prettier-stylelint-0.4.2.tgz: 3 vulnerabilities (highest severity is: 7.5) - autoclosed

[mend-bolt-for-github]

Vulnerable Library - prettier-stylelint-0.4.2.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/postcss-less/node_modules/postcss/package.json

Found in HEAD commit: e9648849ed358c4779432c1b9067aab0eb19c4fb

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2020-28469	High	7.5	glob-parent-2.0.0.tgz	Transitive	N/A	❌
CVE-2021-33623	High	7.5	trim-newlines-1.0.0.tgz	Transitive	N/A	❌
CVE-2021-23382	Medium	5.3	multiple	Transitive	N/A	❌

Details

CVE-2020-28469

Vulnerable Library - glob-parent-2.0.0.tgz

Strips glob magic from a string to provide the parent path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-2.0.0.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/glob-parent/package.json

Dependency Hierarchy:

• prettier-stylelint-0.4.2.tgz (Root Library)
  • stylelint-8.4.0.tgz
    • micromatch-2.3.11.tgz
      • parse-glob-3.0.4.tgz
        • glob-base-0.3.0.tgz
          • ❌ glob-parent-2.0.0.tgz (Vulnerable Library)

Found in HEAD commit: e9648849ed358c4779432c1b9067aab0eb19c4fb

Found in base branch: master

Vulnerability Details

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Publish Date: 2021-06-03

URL: CVE-2020-28469

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469

Release Date: 2021-06-03

Fix Resolution: glob-parent - 5.1.2

Step up your Open Source Security Game with WhiteSource here

CVE-2021-33623

Vulnerable Library - trim-newlines-1.0.0.tgz

Trim newlines from the start and/or end of a string

Library home page: https://registry.npmjs.org/trim-newlines/-/trim-newlines-1.0.0.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/trim-newlines/package.json

Dependency Hierarchy:

• prettier-stylelint-0.4.2.tgz (Root Library)
  • meow-3.7.0.tgz
    • ❌ trim-newlines-1.0.0.tgz (Vulnerable Library)

Found in HEAD commit: e9648849ed358c4779432c1b9067aab0eb19c4fb

Found in base branch: master

Vulnerability Details

The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.

Publish Date: 2021-05-28

URL: CVE-2021-33623

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33623

Release Date: 2021-05-28

Fix Resolution: trim-newlines - 3.0.1, 4.0.1

Step up your Open Source Security Game with WhiteSource here

CVE-2021-23382

Vulnerable Libraries - postcss-6.0.23.tgz, postcss-5.2.18.tgz

postcss-6.0.23.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-6.0.23.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/postcss/package.json

Dependency Hierarchy:

• prettier-stylelint-0.4.2.tgz (Root Library)
  • stylelint-8.4.0.tgz
    • ❌ postcss-6.0.23.tgz (Vulnerable Library)

postcss-5.2.18.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-5.2.18.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/postcss-less/node_modules/postcss/package.json

Dependency Hierarchy:

• prettier-stylelint-0.4.2.tgz (Root Library)
  • stylelint-8.4.0.tgz
    • postcss-less-1.1.5.tgz
      • ❌ postcss-5.2.18.tgz (Vulnerable Library)

Found in HEAD commit: e9648849ed358c4779432c1b9067aab0eb19c4fb

Found in base branch: master

Vulnerability Details

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*\s* sourceMappingURL=(.*).

Publish Date: 2021-04-26

URL: CVE-2021-23382

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23382

Release Date: 2021-04-26

Fix Resolution: postcss - 8.2.13

Step up your Open Source Security Game with WhiteSource here

[mend-bolt-for-github]

✔️ This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.