flamencist / flamencist/CopyCssSelector

WS-2018-0650 (High) detected in useragent-2.3.0.tgz

Open
#35 0 comments 0 reactions 0 assignees View on GitHub
Mend: dependency security vulnerability
Dominant language
JavaScript
Stars
28
Forks
3
PR merge metrics
No merged PRs in 30d

Description

## WS-2018-0650 - High Severity Vulnerability
Vulnerable Library - useragent-2.3.0.tgz

Fastest, most accurate & effecient user agent string parser, uses Browserscope's research for parsing


Library home page: https://registry.npmjs.org/useragent/-/useragent-2.3.0.tgz


Path to dependency file: /package.json


Path to vulnerable library: /node_modules/useragent/package.json


Dependency Hierarchy:
- karma-4.4.1.tgz (Root Library)
- :x: **useragent-2.3.0.tgz** (Vulnerable Library)


Vulnerability Details



Regular Expression Denial of Service (ReDoS) vulnerability was found in useragent through 2.3.0.

Publish Date: 2018-02-27

URL: WS-2018-0650



CVSS 3 Score Details (7.5)

Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High


For more information on CVSS3 Scores, click here.


Suggested Fix

Type: Upgrade version


Origin: https://nvd.nist.gov/vuln/detail/WS-2018-0650


Release Date: 2018-02-27


Fix Resolution: NorDroN.AngularTemplate - 0.1.6;dotnetng.template - 1.0.0.4;JetBrains.Rider.Frontend5 - 213.0.20211008.154703-eap03;MIDIator.WebClient - 1.0.105

***
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.