CVE-2019-10747 (High) detected in set-value-2.0.0.tgz, set-value-0.4.3.tgz

[mend-bolt-for-github]

CVE-2019-10747 - High Severity Vulnerability

Vulnerable Libraries - set-value-2.0.0.tgz, set-value-0.4.3.tgz

set-value-2.0.0.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-2.0.0.tgz

Path to dependency file: /angular-shopping/package.json

Path to vulnerable library: /tmp/git/angular-shopping/node_modules/set-value/package.json

Dependency Hierarchy:

• cli-1.7.1.tgz (Root Library)
  • webpack-dev-server-2.11.1.tgz
    • chokidar-2.0.2.tgz
      • braces-2.3.1.tgz
        • snapdragon-0.8.1.tgz
          • base-0.11.2.tgz
            • cache-base-1.0.1.tgz
              • ❌ set-value-2.0.0.tgz (Vulnerable Library)

set-value-0.4.3.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-0.4.3.tgz

Path to dependency file: /angular-shopping/package.json

Path to vulnerable library: /tmp/git/angular-shopping/node_modules/union-value/node_modules/set-value/package.json

Dependency Hierarchy:

• cli-1.7.1.tgz (Root Library)
  • webpack-dev-server-2.11.1.tgz
    • chokidar-2.0.2.tgz
      • braces-2.3.1.tgz
        • snapdragon-0.8.1.tgz
          • base-0.11.2.tgz
            • cache-base-1.0.1.tgz
              • union-value-1.0.0.tgz
                • ❌ set-value-0.4.3.tgz (Vulnerable Library)

Found in HEAD commit: 1329e1298c2ed6fba617fd2a587e7db5ecdd4adb

Vulnerability Details

A vulnerability was found in set-value before 2.0.1 and from 3.0.0 before 3.0.1 previously reported as WS-2019-0176

Publish Date: 2019-07-24

URL: CVE-2019-10747

CVSS 2 Score Details (7.4)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: jonschlinkert/set-value@95e9d99

Release Date: 2019-07-24

Fix Resolution: 2.0.1,3.0.1

---

Step up your Open Source Security Game with WhiteSource here