Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
We found the patch for CVE-2021-43838 in jsx-slack v4.5.1 is insufficient to save from Regular Expression Denial of Service (ReDoS) attack. This vulnerability affects to jsx-slack v4.5.1 and earlier versions. Impact If attacker can put a lot of JSX elements into <blockquote tag with including multibyte characters, an internal regular expression for escaping characters may consume an excessive amount of computing resources. v4.5.1 has released by passing the test against ASCII characters but missed the case of multibyte characters. https://github.com/yhatt/jsx-slack/security/advisories/GHSA-55xv-f85c-248q Patches jsx-slack v4.5.2 has updated regular expressions for escaping blockquote characters to prevent catastrophic backtracking. It is also including an updated test case to confirm rendering multiple tags in <blockquote with multibyte characters. References - https://github.com/yhatt/jsx-slack/commit/46bc88391d89d5fda4ce689e18ca080bcdd29ecc Credits Thanks to @hieki for finding out…
Recommended action: Upgrade to 4.5.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
jsx-slack v4.5.1 and earlier versions are vulnerable to a regular expression denial-of-service (ReDoS) attack. Impact If attacker can put a lot of JSX elements into <blockquote tag, an internal regular expression for escaping characters may consume an excessive amount of computing resources. Patches See also: https://github.com/yhatt/jsx-slack/security/advisories/GHSA-hp68-xhvj-x6j6 jsx-slack v4.5.2 has updated regular expressions to prevent catastrophic backtracking. jsx-slack v4.5.1 also had patched a workaround. It has no problems to contents with ASCII characters, but still vulnerable to contents with multibyte characters. (https://github.com/yhatt/jsx-slack/commit/36e4a10405e4c7745333e245fcc5029c02c7065d) References - https://nvd.nist.gov/vuln/detail/CVE-2021-43838 - https://github.com/yhatt/jsx-slack/commit/36e4a10405e4c7745333e245fcc5029c02c7065d Credits Thanks to @hieki for finding out this vulnerability.
Recommended action: Upgrade to 4.5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.