You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
There is regular Expression Denial of Service (ReDoS) vulnerability in mocha.
It allows cause a denial of service when stripping crafted invalid function definition from strs.
The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.
dimagwhitesourceappbot
changed the title
mocha-8.3.2.tgz: 3 vulnerabilities (highest severity is: 7.5)
mocha-8.3.2.tgz: 2 vulnerabilities (highest severity is: 7.5)
Dec 4, 2023
Vulnerable Library - mocha-8.3.2.tgz
simple, flexible, fun test framework
Library home page: https://registry.npmjs.org/mocha/-/mocha-8.3.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Found in HEAD commit: b048946ae42446c0ab583ee08f8d27d6b90499e5
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
WS-2021-0638
Vulnerable Library - mocha-8.3.2.tgz
simple, flexible, fun test framework
Library home page: https://registry.npmjs.org/mocha/-/mocha-8.3.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: b048946ae42446c0ab583ee08f8d27d6b90499e5
Found in base branch: master
Vulnerability Details
There is regular Expression Denial of Service (ReDoS) vulnerability in mocha.
It allows cause a denial of service when stripping crafted invalid function definition from strs.
Publish Date: 2021-09-18
URL: WS-2021-0638
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: mochajs/mocha@61b4b92
Release Date: 2021-09-18
Fix Resolution: 10.1.0
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2021-23566
Vulnerable Library - nanoid-3.1.20.tgz
A tiny (108 bytes), secure URL-friendly unique string ID generator
Library home page: https://registry.npmjs.org/nanoid/-/nanoid-3.1.20.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: b048946ae42446c0ab583ee08f8d27d6b90499e5
Found in base branch: master
Vulnerability Details
The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.
Publish Date: 2022-01-14
URL: CVE-2021-23566
CVSS 3 Score Details (5.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: ai/nanoid#328
Release Date: 2022-01-14
Fix Resolution (nanoid): 3.1.31
Direct dependency fix Resolution (mocha): 9.2.0
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.
The text was updated successfully, but these errors were encountered: