pkg icon indicating copy to clipboard operation
pkg copied to clipboard

"CVE-2021-3807" detected in dependent package

Open akshaykumar-vijapur opened this issue 3 years ago • 0 comments

It seems like there is vulnerability in pkg.

Body:  [
    {
        "name": "ansi-regex",
        "version": "2.1.1",
        "vulnerabilities": [
            {
                "title": "Regular Expression Denial of Service (ReDoS)",
                "risk_level": 0,
                "severity": "high",
                "remediation": "3.0.1",
                "cvss": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
                "reported_at": "2021-09-12T12:52:37Z",
                "stdcode": [
                    "CVE-2021-3807"
                ],
                "description": "Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns` [[\\\\]()#;?]*` and `(?:;[-a-zA-Z\\\\d\\\\/#\u0026.:=?%@~_]*)*`.\r\n\r\n\r\n### PoC\r\n```js\r\nimport ansiRegex from 'ansi-regex';\r\n\r\nfor(var i = 1; i \u003c= 50000; i++) {\r\n    var time = [Date.now](http://date.now/)();\r\n    var attack_str = \"\\u001B[\"+\";\".repeat(i*10000);\r\n    ansiRegex().test(attack_str)\r\n    var time_cost = [Date.now](http://date.now/)() - time;\r\n    console.log(\"attack_str.length: \" + attack_str.length + \": \" + time_cost+\" ms\")\r\n}\r\n```",
                "updated_at": "2022-07-07T14:12:59.277135Z",
                "references": null,
                "url": "https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908",
                "id": "SNYK-JS-ANSIREGEX-1583908"
            }
        ],
        "vulnerable": true,
        "ecosystem": "js"

We see that it has been fixed in dependent packages of [email protected]. Can you please take and update the package.

akshaykumar-vijapur avatar Aug 30 '22 08:08 akshaykumar-vijapur