CVE-2017-16137 (Low) detected in debug-4.1.1.tgz
Opened this issue · 0 comments
CVE-2017-16137 - Low Severity Vulnerability
Vulnerable Library - debug-4.1.1.tgz
small debugging utility
Library home page: https://registry.npmjs.org/debug/-/debug-4.1.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/@babel/traverse/node_modules/debug/package.json
Dependency Hierarchy:
- core-7.18.2.tgz (Root Library)
- traverse-7.18.9.tgz
- ❌ debug-4.1.1.tgz (Vulnerable Library)
- traverse-7.18.9.tgz
Found in HEAD commit: 6db9a06a470496fc2b9035d3ba2ddb056637f84e
Found in base branch: main
Vulnerability Details
The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.
Publish Date: 2018-06-07
URL: CVE-2017-16137
CVSS 3 Score Details (3.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: GHSA-gxpj-cx7g-858c
Release Date: 2018-04-26
Fix Resolution (debug): 4.3.1
Direct dependency fix Resolution (@babel/core): 7.18.5
Step up your Open Source Security Game with Mend here