Fix CVE–2021–3807

[debricked-staging]

CVE–2021–3807

Vulnerable dependency:     ansi-regex (npm)    3.0.0    4.1.0

Vulnerability details

Description

Incorrect Comparison

The software compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.

NVD

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

GitHub

Inefficient Regular Expression Complexity in chalk/ansi-regex

ansi-regex is vulnerable to Inefficient Regular Expression Complexity which could lead to a denial of service.

CVSS details - 7.5

 

CVSS3 metrics
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity	None
Availability	High

References

    Inefficient Regular Expression Complexity in chalk/ansi-regex · CVE-2021-3807 · GitHub Advisory Database · GitHub
    NVD - CVE-2021-3807
    Fix potential ReDoS (#37) · chalk/ansi-regex@8d1d7cd · GitHub
    Inefficient Regular Expression Complexity vulnerability found in ansi-regex
    Regular Expression Denial of Service (ReDoS) in ansi-regex | CVE-2021-3807 | Snyk
    Backport of security patch, for benefit of yargs · Issue #38 · chalk/ansi-regex · GitHub
    Backport of security patch, for benefit of yargs · Issue #38 · chalk/ansi-regex · GitHub
    ansi-regex/index.js at c1b5e45f7c65a332ffb03ac8e5804ad37c579cdc · chalk/ansi-regex · GitHub
    GitHub - chalk/ansi-regex: Regular expression for matching ANSI escape codes
    Comparing chalk:HEAD...yetingli:main · chalk/ansi-regex · GitHub
    Release v6.0.1 · chalk/ansi-regex · GitHub
    Oracle Critical Patch Update Advisory - April 2022

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE