diff --git a/advisories/github-reviewed/2018/08/GHSA-gxpj-cx7g-858c/GHSA-gxpj-cx7g-858c.json b/advisories/github-reviewed/2018/08/GHSA-gxpj-cx7g-858c/GHSA-gxpj-cx7g-858c.json index 90a2559449b..e735f3fb064 100644 --- a/advisories/github-reviewed/2018/08/GHSA-gxpj-cx7g-858c/GHSA-gxpj-cx7g-858c.json +++ b/advisories/github-reviewed/2018/08/GHSA-gxpj-cx7g-858c/GHSA-gxpj-cx7g-858c.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-gxpj-cx7g-858c", - "modified": "2023-09-13T23:02:31Z", + "modified": "2023-10-02T17:59:02Z", "published": "2018-08-09T20:18:07Z", "aliases": [ "CVE-2017-16137" ], "summary": "Regular Expression Denial of Service in debug", - "details": "Affected versions of `debug` are vulnerable to regular expression denial of service when untrusted user input is passed into the `o` formatter. \n\nAs it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.\n\n\n## Recommendation\n\nVersion 2.x.x: Update to version 2.6.9 or later.\nVersion 3.x.x: Update to version 3.1.0 or later.", + "details": "Affected versions of `debug` are vulnerable to regular expression denial of service when untrusted user input is passed into the `o` formatter. \n\nAs it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.\n\nThis was later re-introduced in version v3.2.0, and then repatched in versions 3.2.7 and 4.3.1.\n\n## Recommendation\n\nVersion 2.x.x: Update to version 2.6.9 or later.\nVersion 3.1.x: Update to version 3.1.0 or later.\nVersion 3.2.x: Update to version 3.2.7 or later.\nVersion 4.x.x: Update to version 4.3.1 or later.", "severity": [ { "type": "CVSS_V3", @@ -62,6 +62,54 @@ ] } ] + }, + { + "package": { + "ecosystem": "npm", + "name": "debug" + }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.2.0" + }, + { + "fixed": "3.2.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "npm", + "name": "debug" + }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.0.0" + }, + { + "fixed": "4.3.1" + } + ] + } + ] } ], "references": [ @@ -69,6 +117,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16137" }, + { + "type": "WEB", + "url": "https://github.com/debug-js/debug/issues/797" + }, { "type": "WEB", "url": "https://github.com/visionmedia/debug/issues/501" @@ -78,8 +130,24 @@ "url": "https://github.com/visionmedia/debug/pull/504" }, { - "type": "ADVISORY", - "url": "https://github.com/advisories/GHSA-gxpj-cx7g-858c" + "type": "WEB", + "url": "https://github.com/debug-js/debug/commit/4e2150207c568adb9ead8f4c4528016081c88020" + }, + { + "type": "WEB", + "url": "https://github.com/debug-js/debug/commit/71169065b5262f9858ac78cc0b688c84a438f290" + }, + { + "type": "WEB", + "url": "https://github.com/debug-js/debug/commit/b6d12fdbc63b483e5c969da33ea6adc09946b5ac" + }, + { + "type": "WEB", + "url": "https://github.com/debug-js/debug/commit/f53962e944a87e6ca9bb622a2a12dffc22a9bb5a" + }, + { + "type": "PACKAGE", + "url": "https://github.com/visionmedia/debug" }, { "type": "WEB", @@ -88,10 +156,6 @@ { "type": "WEB", "url": "https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63@%3Cnotifications.netbeans.apache.org%3E" - }, - { - "type": "WEB", - "url": "https://www.npmjs.com/advisories/534" } ], "database_specific": {