WS-2022-0322 (High) detected in d3-color-1.0.3.tgz, d3-color-1.2.8.tgz - autoclosed
Closed this issue · 1 comments
WS-2022-0322 - High Severity Vulnerability
Vulnerable Libraries - d3-color-1.0.3.tgz, d3-color-1.2.8.tgz
d3-color-1.0.3.tgz
Color spaces! RGB, HSL, Cubehelix, Lab and HCL (Lch).
Library home page: https://registry.npmjs.org/d3-color/-/d3-color-1.0.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/d3/node_modules/d3-color/package.json
Dependency Hierarchy:
- ngx-charts-11.2.0.tgz (Root Library)
- d3-4.13.0.tgz
- ❌ d3-color-1.0.3.tgz (Vulnerable Library)
- d3-4.13.0.tgz
d3-color-1.2.8.tgz
Color spaces! RGB, HSL, Cubehelix, Lab and HCL (Lch).
Library home page: https://registry.npmjs.org/d3-color/-/d3-color-1.2.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/d3-color/package.json
Dependency Hierarchy:
- ngx-charts-11.2.0.tgz (Root Library)
- ❌ d3-color-1.2.8.tgz (Vulnerable Library)
Found in HEAD commit: 5ab87822afd91cf2c356b709e4d7762392cfc200
Found in base branch: master
Vulnerability Details
The d3-color module provides representations for various color spaces in the browser. Versions prior to 3.1.0 are vulnerable to a Regular expression Denial of Service. This issue has been patched in version 3.1.0. There are no known workarounds.
Publish Date: 2022-09-29
URL: WS-2022-0322
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: GHSA-36jr-mh4h-2g58
Release Date: 2022-09-29
Fix Resolution: d3-color - 3.1.0
Step up your Open Source Security Game with Mend here
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.