GHSA-7fhm-mqm4-2wp7

Withdrawn: ESLint dependencies are vulnerable (ReDoS and Prototype Pollution)

Medium Withdrawn Apr 3, 2020 npm

Severity: Medium; The publisher's own rating, not a CVSS score
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: Available; 2 packages have a fixed version

Description

Withdrawn GitHub has withdrawn this advisory in place of GHSA-vh95-rmgr-6w4m and GHSA-6chw-6frg-f759. The reason for withdrawing is that some mistakes were made during the ingestion of CVE-2020-7598 which caused this advisory to be published with incorrect information.

In order to provide accurate advisory information, new advisories were created:

minimist: https://github.com/advisories/GHSA-vh95-rmgr-6w4m
acorn: https://github.com/advisories/GHSA-6chw-6frg-f759

Affected versions

npm

Package	Vulnerable	Fixed in
acorn	`< 5.7.4`	`5.7.4`
acorn	`>= 6.0.0, < 6.4.1`	`6.4.1`
acorn	`>= 7.0.0, < 7.1.1`	`7.1.1`
minimist	`< 1.2.2`	`1.2.2`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

acorn npm → `5.7.4`

npm

npm install acorn@5.7.4

yarn

yarn add acorn@5.7.4

pnpm

pnpm add acorn@5.7.4

minimist npm → `1.2.2`

npm

npm install minimist@1.2.2

yarn

yarn add minimist@1.2.2

pnpm

pnpm add minimist@1.2.2

References

Advisories

Timeline

Mar 13, 2020 Published
Apr 3, 2020 Withdrawn
Apr 3, 2020 Last updated by the source

Advisory	Severity	Why it's related
GHSA-xvch-5gv4-984h Prototype Pollution in minimist	Critical	Also affects minimist
GHSA-6chw-6frg-f759 Regular Expression Denial of Service in Acorn	High	Also affects acorn
GHSA-vh95-rmgr-6w4m Prototype Pollution in minimist	Medium	Also affects minimist

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor