Mar 28, 2023

hubertstrk commented Mar 28, 2023

diogogasparr commented Apr 28, 2023

dse-copsfs commented May 15, 2023

queejie commented May 30, 2023

B0rrA commented Jun 5, 2023

High Vulnerability in d3-color < v3.1.0 #1799

High Vulnerability in d3-color < v3.1.0 #1799

Comments

ben-coble-sp commented Sep 29, 2022 • edited Loading

yazharasu commented Oct 14, 2022

batebobo commented Nov 2, 2022

moritz89 commented Nov 8, 2022

anthonyattard commented Nov 9, 2022

Faulkner368 commented Nov 23, 2022 • edited Loading

marjan-georgiev commented Dec 6, 2022 • edited Loading

jlquijada commented Dec 13, 2022 • edited Loading

npm audit report

3MR1T00 commented Jan 16, 2023 • edited Loading

daiscog commented Feb 6, 2023

aitmouhou commented Feb 10, 2023

kraighamady commented Feb 14, 2023

samueldmeyer commented Feb 15, 2023

sushmeex commented Mar 28, 2023

hubertstrk commented Mar 28, 2023

diogogasparr commented Apr 28, 2023

dse-copsfs commented May 15, 2023

queejie commented May 30, 2023

B0rrA commented Jun 5, 2023

ben-coble-sp commented Sep 29, 2022 •

edited

Loading

Faulkner368 commented Nov 23, 2022 •

edited

Loading

marjan-georgiev commented Dec 6, 2022 •

edited

Loading

jlquijada commented Dec 13, 2022 •

edited

Loading

3MR1T00 commented Jan 16, 2023 •

edited

Loading