Publish GHSA-gxpj-cx7g-858c

advisories/github-reviewed/2018/08/GHSA-gxpj-cx7g-858c/GHSA-gxpj-cx7g-858c.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-gxpj-cx7g-858c",
-  "modified": "2023-09-13T23:02:31Z",
+  "modified": "2023-10-02T17:59:02Z",
   "published": "2018-08-09T20:18:07Z",
   "aliases": [
     "CVE-2017-16137"
   ],
   "summary": "Regular Expression Denial of Service in debug",
-  "details": "Affected versions of `debug` are vulnerable to regular expression denial of service when untrusted user input is passed into the `o` formatter. \n\nAs it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.\n\n\n## Recommendation\n\nVersion 2.x.x: Update to version 2.6.9 or later.\nVersion 3.x.x: Update to version 3.1.0 or later.",
+  "details": "Affected versions of `debug` are vulnerable to regular expression denial of service when untrusted user input is passed into the `o` formatter. \n\nAs it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.\n\nThis was later re-introduced in version v3.2.0, and then repatched in versions 3.2.7 and 4.3.1.\n\n## Recommendation\n\nVersion 2.x.x: Update to version 2.6.9 or later.\nVersion 3.1.x: Update to version 3.1.0 or later.\nVersion 3.2.x: Update to version 3.2.7 or later.\nVersion 4.x.x: Update to version 4.3.1 or later.",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -62,6 +62,54 @@
           ]
         }
       ]
+    },
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "debug"
+      },
+      "ecosystem_specific": {
+        "affected_functions": [
+          ""
+        ]
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.2.0"
+            },
+            {
+              "fixed": "3.2.7"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "debug"
+      },
+      "ecosystem_specific": {
+        "affected_functions": [
+          ""
+        ]
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "4.0.0"
+            },
+            {
+              "fixed": "4.3.1"
+            }
+          ]
+        }
+      ]
     }
   ],
   "references": [
@@ -69,6 +117,10 @@
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16137"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/debug-js/debug/issues/797"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/visionmedia/debug/issues/501"
@@ -78,8 +130,24 @@
       "url": "https://github.com/visionmedia/debug/pull/504"
     },
     {
-      "type": "ADVISORY",
-      "url": "https://github.com/advisories/GHSA-gxpj-cx7g-858c"
+      "type": "WEB",
+      "url": "https://github.com/debug-js/debug/commit/4e2150207c568adb9ead8f4c4528016081c88020"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/debug-js/debug/commit/71169065b5262f9858ac78cc0b688c84a438f290"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/debug-js/debug/commit/b6d12fdbc63b483e5c969da33ea6adc09946b5ac"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/debug-js/debug/commit/f53962e944a87e6ca9bb622a2a12dffc22a9bb5a"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/visionmedia/debug"
     },
     {
       "type": "WEB",
@@ -88,10 +156,6 @@
     {
       "type": "WEB",
       "url": "https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63@%3Cnotifications.netbeans.apache.org%3E"
-    },
-    {
-      "type": "WEB",
-      "url": "https://www.npmjs.com/advisories/534"
     }
   ],
   "database_specific": {