Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

minimatch minimatch.js braceExpand() Function Improper Regular Expression DoS #1697

Closed
pratikbom opened this issue Mar 11, 2022 · 1 comment · Fixed by #1704
Closed

minimatch minimatch.js braceExpand() Function Improper Regular Expression DoS #1697

pratikbom opened this issue Mar 11, 2022 · 1 comment · Fixed by #1704

Comments

@pratikbom
Copy link

protobuf.js version: 6.11.2

The above mentioned version of protobufjs includes minimatch3.0.4 which has below high severity security issue:
minimatch contains a flaw in the braceExpand() function in minimatch.js that is triggered as an improper regular expression is used to match patterns for brace expansion. This may allow a context-dependent attacker to hang or slow down a Node process using the library.
If we change the version of minimatch to 3.0.5 or above then this could be resolved.
Can this be fixed in the next available release of protobufjs.
@ryansh100
Copy link

Had an issue where the CLI is being included inside the main protobufjs package under cli/node_modules/minimatch folder. I would assume those should just be normal dependencies though.

richgerrard added a commit to richgerrard/protobuf.js that referenced this issue Mar 31, 2022
@richgerrard
Patch minimatch vulnerability
6694617 
If I follow this, glob packages minimatch.  Minimatch released a fix, glob also has a newer build, picking this up should pick up that.
Fixes protobufjs#1696
Fixes protobufjs#1697
Fixes protobufjs#1698
@richgerrard richgerrard mentioned this issue Mar 31, 2022
Merged
alexander-fenster added a commit that referenced this issue May 20, 2022
@richgerrard @alexander-fenster
fix(deps): patch minimatch vulnerability (#1704)
bac61b8 
* Patch minimatch vulnerability

If I follow this, glob packages minimatch.  Minimatch released a fix, glob also has a newer build, picking this up should pick up that.
Fixes #1696
Fixes #1697
Fixes #1698

* chore: update lockfile

Co-authored-by: Alexander Fenster <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix(deps): patch minimatch vulnerability richgerrard/protobuf.js
2 participants
@ryansh100 @pratikbom