diff --git a/advisories/unreviewed/2022/10/GHSA-pfq8-rq6v-vf5m/GHSA-pfq8-rq6v-vf5m.json b/advisories/github-reviewed/2022/10/GHSA-pfq8-rq6v-vf5m/GHSA-pfq8-rq6v-vf5m.json similarity index 60% rename from advisories/unreviewed/2022/10/GHSA-pfq8-rq6v-vf5m/GHSA-pfq8-rq6v-vf5m.json rename to advisories/github-reviewed/2022/10/GHSA-pfq8-rq6v-vf5m/GHSA-pfq8-rq6v-vf5m.json index 8ffef4aba73..78c4379f94a 100644 --- a/advisories/unreviewed/2022/10/GHSA-pfq8-rq6v-vf5m/GHSA-pfq8-rq6v-vf5m.json +++ b/advisories/github-reviewed/2022/10/GHSA-pfq8-rq6v-vf5m/GHSA-pfq8-rq6v-vf5m.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-pfq8-rq6v-vf5m", - "modified": "2022-11-01T19:00:28Z", + "modified": "2024-04-22T23:06:37Z", "published": "2022-10-31T19:00:36Z", "aliases": [ "CVE-2022-37620" ], + "summary": "kangax html-minifier REDoS vulnerability", "details": "A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 via the candidate variable in htmlminifier.js.", "severity": [ { @@ -14,7 +15,30 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "html-minifier" + }, + "ecosystem_specific": { + "affected_functions": [ + "(html-minifier).minify" + ] + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.0.0" + } + ] + } + ] + } ], "references": [ { @@ -25,6 +49,10 @@ "type": "WEB", "url": "https://github.com/kangax/html-minifier/issues/1135" }, + { + "type": "PACKAGE", + "url": "https://github.com/kangax/html-minifier" + }, { "type": "WEB", "url": "https://github.com/kangax/html-minifier/blob/51ce10f4daedb1de483ffbcccecc41be1c873da2/src/htmlminifier.js#L1338" @@ -36,11 +64,12 @@ ], "database_specific": { "cwe_ids": [ + "CWE-1333", "CWE-400" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-04-22T23:06:37Z", "nvd_published_at": "2022-10-31T12:15:00Z" } } \ No newline at end of file