Vulnerable Library - eslint-plugin-4.8.2.tgz

Path to dependency file: /tmp/ws-scm/racing-bars-history/package.json

Path to vulnerable library: /tmp/ws-scm/racing-bars-history/src/angular/node_modules/debug/package.json,/tmp/ws-scm/racing-bars-history/src/angular/node_modules/debug/package.json

## Vulnerabilities | CVE | Severity |

CVSS | Dependency | Type | Fixed in (eslint-plugin version) | Remediation Possible** | | ------------- | ------------- | ----- | ----- | ----- | ------------- | --- | | [CVE-2017-16137](https://www.mend.io/vulnerability-database/CVE-2017-16137) |

Low | 3.7 | debug-4.1.1.tgz | Transitive | 4.9.0 | ❌ |

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

## Details

CVE-2017-16137

### Vulnerable Library - debug-4.1.1.tgz

small debugging utility

Library home page: https://registry.npmjs.org/debug/-/debug-4.1.1.tgz

Path to dependency file: /tmp/ws-scm/racing-bars-history/src/angular/package.json

Path to vulnerable library: /tmp/ws-scm/racing-bars-history/src/angular/node_modules/debug/package.json,/tmp/ws-scm/racing-bars-history/src/angular/node_modules/debug/package.json

Dependency Hierarchy: - eslint-plugin-4.8.2.tgz (Root Library) - :x: **debug-4.1.1.tgz** (Vulnerable Library)

Found in base branch: develop

### Vulnerability Details

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Publish Date: 2018-06-07

URL: CVE-2017-16137

### CVSS 3 Score Details (3.7)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-gxpj-cx7g-858c

Release Date: 2018-04-26

Fix Resolution (debug): 4.3.1

Direct dependency fix Resolution (@typescript-eslint/eslint-plugin): 4.9.0

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)

eslint-plugin-4.8.2.tgz: 1 vulnerabilities (highest severity is: 3.7) #154

Company

Community

Support

Connect