WS-2018-0590 (High) detected in diff-3.2.0.tgz - autoclosed
mend-bolt-for-github opened this issue · 1 comments
WS-2018-0590 - High Severity Vulnerability
Vulnerable Library - diff-3.2.0.tgz
A javascript text diff implementation.
Library home page: https://registry.npmjs.org/diff/-/diff-3.2.0.tgz
Path to dependency file: binder-test/jupyter_desktop/share/web/noVNC-1.1.0/package.json
Path to vulnerable library: binder-test/jupyter_desktop/share/web/noVNC-1.1.0/node_modules/diff/package.json
Dependency Hierarchy:
- mocha-3.5.3.tgz (Root Library)
- ❌ diff-3.2.0.tgz (Vulnerable Library)
Found in HEAD commit: bd5bc719d8e07b9b820e60f7a74922afdf2d98be
Found in base branch: main
Vulnerability Details
A vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.
Publish Date: 2018-03-05
URL: WS-2018-0590
CVSS 2 Score Details (7.0)
Base Score Metrics not available
Suggested Fix
Type: Upgrade version
Origin: kpdecker/jsdiff@2aec429
Release Date: 2019-06-11
Fix Resolution: 3.5.0
Step up your Open Source Security Game with WhiteSource here
✔️ This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.