Bulk vulnerability fix - Lockfile fix #23
Closed
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Bulk vulnerability fix - Lockfile fix
This pull request will update your transitive dependencies within the allowed version intervals provided by your direct dependencies.
Fixed vulnerabilities:
CVE–2021–23368
Description
NVD
GitHub
CVSS details - 5.3
References
Fix unsafe regexp · postcss/postcss@8682b1e · GitHub
Fix unsafe regexp in getAnnotationURL() too · postcss/postcss@b6f3e4d · GitHub
Pony Mail!
Pony Mail!
Pony Mail!
Pony Mail!
Pony Mail!
Pony Mail!
NVD - CVE-2021-23368
Regular Expression Denial of Service in postcss · CVE-2021-23368 · GitHub Advisory Database · GitHub
CVE–2021–23343
Description
NVD
CVSS details - 7.5
References
ReDoS in path-parse · Issue #8 · jbgutierrez/path-parse · GitHub
Pony Mail!
fixed regexes to avoid ReDoS attacks by jeffrey-pinyan-ithreat · Pull Request #10 · jbgutierrez/path-parse · GitHub
CVE–2021–33502
Description
GitHub
NVD
CVSS details - 7.5
References
Release v6.0.1 · sindresorhus/normalize-url · GitHub
NVD - CVE-2021-33502
ReDoS in normalize-url · CVE-2021-33502 · GitHub Advisory Database · GitHub
CVE–2021–31597
Description
Improper Certificate Validation
GitHub
NVD
CVSS details - 9.4
References
MISC
Fix issue where rejectUnauthorized would default to false instead of … · mjwwit/node-XMLHttpRequest@bf53329 · GitHub
Comparing v1.6.0...1.6.1 · mjwwit/node-XMLHttpRequest · GitHub
CVE-2021-31597 Node.js Vulnerability in NetApp Products | NetApp Product Security
Improper Certificate Validation in xmlhttprequest-ssl · CVE-2021-31597 · GitHub Advisory Database · GitHub
NVD - CVE-2021-31597
Related information
📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more at Debricked