[
https://issues.apache.org/jira/browse/PHOENIX-8028?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Dávid Paksy updated PHOENIX-8028:
---------------------------------
Description:
Dependabot opened 2 automated CVE fix PR-s:
- https://github.com/apache/phoenix-site/pull/47
- https://github.com/apache/phoenix-site/pull/46
npm audit before:
{noformat}
npm audit
# npm audit report
brace-expansion <=1.1.20 || 4.0.0 - 5.0.11
Severity: high
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU
denial of service - https://github.com/advisories/GHSA-q2hr-2g5m-vwhr
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU
denial of service - https://github.com/advisories/GHSA-q2hr-2g5m-vwhr
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing
stack exhaustion - https://github.com/advisories/GHSA-qhr7-859c-m2p7
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing
stack exhaustion - https://github.com/advisories/GHSA-qhr7-859c-m2p7
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing
stack exhaustion - https://github.com/advisories/GHSA-6j4f-fj2g-mc7p
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing
stack exhaustion - https://github.com/advisories/GHSA-6j4f-fj2g-mc7p
fix available via `npm audit fix`
node_modules/@eslint/config-array/node_modules/brace-expansion
node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion
node_modules/brace-expansion
node_modules/eslint-plugin-import-x/node_modules/brace-expansion
node_modules/eslint/node_modules/brace-expansion
compression <1.8.2
Severity: high
compression vulnerable to Denial of Service via memory leak on premature
response close - https://github.com/advisories/GHSA-vc2v-76pw-4v95
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/compression
serve >=10.1.0
Depends on vulnerable versions of compression
node_modules/serve
fast-uri 3.0.0 - 3.1.7
Severity: moderate
fast-uri vulnerable to inconsistent host case normalization via percent-encoded
octets - https://github.com/advisories/GHSA-hrr3-gc8f-f4qj
fix available via `npm audit fix`
node_modules/fast-uri
katex 0.11.0 - 0.18.1
KaTeX: Existing prototype pollution can bypass trust restrictions -
https://github.com/advisories/GHSA-238p-pmpm-9mq7
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/katex
micromark-extension-math *
Depends on vulnerable versions of katex
node_modules/micromark-extension-math
remark-math >=4.0.0
Depends on vulnerable versions of micromark-extension-math
node_modules/remark-math
rehype-katex >=2.0.0
Depends on vulnerable versions of katex
node_modules/rehype-katex
nanoid <3.3.18
Severity: high
nanoid: custom generators can loop indefinitely when size is zero -
https://github.com/advisories/GHSA-2v37-7h3g-55p8
fix available via `npm audit fix`
node_modules/nanoid
postcss-selector-parser <7.1.6
Severity: moderate
PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion -
https://github.com/advisories/GHSA-rj75-hqrm-r3gf
fix available via `npm audit fix --force`
Will install @tailwindcss/[email protected], which is a breaking change
node_modules/postcss-selector-parser
@tailwindcss/typography <=0.0.0-insiders.fda8ce5 || >=0.5.5
Depends on vulnerable versions of postcss-selector-parser
node_modules/@tailwindcss/typography
source-map-js 1.0.0 - 1.2.1
Severity: high
source-map-js allows event-loop denial of service through indexed source-map
section offsets - https://github.com/advisories/GHSA-68fv-2mgg-jv7q
fix available via `npm audit fix`
node_modules/source-map-js
12 vulnerabilities (4 low, 3 moderate, 5 high)
To address issues that do not require attention, run:
npm audit fix
{noformat}
was:
Dependabot opened 2 automated CVE fix PR-s:
- https://github.com/apache/phoenix-site/pull/47
- https://github.com/apache/phoenix-site/pull/46
> Update brace-expansion and source-map-js from 1.2.1 to 1.2.2 in website
> -----------------------------------------------------------------------
>
> Key: PHOENIX-8028
> URL: https://issues.apache.org/jira/browse/PHOENIX-8028
> Project: Phoenix
> Issue Type: Task
> Components: website
> Reporter: Dávid Paksy
> Assignee: Dávid Paksy
> Priority: Major
>
> Dependabot opened 2 automated CVE fix PR-s:
> - https://github.com/apache/phoenix-site/pull/47
> - https://github.com/apache/phoenix-site/pull/46
> npm audit before:
> {noformat}
> npm audit
> # npm audit report
> brace-expansion <=1.1.20 || 4.0.0 - 5.0.11
> Severity: high
> brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU
> denial of service - https://github.com/advisories/GHSA-q2hr-2g5m-vwhr
> brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU
> denial of service - https://github.com/advisories/GHSA-q2hr-2g5m-vwhr
> brace-expansion: DoS via uncontrolled recursion on nested brace groups
> causing stack exhaustion - https://github.com/advisories/GHSA-qhr7-859c-m2p7
> brace-expansion: DoS via uncontrolled recursion on nested brace groups
> causing stack exhaustion - https://github.com/advisories/GHSA-qhr7-859c-m2p7
> brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing
> stack exhaustion - https://github.com/advisories/GHSA-6j4f-fj2g-mc7p
> brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing
> stack exhaustion - https://github.com/advisories/GHSA-6j4f-fj2g-mc7p
> fix available via `npm audit fix`
> node_modules/@eslint/config-array/node_modules/brace-expansion
> node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion
> node_modules/brace-expansion
> node_modules/eslint-plugin-import-x/node_modules/brace-expansion
> node_modules/eslint/node_modules/brace-expansion
> compression <1.8.2
> Severity: high
> compression vulnerable to Denial of Service via memory leak on premature
> response close - https://github.com/advisories/GHSA-vc2v-76pw-4v95
> fix available via `npm audit fix --force`
> Will install [email protected], which is a breaking change
> node_modules/compression
> serve >=10.1.0
> Depends on vulnerable versions of compression
> node_modules/serve
> fast-uri 3.0.0 - 3.1.7
> Severity: moderate
> fast-uri vulnerable to inconsistent host case normalization via
> percent-encoded octets - https://github.com/advisories/GHSA-hrr3-gc8f-f4qj
> fix available via `npm audit fix`
> node_modules/fast-uri
> katex 0.11.0 - 0.18.1
> KaTeX: Existing prototype pollution can bypass trust restrictions -
> https://github.com/advisories/GHSA-238p-pmpm-9mq7
> fix available via `npm audit fix --force`
> Will install [email protected], which is a breaking change
> node_modules/katex
> micromark-extension-math *
> Depends on vulnerable versions of katex
> node_modules/micromark-extension-math
> remark-math >=4.0.0
> Depends on vulnerable versions of micromark-extension-math
> node_modules/remark-math
> rehype-katex >=2.0.0
> Depends on vulnerable versions of katex
> node_modules/rehype-katex
> nanoid <3.3.18
> Severity: high
> nanoid: custom generators can loop indefinitely when size is zero -
> https://github.com/advisories/GHSA-2v37-7h3g-55p8
> fix available via `npm audit fix`
> node_modules/nanoid
> postcss-selector-parser <7.1.6
> Severity: moderate
> PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
> - https://github.com/advisories/GHSA-rj75-hqrm-r3gf
> fix available via `npm audit fix --force`
> Will install @tailwindcss/[email protected], which is a breaking change
> node_modules/postcss-selector-parser
> @tailwindcss/typography <=0.0.0-insiders.fda8ce5 || >=0.5.5
> Depends on vulnerable versions of postcss-selector-parser
> node_modules/@tailwindcss/typography
> source-map-js 1.0.0 - 1.2.1
> Severity: high
> source-map-js allows event-loop denial of service through indexed source-map
> section offsets - https://github.com/advisories/GHSA-68fv-2mgg-jv7q
> fix available via `npm audit fix`
> node_modules/source-map-js
> 12 vulnerabilities (4 low, 3 moderate, 5 high)
> To address issues that do not require attention, run:
> npm audit fix
> {noformat}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
