This repository has been archived by the owner on Jan 8, 2021. It is now read-only.
WS-2019-0425 (Medium) detected in mocha-3.5.3.tgz #171
Labels
security vulnerability
Security vulnerability detected by WhiteSource
WS-2019-0425 - Medium Severity Vulnerability
Vulnerable Library - mocha-3.5.3.tgz
simple, flexible, fun test framework
Library home page: https://registry.npmjs.org/mocha/-/mocha-3.5.3.tgz
Path to dependency file: recursos.osweekends.com/client/package.json
Path to vulnerable library: recursos.osweekends.com/client/node_modules/mocha/package.json
Dependency Hierarchy:
Found in HEAD commit: 62d2fd7fb5555001243fa0fa126216413fb99e9f
Vulnerability Details
Mocha is vulnerable to ReDoS attack. If the stack trace in utils.js begins with a large error message, and full-trace is not enabled, utils.stackTraceFilter() will take exponential run time.
Publish Date: 2019-01-24
URL: WS-2019-0425
CVSS 3 Score Details (5.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: v6.0.0
Release Date: 2020-05-07
Fix Resolution: https://github.com/mochajs/mocha/commit/1a43d8b11a64e4e85fe2a61aed91c259bbbac559
Step up your Open Source Security Game with WhiteSource here
The text was updated successfully, but these errors were encountered: