ilkeraltin / notetaker-app Goto Github PK

Vulnerable Library - axios-0.18.0.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.18.0.tgz

Path to dependency file: /notetaker-app/package.json

Path to vulnerable library: /notetaker-app/node_modules/axios/package.json

Dependency Hierarchy:

• ❌ axios-0.18.0.tgz (Vulnerable Library)

Found in HEAD commit: ff80d97340ef46484f0799621c6c8d2a35792463

Vulnerability Details

Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded.

Publish Date: 2019-05-07

URL: CVE-2019-10742

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Vulnerable Library - braces-1.8.5.tgz

Fastest brace expansion for node.js, with the most complete support for the Bash 4.3 braces specification.

Library home page: https://registry.npmjs.org/braces/-/braces-1.8.5.tgz

Path to dependency file: /notetaker-app/package.json

Path to vulnerable library: /tmp/git/notetaker-app/node_modules/braces/package.json

Dependency Hierarchy:

• webpack-1.15.0.tgz (Root Library)
  • watchpack-0.2.9.tgz
    • chokidar-1.7.0.tgz
      • anymatch-1.3.2.tgz
        • micromatch-2.3.11.tgz
          • ❌ braces-1.8.5.tgz (Vulnerable Library)

Found in HEAD commit: ff80d97340ef46484f0799621c6c8d2a35792463

Vulnerability Details

Version of braces prior to 2.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.

Publish Date: 2019-03-25

URL: WS-2019-0019

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/786

Release Date: 2019-02-21

Fix Resolution: 2.3.1