scriptex/rollup-mpa

CVE-2018-1109 (High) detected in braces-1.8.5.tgz

Closed this issue · 0 comments

mend-bolt-for-github commented

CVE-2018-1109 - High Severity Vulnerability

Vulnerable Library - braces-1.8.5.tgz

Fastest brace expansion for node.js, with the most complete support for the Bash 4.3 braces specification.

Library home page: https://registry.npmjs.org/braces/-/braces-1.8.5.tgz

Path to dependency file: rollup-mpa/package.json

Path to vulnerable library: rollup-mpa/node_modules/rollup-watch/node_modules/braces/package.json

Dependency Hierarchy:

  • rollup-watch-4.3.1.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • anymatch-1.3.2.tgz
        • micromatch-2.3.11.tgz
          • ❌ braces-1.8.5.tgz (Vulnerable Library)

Found in HEAD commit: 647a1cbcd994a4f2ce0c00711287a68ad6286f39

Found in base branch: master

Vulnerability Details

Braces before 1.4.2 and 2.17.2 is vulnerable to ReDoS. It used a regular expression (^{(,+(?:({,+})),|,(?:({,+})),+)}) in order to detects empty braces. This can cause an impact of about 10 seconds matching time for data 50K characters long.

Publish Date: 2020-07-21

URL: CVE-2018-1109

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1547272

Release Date: 2020-07-21

Fix Resolution: 2.3.1

Step up your Open Source Security Game with WhiteSource here