You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Path to vulnerable library: /Signaling/node_modules/micromatch/package.json,/Archiving/node_modules/micromatch/package.json,/Multiparty/node_modules/micromatch/package.json,/ScreenSharing/node_modules/micromatch/package.json
The NPM package micromatch prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in micromatch.braces() in index.js because the pattern .* will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.
Mend Note: After conducting a further research, it was concluded that CVE-2024-4067 should not reflect the security risk score in NVD, but will be kept for users' awareness.
serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.
Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.
mend-for-github-combot
changed the title
react-native-0.71.9.tgz: 1 vulnerabilities (highest severity is: 9.8) unreachable
react-native-0.71.9.tgz: 3 vulnerabilities (highest severity is: 9.8)
May 15, 2024
mend-for-github-combot
changed the title
react-native-0.71.9.tgz: 3 vulnerabilities (highest severity is: 9.8)
react-native-0.71.9.tgz: 4 vulnerabilities (highest severity is: 9.8)
Jun 2, 2024
mend-for-github-combot
changed the title
react-native-0.71.9.tgz: 4 vulnerabilities (highest severity is: 9.8)
react-native-0.71.9.tgz: 5 vulnerabilities (highest severity is: 9.8)
Jun 19, 2024
mend-for-github-combot
changed the title
react-native-0.71.9.tgz: 5 vulnerabilities (highest severity is: 9.8)
react-native-0.71.9.tgz: 6 vulnerabilities (highest severity is: 9.8)
Jul 3, 2024
mend-for-github-combot
changed the title
react-native-0.71.9.tgz: 6 vulnerabilities (highest severity is: 9.8)
react-native-0.71.9.tgz: 5 vulnerabilities (highest severity is: 9.8)
Jul 19, 2024
mend-for-github-combot
changed the title
react-native-0.71.9.tgz: 5 vulnerabilities (highest severity is: 9.8)
react-native-0.71.9.tgz: 6 vulnerabilities (highest severity is: 9.8)
Jul 31, 2024
mend-for-github-combot
changed the title
react-native-0.71.9.tgz: 6 vulnerabilities (highest severity is: 9.8)
react-native-0.71.9.tgz: 1 vulnerabilities (highest severity is: 5.3)
Aug 6, 2024
mend-for-github-combot
changed the title
react-native-0.71.9.tgz: 1 vulnerabilities (highest severity is: 5.3)
react-native-0.71.9.tgz: 1 vulnerabilities (highest severity is: 7.5)
Aug 25, 2024
mend-for-github-combot
changed the title
react-native-0.71.9.tgz: 1 vulnerabilities (highest severity is: 7.5)
react-native-0.71.9.tgz: 1 vulnerabilities (highest severity is: 5.3)
Aug 29, 2024
mend-for-github-combot
changed the title
react-native-0.71.9.tgz: 1 vulnerabilities (highest severity is: 5.3)
react-native-0.71.9.tgz: 3 vulnerabilities (highest severity is: 5.3)
Sep 24, 2024
Vulnerable Library - react-native-0.71.9.tgz
Path to dependency file: /BasicVideoChat/package.json
Path to vulnerable library: /BasicVideoChat/node_modules/micromatch/package.json
Found in HEAD commit: 61ff2ca836dbea7d5ecbab9402c771e3f7916abc
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2024-4067
Vulnerable Libraries - micromatch-4.0.5.tgz, micromatch-4.0.7.tgz
micromatch-4.0.5.tgz
Glob matching for javascript/node.js. A replacement and faster alternative to minimatch and multimatch.
Library home page: https://registry.npmjs.org/micromatch/-/micromatch-4.0.5.tgz
Path to dependency file: /Signaling/package.json
Path to vulnerable library: /Signaling/node_modules/micromatch/package.json,/Archiving/node_modules/micromatch/package.json,/Multiparty/node_modules/micromatch/package.json,/ScreenSharing/node_modules/micromatch/package.json
Dependency Hierarchy:
micromatch-4.0.7.tgz
Library home page: https://registry.npmjs.org/micromatch/-/micromatch-4.0.7.tgz
Path to dependency file: /BasicVideoChat/package.json
Path to vulnerable library: /BasicVideoChat/node_modules/micromatch/package.json
Dependency Hierarchy:
Found in HEAD commit: 61ff2ca836dbea7d5ecbab9402c771e3f7916abc
Found in base branch: main
Vulnerability Details
The NPM package
micromatch
prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs inmicromatch.braces()
inindex.js
because the pattern.*
will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.Mend Note: After conducting a further research, it was concluded that CVE-2024-4067 should not reflect the security risk score in NVD, but will be kept for users' awareness.
Publish Date: 2024-05-13
URL: CVE-2024-4067
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.0%
CVSS 3 Score Details (5.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2024-05-13
Fix Resolution: micromatch - 4.0.8
CVE-2024-43800
Vulnerable Library - serve-static-1.15.0.tgz
Serve static files
Library home page: https://registry.npmjs.org/serve-static/-/serve-static-1.15.0.tgz
Dependency Hierarchy:
Found in HEAD commit: 61ff2ca836dbea7d5ecbab9402c771e3f7916abc
Found in base branch: main
Vulnerability Details
serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.
Publish Date: 2024-09-10
URL: CVE-2024-43800
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.1%
CVSS 3 Score Details (5.0)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-cm22-4g7w-348p
Release Date: 2024-09-10
Fix Resolution: serve-static - 1.16.0,2.1.0
CVE-2024-43799
Vulnerable Library - send-0.18.0.tgz
Better streaming static file server with Range and conditional-GET support
Library home page: https://registry.npmjs.org/send/-/send-0.18.0.tgz
Dependency Hierarchy:
Found in HEAD commit: 61ff2ca836dbea7d5ecbab9402c771e3f7916abc
Found in base branch: main
Vulnerability Details
Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.
Publish Date: 2024-09-10
URL: CVE-2024-43799
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.0%
CVSS 3 Score Details (5.0)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-m6fv-jmcg-4jfg
Release Date: 2024-09-10
Fix Resolution: send - 0.19.0
The text was updated successfully, but these errors were encountered: