mikaela
mikaela copied to clipboard
opus-0.3.2.tgz: 2 vulnerabilities (highest severity is: 7.5)
Vulnerable Library - opus-0.3.2.tgz
Opus bindings for Node
Library home page: https://registry.npmjs.org/@discordjs/opus/-/opus-0.3.2.tgz
Path to dependency file: /tmp/ws-scm/MikaelaBot/package.json
Path to vulnerable library: /MikaelaBot/node_modules/@discordjs/opus/package.json
Vulnerabilities
CVE | Severity | ![]() |
Dependency | Type | Fixed in (opus version) | Remediation Available |
---|---|---|---|---|---|---|
CVE-2022-25345 | ![]() |
7.5 | opus-0.3.2.tgz | Direct | N/A | ❌ |
CVE-2022-3517 | ![]() |
7.5 | minimatch-3.0.4.tgz | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.
Details
CVE-2022-25345
Vulnerable Library - opus-0.3.2.tgz
Opus bindings for Node
Library home page: https://registry.npmjs.org/@discordjs/opus/-/opus-0.3.2.tgz
Path to dependency file: /tmp/ws-scm/MikaelaBot/package.json
Path to vulnerable library: /MikaelaBot/node_modules/@discordjs/opus/package.json
Dependency Hierarchy:
- :x: opus-0.3.2.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
All versions of package @discordjs/opus are vulnerable to Denial of Service (DoS) when trying to encode using an encoder with zero channels, or a non-initialized buffer. This leads to a hard crash.
Publish Date: 2022-06-17
URL: CVE-2022-25345
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Step up your Open Source Security Game with Mend here
CVE-2022-3517
Vulnerable Library - minimatch-3.0.4.tgz
a glob matcher in javascript
Library home page: https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz
Path to dependency file: /tmp/ws-scm/MikaelaBot/package.json
Path to vulnerable library: /tmp/ws-scm/MikaelaBot/node_modules/minimatch/package.json
Dependency Hierarchy:
- opus-0.3.2.tgz (Root Library)
- node-pre-gyp-0.1.0.tgz
- npm-packlist-1.4.8.tgz
- ignore-walk-3.0.3.tgz
- :x: minimatch-3.0.4.tgz (Vulnerable Library)
- ignore-walk-3.0.3.tgz
- npm-packlist-1.4.8.tgz
- node-pre-gyp-0.1.0.tgz
Found in base branch: main
Vulnerability Details
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.
Publish Date: 2022-10-17
URL: CVE-2022-3517
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2022-10-17
Fix Resolution: minimatch - 3.0.5
Step up your Open Source Security Game with Mend here