Skip to content

Problem with IQ Server vulnerability : sonatype-2020-0067 #55

Description

@turbo-xav

Hi,

Here is my problem.
I want to install "compodoc" in an internal angular project but one dependencies is blocked by Iq server for this reason :

Sonatype-2020-0067 :
EXPLANATION
The acorn package is vulnerable to Regular Expression Denial of Service (ReDoS). The RegExpValidationState.prototype.at and RegExpValidationState.prototype.nextIndex functions in acorn.js, acorn.mjs, and acorn.es.js process user-supplied input without properly validating UTF-16 surrogate pairs. A remote attacker can exploit this behavior by submitting a crafted UTF-16 encoded string which, when parsed by the application, will result in an infinite loop, ultimately leading to a DoS condition.
ROOT CAUSE
static-module-3.0.4.tgzpackage/dist/acorn.js[5.5.0, 5.7.4)
ADVISORIES
Third Party:https://www.npmjs.com/advisories/1488

Is there a solution to fix it in futur version of "static module" ?

Best regards

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions