CVE-2021-23362 (Medium) detected in hosted-git-info-2.8.8.tgz #84
whitesource-bolt-for-github[bot] posted onGitHub
CVE-2021-23362 - Medium Severity Vulnerability
<details><summary><img src='https://whitesource-resources.whitesourcesoftware.com/vulnerability_details.png' width=19 height=20> Vulnerable Library - <b>hosted-git-info-2.8.8.tgz</b></p></summary>
<p>Provides metadata and conversions from repository urls for Github, Bitbucket and Gitlab</p> <p>Library home page: <a href="https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.8.8.tgz">https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.8.8.tgz</a></p> <p>Path to dependency file: weather-app/package.json</p> <p>Path to vulnerable library: weather-app/node_modules/hosted-git-info/package.json</p> <p>
Dependency Hierarchy:
- react-scripts-4.0.3.tgz (Root Library)
- eslint-plugin-import-2.22.1.tgz
- read-pkg-up-2.0.0.tgz
- read-pkg-2.0.0.tgz
- normalize-package-data-2.5.0.tgz
- :x: hosted-git-info-2.8.8.tgz (Vulnerable Library)
<p>Found in HEAD commit: <a href="https://github.com/scriptex/weather-app/commit/4e26424aa2dc003ae54c618f04f47c73dbc07ec9">4e26424aa2dc003ae54c618f04f47c73dbc07ec9</a></p> <p>Found in base branch: <b>master</b></p> </p> </details> <p></p> <details><summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png' width=19 height=20> Vulnerability Details</summary> <p>
- :x: hosted-git-info-2.8.8.tgz (Vulnerable Library)
- normalize-package-data-2.5.0.tgz
- read-pkg-2.0.0.tgz
- read-pkg-up-2.0.0.tgz
- eslint-plugin-import-2.22.1.tgz
The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via shortcutMatch in fromUrl().
<p>Publish Date: 2021-03-23 <p>URL: <a href=https://vuln.whitesourcesoftware.com/vulnerability/CVE-2021-23362>CVE-2021-23362</a></p> </p> </details> <p></p> <details><summary><img src='https://whitesource-resources.whitesourcesoftware.com/cvss3.png' width=19 height=20> CVSS 3 Score Details (<b>5.3</b>)</summary> <p>
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
</p> For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>. </p> </details> <p></p> <details><summary><img src='https://whitesource-resources.whitesourcesoftware.com/suggested_fix.png' width=19 height=20> Suggested Fix</summary> <p>
<p>Type: Upgrade version</p> <p>Origin: <a href="https://github.com/npm/hosted-git-info/releases/tag/v3.0.8">https://github.com/npm/hosted-git-info/releases/tag/v3.0.8</a></p> <p>Release Date: 2021-03-23</p> <p>Fix Resolution: hosted-git-info - 3.0.8</p>
</p> </details> <p></p>
Step up your Open Source Security Game with WhiteSource here