[GHSA-v6h2-p8h4-qcjw] brace-expansion Regular Expression Denial of Service vulnerability #5711
Conversation
| "severity": [ | ||
| { | ||
| "type": "CVSS_V3", | ||
| "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L" | ||
| }, | ||
| { | ||
| "type": "CVSS_V4", | ||
| "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" | ||
| "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" | ||
| } | ||
| ], |
There was a problem hiding this comment.
I have no idea about this part of the change. Your form said that was there was an error, so I changed a setting in the "calculator" below it and then changed it back. 🤷
github-actions
bot
changed the base branch from
main
to
anomiex/advisory-improvement-5711
| @@ -29,10 +25,48 @@ | |||
| "type": "ECOSYSTEM", | |||
| "events": [ | |||
| { | |||
| "introduced": "2.0.1" | |||
| "introduced": "2.0.0" | |||
There was a problem hiding this comment.
Apparently I accidentally changed this too
| "introduced": "2.0.0" | |
| "introduced": "2.0.1" |
|
duplicate of #5716 |
|
Thank you for your contribution to the Advisory Database @anomiex! As @turi4200 mentioned above, this is actually a duplicate of a few other PRs that have already contributed this information to us (#5701, #5710, #5716). We've made the relevant changes to GHSA-v6h2-p8h4-qcjw, and you should be able to see the updates live. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future! |
Updates
Comments
Appears to have been patched in 2.0.2, 3.0.1, and 4.0.1