WS-2018-0591 (Medium) detected in esm-3.0.84.tgz

[mend-bolt-for-github]

WS-2018-0591 - Medium Severity Vulnerability

Vulnerable Library - esm-3.0.84.tgz

Tomorrow's ECMAScript modules today!

Library home page: https://registry.npmjs.org/esm/-/esm-3.0.84.tgz

Path to dependency file: /tmp/ws-scm/cesium-coreui-react/frontend/package.json

Path to vulnerable library: /tmp/ws-scm/cesium-coreui-react/frontend/node_modules/esm/package.json

Dependency Hierarchy:

• plotly.js-1.49.4.tgz (Root Library)
  • mapbox-gl-1.1.1.tgz
    • ❌ esm-3.0.84.tgz (Vulnerable Library)

Found in HEAD commit: 8c766291aacf616f0f787849563a1a20989f6c61

Vulnerability Details

A Regular Expression Denial of Service vulnerability was discovered in esm before 3.1.0. The issue is that esm's find-indexes is using the unescaped identifiers in a regex, which, in this case, causes an infinite loop.

Publish Date: 2018-12-24

URL: WS-2018-0591

CVSS 2 Score Details (6.7)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: standard-things/esm#694

Release Date: 2019-06-16

Fix Resolution: 3.1.0

---

Step up your Open Source Security Game with WhiteSource here