Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Denial of service vulnerability that could be exploited during a guest checkout. The regular expression used to validate a guest order's email was subject to exponential backtracking through a fragment like a.a.. Before the patch, it can be reproduced in the console like this: To reproduce in the browser, fill in the "Customer Email" field with that fake email address during a guest checkout. Before that, you should open the browser dev tools and change the type attribute for that field from email to text. After entering a fake address and pressing the "Save & Continue" button, the browser will take a long term to perform the request before showing an error message for the invalid address. Eventually, making the email string even longer could lead to the exhaustion of server resources. Patches Versions 3.1.4, 3.0.4, and 2.11.13 have been patched to use a different regular expression. There's an improbable chance that some orders in your system end up having associated an email…
Recommended action: Upgrade to 3.1.4, 3.0.4 or 2.11.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The actual vulnerability has been discovered on solidusauthdevise. See GHSA-xm34-v85h-9pg2 for details. The security advisory here exists to provide an extra layer of security in the form of a monkey patch for users who don't update solidusauthdevise. For this reason, it has been marked as low impact on this end. Patches For extra security, update soliduscore to versions 3.1.3, 3.0.3 or 2.11.12. Workarounds Look at the workarounds described at GHSA-xm34-v85h-9pg2. References - GHSA-xm34-v85h-9pg2. For more information If you have any questions or comments about this advisory: Open an issue in solidusauthdevise or a discussion in solidus Email us at security@solidus.io Contact the core team on Slack
Recommended action: Upgrade to 3.1.3, 3.0.3 or 2.11.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.