WS-2021-0638 (High) detected in mocha-7.2.0.tgz #2269
Assignees
Labels
Mend: dependency security vulnerability
Security vulnerability detected by Mend
Comments
mend-for-jackfan.us.kg
bot
added
the
Mend: dependency security vulnerability
mend-for-jackfan.us.kg
bot
changed the title
ananzh
added a commit
to ananzh/OpenSearch-Dashboards
that referenced
this issue
Nov 1, 2022
In our current repo, most mocha tests have been changed to jest in this issue: opensearch-project#215 The fix for the above issue (mochajs/mocha@61b4b92) is only released in the latest version v10.1.0: https://github.com/mochajs/mocha/blob/5f96d511dbf913f135b92198aab721a27f6b44fe/lib/utils.js#L79 Though it is a bump from 7.2.0 to 10.1.0, I don't see breaking changes for plugins or users. Issue Resolved: opensearch-project#2269 Signed-off-by: Anan Zhuang <[email protected]>
|
The fix for the above issue is only released in the latest version v10.1.0: To fix it, mocha needs to be bumped to v10.1.0 |
8 tasks
ananzh
added a commit
to ananzh/OpenSearch-Dashboards
that referenced
this issue
Nov 1, 2022
In our current repo, most mocha tests have been changed to jest in this issue: opensearch-project#215 The fix for the above issue (mochajs/mocha@61b4b92) is only released in the latest version v10.1.0: https://github.com/mochajs/mocha/blob/5f96d511dbf913f135b92198aab721a27f6b44fe/lib/utils.js#L79 Though it is a bump from 7.2.0 to 10.1.0, I don't see breaking changes for plugins or users. Issue Resolved: opensearch-project#2269 Signed-off-by: Anan Zhuang <[email protected]>
AlexRuiz7
pushed a commit
to wazuh/wazuh-dashboard
that referenced
this issue
Dec 14, 2022
* [WS-2021-0638][Security] bump mocha to 10.1.0 In our current repo, most mocha tests have been changed to jest in this issue: opensearch-project#215 The fix for the above issue (mochajs/mocha@61b4b92) is only released in the latest version v10.1.0: https://github.com/mochajs/mocha/blob/5f96d511dbf913f135b92198aab721a27f6b44fe/lib/utils.js#L79 Since we are considering this change might break others, we will not backport to 2.x and release it in 3.0.0 Issue Resolved: opensearch-project#2269 Signed-off-by: Anan Zhuang <[email protected]>
AlexRuiz7
pushed a commit
to wazuh/wazuh-dashboard
that referenced
this issue
Dec 14, 2022
* [WS-2021-0638][Security] bump mocha to 10.1.0 In our current repo, most mocha tests have been changed to jest in this issue: opensearch-project#215 The fix for the above issue (mochajs/mocha@61b4b92) is only released in the latest version v10.1.0: https://github.com/mochajs/mocha/blob/5f96d511dbf913f135b92198aab721a27f6b44fe/lib/utils.js#L79 Since we are considering this change might break others, we will not backport to 2.x and release it in 3.0.0 Issue Resolved: opensearch-project#2269 Signed-off-by: Anan Zhuang <[email protected]>
sipopo
pushed a commit
to sipopo/OpenSearch-Dashboards
that referenced
this issue
Dec 16, 2022
* [WS-2021-0638][Security] bump mocha to 10.1.0 In our current repo, most mocha tests have been changed to jest in this issue: opensearch-project#215 The fix for the above issue (mochajs/mocha@61b4b92) is only released in the latest version v10.1.0: https://github.com/mochajs/mocha/blob/5f96d511dbf913f135b92198aab721a27f6b44fe/lib/utils.js#L79 Since we are considering this change might break others, we will not backport to 2.x and release it in 3.0.0 Issue Resolved: opensearch-project#2269 Signed-off-by: Anan Zhuang <[email protected]> Signed-off-by: Sergey Osipov <[email protected]>
Arpit-Bandejiya
pushed a commit
to Arpit-Bandejiya/OpenSearch-Dashboards
that referenced
this issue
Jan 13, 2023
* [WS-2021-0638][Security] bump mocha to 10.1.0 In our current repo, most mocha tests have been changed to jest in this issue: opensearch-project#215 The fix for the above issue (mochajs/mocha@61b4b92) is only released in the latest version v10.1.0: https://github.com/mochajs/mocha/blob/5f96d511dbf913f135b92198aab721a27f6b44fe/lib/utils.js#L79 Since we are considering this change might break others, we will not backport to 2.x and release it in 3.0.0 Issue Resolved: opensearch-project#2269 Signed-off-by: Anan Zhuang <[email protected]> Signed-off-by: Arpit Bandejiya <[email protected]>
sikhote
pushed a commit
to sikhote/OpenSearch-Dashboards
that referenced
this issue
Apr 24, 2023
* [WS-2021-0638][Security] bump mocha to 10.1.0 In our current repo, most mocha tests have been changed to jest in this issue: opensearch-project#215 The fix for the above issue (mochajs/mocha@61b4b92) is only released in the latest version v10.1.0: https://github.com/mochajs/mocha/blob/5f96d511dbf913f135b92198aab721a27f6b44fe/lib/utils.js#L79 Since we are considering this change might break others, we will not backport to 2.x and release it in 3.0.0 Issue Resolved: opensearch-project#2269 Signed-off-by: Anan Zhuang <[email protected]> Signed-off-by: David Sinclair <[email protected]>
sikhote
pushed a commit
to sikhote/OpenSearch-Dashboards
that referenced
this issue
Apr 24, 2023
* [WS-2021-0638][Security] bump mocha to 10.1.0 In our current repo, most mocha tests have been changed to jest in this issue: opensearch-project#215 The fix for the above issue (mochajs/mocha@61b4b92) is only released in the latest version v10.1.0: https://github.com/mochajs/mocha/blob/5f96d511dbf913f135b92198aab721a27f6b44fe/lib/utils.js#L79 Since we are considering this change might break others, we will not backport to 2.x and release it in 3.0.0 Issue Resolved: opensearch-project#2269 Signed-off-by: Anan Zhuang <[email protected]> Signed-off-by: David Sinclair <[email protected]>
8 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
WS-2021-0638 - High Severity Vulnerability
simple, flexible, fun test framework
Library home page: https://registry.npmjs.org/mocha/-/mocha-7.2.0.tgz
Dependency Hierarchy:
Found in base branch: main
There is regular Expression Denial of Service (ReDoS) vulnerability in mocha.
It allows cause a denial of service when stripping crafted invalid function definition from strs.
Publish Date: 2021-09-18
URL: WS-2021-0638
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.The text was updated successfully, but these errors were encountered: