CVE-2017-18214 - Update or replace file-stream-rotator dependency
ddsharpe opened this issue · 2 comments
Update or replace file-stream-rotator dependency to a version that excludes the vulnerable code. CVE-2017-18214, The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055. The file-stream-rotator declares its dependency as "moment": "^2.11.2" making it possible for the vulnerable version to become part of the distribution.
The file-stream-rotator project appears to be abandoned.
+1
There is a race condition in file-stream-rotator when creating log directories rogerc/file-stream-rotator#81, which throws an EEXISTS error. I don't think this pr will be merged because file-stream-rotator is not updated recent two years...