High severity security alert: diff dependency

Question

High severity security alert: diff dependency

drewwmercer opened this issue 5 years ago · comments

Drew W Mercer commented 5 years ago

Remediation: Upgrade diff to version 3.5.0 or later.

Current version: 4.0.1

Drew W Mercer · Answer 1 · Wed Oct 02 2019 00:37:27 GMT+0800 (China Standard Time)

WS-2018-0590: high severity
Vulnerable versions: < 3.5.0
Patched version: 3.5.0

A vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.

Drew W Mercer · Answer 2 · Wed Oct 02 2019 00:38:08 GMT+0800 (China Standard Time)

package-lock.json currently references vulnerable package v3.3.1

neoan · Answer 3 · Wed Oct 02 2019 00:51:05 GMT+0800 (China Standard Time)

I am on it

neoan · Answer 4 · Wed Oct 02 2019 01:36:14 GMT+0800 (China Standard Time)

Update: The culprit seems to be mocha which requires "diff". There is currently a PR waiting to address that issue and I will check tomorrow whether or not we can update to a patched version of mocha.