Giter Site home page Giter Site logo

alexrogalskiy / android-patterns Goto Github PK

View Code? Open in Web Editor NEW
4.0 3.0 3.0 15.42 MB

๐Ÿ† Android4You Design patterns

Home Page: https://alexander-rogalsky.gitbook.io/android-patterns/

License: GNU General Public License v3.0

Shell 28.34% JavaScript 6.80% Dockerfile 9.53% Starlark 24.68% Open Policy Agent 6.14% Python 8.87% Makefile 6.80% Go 4.89% Mustache 3.80% Vim Script 0.15%
android patterns-design patterns ebook android-architecture android-ui android-sdk android-development android-architecture-components

android-patterns's Introduction

Android Design Patterns

Android Design patterns

Nullable labs Android patterns Android patterns

GitHub tag (latest by date) GitHub Release Date Lines of code GitHub closed issues GitHub closed pull requests GitHub repo size GitHub last commit GitHub GitHub language count GitHub search hit counter GitHub Repository branches GitHub Repository dependents

FOSSA Status Renovatebot Dependabot NewReleases Hits-of-Code ComVer GitHub Super-Linter Documentation Status

๐ŸŽน Table of contents

โ˜ Summary

Android Project Status: Active โ€“ The project has reached a stable, usable state and is being actively developed. Project created status Project updated status

Android Design Patterns is intended to provide various use case scenarios and architectural concepts on prototyping adaptive applications.

mkdocs.yml    # Configuration file.
docs/
    readme.md  # General information
    summary.md  # Table of contents
    units/
        design-patterns.md # Design patterns and architectural concepts
        scenarios.md # Scenarios in practice
        use-cases.md # Typical use cases 
    user-guide/
        changelog.md # Changelog page 
        code_of_conduct.md # Code of conduct page 
        code_owners.md # Code owners page 
        dependency.md # Dependency page 
        description.md # Description page
        faq.md # FAQ page
        getting-started.md # Getting started page
        troubleshooting.md # Troubleshooting page
        upgrade.md # Upgrade page
    reporting/
        info.md # Informational page
        issue_template.md # Issue template page
        bug_report.md # Bug report template
        custom_report.md # Custom report template
        feature_request_template.md # Feature request template
        pull_request_template.md # Pull request template
    contributing/
        info.md # Contributing page
    links/
        info.md # Links page

๐Ÿ“ Documentation

The Website documentation is provided by gitbook and can be discovered at url:

Android Patterns

To enable documentation serving at localhost you can run the following script

./scripts/build-docs.sh

otherwise, the next steps should be considered:

1) Install/upgrade pip command-line utility:

pip install --upgrade pip

or if you need to install pip for the first time:

wget --no-check-certificate https://bootstrap.pypa.io/get-pip.py
python get-pip.py

2) Install the mkdocs package using pip:

pip install mkdocs

or more conveniently for Windows subsystem:

python -m pip install mkdocs
python -m mkdocs

3) Install the material theme for the website:

python -m pip install mkdocs-material
python -m pip install markdown-include
...
(see requirements.txt)
...

4) Start the server at localhost by running the following command:

python -m mkdocs build --clean --config-file mkdocs.yml
python -m mkdocs serve --verbose --dirtyreload

5) Deploy to GitHub pages:

python -m mkdocs --verbose gh-deploy --force --remote-branch gh-pages

5) Open up localhost in browser to get the default documentation homepage.

๐Ÿงถ Kubernetes

Running k8s cluster with tilt command by acquiring k8s deployment configuration:

tilt up

Shutting down k8s cluster with provisioned resources removal:

tilt down --delete-namespaces

โฐ Statistics

Documentation PageSpeed result dashboard

๐Ÿ“ Versioning

The project uses SemVer for versioning. For the versions available, see the tags on this repository.

๐ŸŒน Authors

Android Patterns is maintained by the following GitHub team-members:

  • Author

with community support please contact with us if you have some question or proposition.

๐Ÿ’• Contributing

Contributors Display

Please read CONTRIBUTING.md for details on our code of conduct, and the process for submitting pull requests to us (emoji key).

This project follows the all-contributors specification. Contributions of any kind are welcome!

PRs Welcome Github contributors

See also the list of contributors who participated in this project.

๐Ÿšจ Visitor stats

GitHub page hits

GitHub stars GitHub forks GitHub watchers

โšฝ Licensing

Android Patterns is distributed under LGPL version 3 or later, [License]. LGPLv3 is additional permissions on top of GPLv3.

image

๐ŸŒŸ Development Support

Like Android Design patterns and Android Patterns ? Consider buying me a coffee :)

Become a Patron Buy Me A Coffee KoFi

๐Ÿ‘จโ€๐Ÿ‘จโ€๐Ÿ‘งโ€๐Ÿ‘ฆ Acknowledgement

Stargazers repo roster for @AlexRogalskiy/android-patterns

Stargazers over time

Statistics report

๐Ÿ“Ž OpenGraph Card

OpenGraph card

๐Ÿ”ฅ Feeds and Podcasts

Reddit posts

InfoWorld posts

RedHat posts

Android Authority posts

Android Arsenal posts

Medium posts

Gizmodo posts

Mobile Dev Memo posts

Infinum posts


forthebadge forthebadge forthebadge

android-patterns's People

Contributors

alexrogalskiy avatar dependabot[bot] avatar github-actions[bot] avatar renovate-bot avatar

Stargazers

 avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar

Forkers

dsp-testing

android-patterns's Issues

CVE-2019-10744 (High) detected in lodash-2.4.2.tgz

CVE-2019-10744 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 44ad98844a803d44f5b497fa1907ae9b9dadfaf9

Found in base branch: master

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-08

Fix Resolution: lodash-4.17.12, lodash-amd-4.17.12, lodash-es-4.17.12, lodash.defaultsdeep-4.6.1, lodash.merge- 4.6.2, lodash.mergewith-4.6.2, lodash.template-4.5.0


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23358 (High) detected in underscore-1.6.0.tgz

CVE-2021-23358 - High Severity Vulnerability

Vulnerable Library - underscore-1.6.0.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/underscore/package.json

Dependency Hierarchy:

  • jsonlint-1.6.3.tgz (Root Library)
    • nomnom-1.8.1.tgz
      • โŒ underscore-1.6.0.tgz (Vulnerable Library)

Found in HEAD commit: 5fc5f963f2befb187f903259f7dee376f5dc3628

Found in base branch: master

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2


Step up your Open Source Security Game with WhiteSource here

CVE-2018-3721 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-3721 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: e7381166be987377e72a21d5167e1b6ca947f502

Found in base branch: master

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution: 4.17.5


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23358 (High) detected in underscore-1.6.0.tgz

CVE-2021-23358 - High Severity Vulnerability

Vulnerable Library - underscore-1.6.0.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/underscore/package.json

Dependency Hierarchy:

  • jsonlint-1.6.3.tgz (Root Library)
    • nomnom-1.8.1.tgz
      • โŒ underscore-1.6.0.tgz (Vulnerable Library)

Found in HEAD commit: ead7c7bfe90e64648164c715d8c8a4d50f95aa0b

Found in base branch: master

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2


Step up your Open Source Security Game with WhiteSource here

CVE-2020-15366 (Medium) detected in ajv-4.11.8.tgz

CVE-2020-15366 - Medium Severity Vulnerability

Vulnerable Library - ajv-4.11.8.tgz

Another JSON Schema Validator

Library home page: https://registry.npmjs.org/ajv/-/ajv-4.11.8.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/@textlint/linter-formatter/node_modules/ajv/package.json

Dependency Hierarchy:

  • textlint-11.9.1.tgz (Root Library)
    • linter-formatter-3.3.5.tgz
      • table-3.8.3.tgz
        • โŒ ajv-4.11.8.tgz (Vulnerable Library)

Found in HEAD commit: ead7c7bfe90e64648164c715d8c8a4d50f95aa0b

Found in base branch: master

Vulnerability Details

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)

Publish Date: 2020-07-15

URL: CVE-2020-15366

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/ajv-validator/ajv/releases/tag/v6.12.3

Release Date: 2020-07-15

Fix Resolution: ajv - 6.12.3


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23337 (High) detected in lodash-2.4.2.tgz

CVE-2021-23337 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 5fc5f963f2befb187f903259f7dee376f5dc3628

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@3469357

Release Date: 2021-02-15

Fix Resolution: lodash - 4.17.21


Step up your Open Source Security Game with WhiteSource here

CVE-2019-10744 (High) detected in lodash-2.4.2.tgz

CVE-2019-10744 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: e7381166be987377e72a21d5167e1b6ca947f502

Found in base branch: master

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-08

Fix Resolution: lodash-4.17.12, lodash-amd-4.17.12, lodash-es-4.17.12, lodash.defaultsdeep-4.6.1, lodash.merge- 4.6.2, lodash.mergewith-4.6.2, lodash.template-4.5.0


Step up your Open Source Security Game with WhiteSource here

CVE-2019-10744 (High) detected in lodash-2.4.2.tgz

CVE-2019-10744 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 5fc5f963f2befb187f903259f7dee376f5dc3628

Found in base branch: master

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-08

Fix Resolution: lodash-4.17.12, lodash-amd-4.17.12, lodash-es-4.17.12, lodash.defaultsdeep-4.6.1, lodash.merge- 4.6.2, lodash.mergewith-4.6.2, lodash.template-4.5.0


Step up your Open Source Security Game with WhiteSource here

CVE-2018-3721 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-3721 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 44ad98844a803d44f5b497fa1907ae9b9dadfaf9

Found in base branch: master

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution: 4.17.5


Step up your Open Source Security Game with WhiteSource here

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Warning

These dependencies are deprecated:

Datasource Name Replacement PR?
npm validate-commit-msg Unavailable

Rate-Limited

These updates are currently rate-limited. Click on a checkbox below to force their creation now.

  • โฌ†๏ธ Updates alex to ^9.1.1
  • โฌ†๏ธ Updates dumb-init to >=1.2.5.post1
  • โฌ†๏ธ Updates markdown-checklist to >=0.4.4
  • โฌ†๏ธ Updates sangonzal/repository-traffic-action action to v0.1.5
  • โฌ†๏ธ Updates textlint-rule-en-capitalization to ^2.0.3
  • โฌ†๏ธ Updates textlint-rule-terminology to ^2.1.6
  • โฌ†๏ธ Updates yogevbd/enforce-label-action action to v2.2.2
  • โฌ†๏ธ Updates LouisBrunner/checks-action action to v1.6.2
  • โฌ†๏ธ Updates Node.js
  • โฌ†๏ธ Updates actions/checkout action to v2.7.0
  • โฌ†๏ธ Updates conventional-changelog-cli to ^2.2.2
  • โฌ†๏ธ Updates dessant/lock-threads action to v2.1.2
  • โฌ†๏ธ Updates git-cz to ^4.9.0
  • โฌ†๏ธ Updates helm/chart-releaser-action action to v1.6.0
  • โฌ†๏ธ Updates helm/chart-testing-action action to v2.6.1
  • โฌ†๏ธ Updates helm/kind-action action to v1.10.0
  • โฌ†๏ธ Updates ibiqlik/action-yamllint action to v3.1.1
  • โฌ†๏ธ Updates lint-staged to ^11.3.0-beta.2
  • โฌ†๏ธ Updates markdown to >=3.6
  • โฌ†๏ธ Updates markdown-include to >=0.8.1
  • โฌ†๏ธ Updates markdown-link-check to ^3.12.2
  • โฌ†๏ธ Updates markdownlint-cli to ^0.41.0
  • โฌ†๏ธ Updates mdx-truly-sane-lists to >=1.3
  • โฌ†๏ธ Updates mkdocs to >=1.6.0
  • โฌ†๏ธ Updates mkdocs-awesome-pages-plugin to >=2.9.2
  • โฌ†๏ธ Updates mkdocs-git-revision-date-localized-plugin to >=0.12.1
  • โฌ†๏ธ Updates mkdocs-include-markdown-plugin to >=3.9.1
  • โฌ†๏ธ Updates mkdocs-material to >=7.3.6
  • โฌ†๏ธ Updates mkdocs-material-extensions to >=1.3.1
  • โฌ†๏ธ Updates mkdocs-redirects to >=1.2.1
  • โฌ†๏ธ Updates node to v14.21.3
  • โฌ†๏ธ Updates prettier to ^2.8.8
  • โฌ†๏ธ Updates pretty-quick to ^3.3.1
  • โฌ†๏ธ Updates pygments to >=2.18.0
  • โฌ†๏ธ Updates python-markdown-math to >=0.8
  • โฌ†๏ธ Updates release-it to ^14.14.3
  • โฌ†๏ธ Updates repo-link-check to ^0.14.2
  • โฌ†๏ธ Updates stefanprodan/helm-gh-pages action to v1.7.0
  • โฌ†๏ธ Updates stylelint-scss to ^3.21.0
  • โฌ†๏ธ Updates textlint to ^12.6.1
  • โฌ†๏ธ Updates tretuna/sync-branches action to v1.4.0
  • โฌ†๏ธ Updates yaml-lint to ^1.7.0
  • โฌ†๏ธ Updates EndBug/add-and-commit action to v9
  • โฌ†๏ธ Updates LouisBrunner/checks-action action to v2
  • โฌ†๏ธ Updates Node.js to v20
  • โฌ†๏ธ Updates actions/cache action to v4
  • โฌ†๏ธ Updates actions/checkout action to v4
  • โฌ†๏ธ Updates actions/github-script action to v4
  • โฌ†๏ธ Updates actions/labeler action to v5
  • โฌ†๏ธ Updates actions/setup-node action to v4
  • โฌ†๏ธ Updates actions/setup-python action to v5
  • โฌ†๏ธ Updates actions/stale action to v9
  • โฌ†๏ธ Updates actions/upload-artifact action to v4
  • โฌ†๏ธ Updates alex to v11
  • โฌ†๏ธ Updates anchore/scan-action action to v3
  • โฌ†๏ธ Updates azure/setup-helm action to v4
  • โฌ†๏ธ Updates conventional-changelog-cli to v5
  • โฌ†๏ธ Updates cookiecutter to v2
  • โฌ†๏ธ Updates crazy-max/ghaction-github-labeler action to v5
  • โฌ†๏ธ Updates dessant/lock-threads action to v5
  • โฌ†๏ธ Updates docker/build-push-action action to v6
  • โฌ†๏ธ Updates docker/login-action action to v3
  • โฌ†๏ธ Updates docker/setup-buildx-action action to v3
  • โฌ†๏ธ Updates docker/setup-qemu-action action to v3
  • โฌ†๏ธ Updates github/codeql-action action to v3
  • โฌ†๏ธ Updates github/super-linter action to v6
  • โฌ†๏ธ Updates husky to v9
  • โฌ†๏ธ Updates lannonbr/issue-label-manager-action action to v4
  • โฌ†๏ธ Updates lint-staged to v15
  • โฌ†๏ธ Updates mkdocs-git-revision-date-localized-plugin to v1
  • โฌ†๏ธ Updates mkdocs-include-markdown-plugin to v6
  • โฌ†๏ธ Updates mkdocs-material to v9
  • โฌ†๏ธ Updates mondeja/remove-labels-gh-action action to v2
  • โฌ†๏ธ Updates node to v22
  • โฌ†๏ธ Updates peaceiris/actions-gh-pages action to v4
  • โฌ†๏ธ Updates peter-evans/create-or-update-comment action to v4
  • โฌ†๏ธ Updates peter-evans/create-pull-request action to v6
  • โฌ†๏ธ Updates pnpm/action-setup action to v4
  • โฌ†๏ธ Updates prettier to v3
  • โฌ†๏ธ Updates pretty-quick to v4
  • โฌ†๏ธ Updates prologic/action-remark-lint action to v5
  • โฌ†๏ธ Updates pymdown-extensions to v10
  • โฌ†๏ธ Updates release-it to v17
  • โฌ†๏ธ Updates remark (major) (remark-cli, remark-lint-code-block-style, remark-lint-ordered-list-marker-value, remark-validate-links)
  • โฌ†๏ธ Updates stefanzweifel/git-auto-commit-action action to v5
  • โฌ†๏ธ Updates stylelint to v16
  • โฌ†๏ธ Updates stylelint-config-standard to v36
  • โฌ†๏ธ Updates stylelint-order to v6
  • โฌ†๏ธ Updates stylelint-scss to v6
  • โฌ†๏ธ Updates textlint to v14
  • โฌ†๏ธ Updates textlint-rule-alex to v5
  • โฌ†๏ธ Updates textlint-rule-stop-words to v5
  • โฌ†๏ธ Updates textlint-rule-terminology to v5
  • โฌ†๏ธ Updates tibdex/backport action to v2
  • โฌ†๏ธ Updates ubuntu to v24
  • โฌ†๏ธ Updates wagoid/commitlint-github-action action to v6
  • โฌ†๏ธ Lock file maintenance
  • ๐Ÿ” Create all rate-limited PRs at once ๐Ÿ”

Edited/Blocked

These updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox.


Warning

Renovate failed to look up the following dependencies: Failed to look up github-tags package iterative/link-check.action.

Files affected: .github/workflows/link-check-all.yml, .github/workflows/link-check-deploy.yml


Detected dependencies

docker-compose
docker-compose.yml
dockerfile
Dockerfile
  • node 12-buster
tilt_modules/restart_process/Dockerfile
github-actions
.github/workflows/action-devto.yml
  • actions/checkout v2
  • ful1e5/TheActionDev v2
.github/workflows/add-labels.yml
.github/workflows/backport.yml
  • tibdex/backport v1
  • ubuntu 18.04
.github/workflows/blogpost-workflow.yml
  • actions/checkout v2
.github/workflows/broken-links.yml
  • actions/checkout v2
  • actions/setup-node v2.1.4
.github/workflows/build.yml
  • actions/checkout v2
  • actions/setup-node v1
  • pnpm/action-setup v1.2.1
.github/workflows/changelog.yml
  • actions/cache v2.1.4
.github/workflows/chart-release.yaml
  • actions/checkout v2
  • azure/setup-helm v1
  • helm/chart-releaser-action v1.1.0
.github/workflows/check-urls.yml
  • actions/checkout v2
  • trilom/file-changes-action v1.2.4
  • actions/upload-artifact v2
.github/workflows/claim.yml
  • actions/github-script v3.1
.github/workflows/cleanup.yml
  • kolpav/purge-artifacts-action v1
.github/workflows/close-pending.yml
.github/workflows/closing.yml
  • peter-evans/create-or-update-comment v1
  • peter-evans/create-or-update-comment v1
  • ubuntu 18.04
.github/workflows/codeql-analysis.yml
  • actions/checkout v2
  • github/codeql-action v1
  • github/codeql-action v1
.github/workflows/codespell.yaml
  • actions/checkout v2
.github/workflows/comment_on_issue.yml
  • actions/github-script v3.1
.github/workflows/comments.yml
.github/workflows/commitlint.yml
  • actions/checkout v2
  • wagoid/commitlint-github-action v2.2.5
.github/workflows/compress.yml
  • actions/checkout v2
  • peter-evans/create-pull-request v3
.github/workflows/docker.yaml
  • actions/checkout v2
  • anchore/scan-action 1.0.6
  • actions/upload-artifact v2
.github/workflows/enforce-labels.yml
  • yogevbd/enforce-label-action 2.2.1
.github/workflows/gh-pages.yml
  • JamesIves/github-pages-deploy-action 4.0.0
.github/workflows/greetings.yml
.github/workflows/helm.yml
  • actions/checkout v2
  • docker/setup-qemu-action v1
  • docker/setup-buildx-action v1
  • docker/login-action v1
  • docker/build-push-action v2
  • stefanprodan/helm-gh-pages v1.3.0
.github/workflows/label.yml
  • actions/labeler v2
.github/workflows/labels.yml
  • lannonbr/issue-label-manager-action 2.0.0
.github/workflows/labels2.yml
  • actions/checkout v2
  • crazy-max/ghaction-github-labeler v3
.github/workflows/link-check-all.yml
  • actions/checkout v2
  • iterative/link-check.action v0.7
.github/workflows/link-check-deploy.yml
  • actions/checkout v2
  • LouisBrunner/checks-action v1.0.0
  • iterative/link-check.action v0.7
  • LouisBrunner/checks-action v1.0.0
  • LouisBrunner/checks-action v1.0.0
.github/workflows/lint-pr.yml
.github/workflows/lint-test.yaml
  • actions/checkout v2
  • azure/setup-helm v1
  • actions/setup-python v2
  • helm/chart-testing-action v2.0.1
  • helm/kind-action v1.1.0
.github/workflows/lint.yml
  • actions/checkout v2
  • actions/setup-python v1
  • ubuntu 20.04
.github/workflows/linter.yml
  • actions/checkout v2
  • github/super-linter v3
.github/workflows/lock.yml
  • dessant/lock-threads v2.0.3
.github/workflows/mkdocs.yml
  • actions/checkout v2
  • actions/setup-python v2
  • actions/cache v2
  • peaceiris/actions-gh-pages v3
  • ubuntu 18.04
.github/workflows/opengraph-card.yml
  • actions/checkout v2
  • stefanzweifel/git-auto-commit-action v4
.github/workflows/pagespeed.yml
  • actions/checkout v2
  • stefanzweifel/git-auto-commit-action v4
.github/workflows/pr-helper.yml
  • Matticusau/pr-helper v1.2.5
.github/workflows/project-card-moved.yml
  • technote-space/auto-card-labeler v1
.github/workflows/release-changelog.yml
.github/workflows/release.yml
  • actions/checkout v2
  • haya14busa/action-bumpr v1
  • haya14busa/action-update-semver v1
  • haya14busa/action-cond v1
  • actions/create-release v1
  • actions/checkout v2
  • haya14busa/action-bumpr v1
.github/workflows/remove-labels.yml
  • mondeja/remove-labels-gh-action v1
  • mondeja/remove-labels-gh-action v1
  • mondeja/remove-labels-gh-action v1
.github/workflows/remove-old-artifacts.yml
  • c-hive/gha-remove-artifacts v1
.github/workflows/repo-traffic.yml
  • actions/checkout v2
  • sangonzal/repository-traffic-action v0.1.4
  • EndBug/add-and-commit v4
.github/workflows/reviewdog.yml
  • actions/checkout v2
  • prologic/action-remark-lint v2
.github/workflows/shiftleft-analysis.yml
  • actions/checkout v1
  • github/codeql-action v1
.github/workflows/spellcheck.yml
.github/workflows/stale.yml
  • actions/stale v3
.github/workflows/sync.yml
  • actions/checkout v2
  • actions/setup-node v2.1.4
  • tretuna/sync-branches 1.2.0
.github/workflows/toc.yml
  • actions/checkout v2
  • stefanzweifel/git-auto-commit-action v4
.github/workflows/unlock-reopened-issues.yml
  • Dunning-Kruger/unlock-issues v1.1
.github/workflows/version-update.yml
  • actions/checkout v2
  • stefanzweifel/git-auto-commit-action v4
.github/workflows/welcome_contributor.yml
  • actions/github-script v3.1
.github/workflows/yaml-lint.yml
  • actions/checkout v2.3.4
  • ibiqlik/action-yamllint v3.0.2
helm-values
charts/values.yaml
npm
package.json
  • alex ^9.1.0
  • conventional-changelog-cli ^2.1.1
  • dockerfile_lint ^0.3.4
  • husky ^7.0.1
  • git-cz ^4.7.6
  • jsonlint ^1.6.3
  • license-checker ^25.0.1
  • lint-staged ^11.0.1
  • markdown-link-check ^3.8.7
  • markdownlint-cli ^0.27.1
  • stylelint ~13.13.1
  • stylelint-config-standard ^22.0.0
  • stylelint-order ^4.1.0
  • stylelint-scss ^3.20.1
  • prettier ^2.3.2
  • pretty-quick ^3.1.1
  • release-it ^14.10.0
  • remark-cli ^9.0.0
  • remark-lint-code-block-style ^2.0.1
  • remark-lint-ordered-list-marker-value ^2.0.1
  • remark-preset-davidtheclark ^0.12.0
  • remark-validate-links ^10.0.4
  • repo-link-check ^0.7.1
  • textlint ^12.0.2
  • textlint-rule-alex ^3.0.0
  • textlint-rule-common-misspellings ^1.0.1
  • textlint-rule-en-capitalization ^2.0.2
  • textlint-rule-stop-words ^2.0.9
  • textlint-rule-terminology ^2.1.5
  • textlint-rule-write-good ^2.0.0
  • validate-commit-msg ^2.14.0
  • yaml-lint ^1.2.4
  • node >= 12.x
nvm
.nvmrc
  • node 14.16.0
pip_requirements
docs/requirements.txt
  • click-man >=0.4.1
  • mkdocs >=1.2
  • pygments >=2.4
  • mkdocs-material >=7.1.2
  • markdown >=3.2
  • markdown-checklist >=0.4.1
  • fontawesome-markdown >=0.2.6
  • markdown-include >=0.6.0
  • pymdown-extensions >=8.2
  • python-markdown-math >=0.6
  • mkdocs-material-extensions >=1.0
  • mkdocs-git-revision-date-localized-plugin >=0.9.2
  • mkdocs-awesome-pages-plugin >=2.5.0
  • mdx-truly-sane-lists >=1.2
  • mkdocs-include-markdown-plugin >=3.2.1
  • mkdocs-redirects >=1.0.3
  • smarty >=0.3.3
  • dumb-init >=1.2.5
  • cookiecutter >=1.7.3

  • Check this box to trigger a request for Renovate to run again on this repository

CVE-2021-23358 (High) detected in underscore-1.6.0.tgz

CVE-2021-23358 - High Severity Vulnerability

Vulnerable Library - underscore-1.6.0.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/underscore/package.json

Dependency Hierarchy:

  • jsonlint-1.6.3.tgz (Root Library)
    • nomnom-1.8.1.tgz
      • โŒ underscore-1.6.0.tgz (Vulnerable Library)

Found in HEAD commit: 279e69e2482fcf69783e952d9efcf4492d91ae3c

Found in base branch: master

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2


Step up your Open Source Security Game with WhiteSource here

CVE-2018-3721 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-3721 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: f91c87f9fd3b11593751bed38d3c575b3db5f111

Found in base branch: master

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution: 4.17.5


Step up your Open Source Security Game with WhiteSource here

CVE-2020-8203 (High) detected in lodash-2.4.2.tgz

CVE-2020-8203 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: f91c87f9fd3b11593751bed38d3c575b3db5f111

Found in base branch: master

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-10-21

Fix Resolution: lodash - 4.17.19


Step up your Open Source Security Game with WhiteSource here

CVE-2018-16487 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-16487 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: f91c87f9fd3b11593751bed38d3c575b3db5f111

Found in base branch: master

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2019-1010266 (Medium) detected in lodash-2.4.2.tgz

CVE-2019-1010266 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: e7381166be987377e72a21d5167e1b6ca947f502

Found in base branch: master

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2018-16487 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-16487 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: e7381166be987377e72a21d5167e1b6ca947f502

Found in base branch: master

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2021-33623 (High) detected in trim-newlines-1.0.0.tgz

CVE-2021-33623 - High Severity Vulnerability

Vulnerable Library - trim-newlines-1.0.0.tgz

Trim newlines from the start and/or end of a string

Library home page: https://registry.npmjs.org/trim-newlines/-/trim-newlines-1.0.0.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/get-pkg-repo/node_modules/trim-newlines/package.json

Dependency Hierarchy:

  • conventional-changelog-cli-2.1.1.tgz (Root Library)
    • conventional-changelog-3.1.24.tgz
      • conventional-changelog-core-4.2.2.tgz
        • get-pkg-repo-1.4.0.tgz
          • meow-3.7.0.tgz
            • โŒ trim-newlines-1.0.0.tgz (Vulnerable Library)

Found in HEAD commit: e7381166be987377e72a21d5167e1b6ca947f502

Found in base branch: master

Vulnerability Details

The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.

Publish Date: 2021-05-28

URL: CVE-2021-33623

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33623

Release Date: 2021-05-28

Fix Resolution: trim-newlines - 3.0.1, 4.0.1


Step up your Open Source Security Game with WhiteSource here

CVE-2020-7753 (High) detected in trim-0.0.1.tgz

CVE-2020-7753 - High Severity Vulnerability

Vulnerable Library - trim-0.0.1.tgz

Trim string whitespace

Library home page: https://registry.npmjs.org/trim/-/trim-0.0.1.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/trim/package.json

Dependency Hierarchy:

  • alex-9.1.0.tgz (Root Library)
    • remark-parse-8.0.3.tgz
      • โŒ trim-0.0.1.tgz (Vulnerable Library)

Found in HEAD commit: 5fc5f963f2befb187f903259f7dee376f5dc3628

Found in base branch: master

Vulnerability Details

All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

Publish Date: 2020-10-27

URL: CVE-2020-7753

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: component/trim#8

Release Date: 2020-10-27

Fix Resolution: trim - 0.0.3


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23358 (High) detected in underscore-1.6.0.tgz

CVE-2021-23358 - High Severity Vulnerability

Vulnerable Library - underscore-1.6.0.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/underscore/package.json

Dependency Hierarchy:

  • jsonlint-1.6.3.tgz (Root Library)
    • nomnom-1.8.1.tgz
      • โŒ underscore-1.6.0.tgz (Vulnerable Library)

Found in HEAD commit: 44ad98844a803d44f5b497fa1907ae9b9dadfaf9

Found in base branch: master

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23358 (High) detected in underscore-1.6.0.tgz

CVE-2021-23358 - High Severity Vulnerability

Vulnerable Library - underscore-1.6.0.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/underscore/package.json

Dependency Hierarchy:

  • jsonlint-1.6.3.tgz (Root Library)
    • nomnom-1.8.1.tgz
      • โŒ underscore-1.6.0.tgz (Vulnerable Library)

Found in HEAD commit: c6f7159e9aa44b9aa1a20b59d61588aee56ee7b8

Found in base branch: master

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2


Step up your Open Source Security Game with WhiteSource here

CVE-2020-8203 (High) detected in lodash-2.4.2.tgz

CVE-2020-8203 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 44ad98844a803d44f5b497fa1907ae9b9dadfaf9

Found in base branch: master

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-10-21

Fix Resolution: lodash - 4.17.19


Step up your Open Source Security Game with WhiteSource here

CVE-2019-1010266 (Medium) detected in lodash-2.4.2.tgz

CVE-2019-1010266 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 5fc5f963f2befb187f903259f7dee376f5dc3628

Found in base branch: master

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2020-7753 (High) detected in trim-0.0.1.tgz

CVE-2020-7753 - High Severity Vulnerability

Vulnerable Library - trim-0.0.1.tgz

Trim string whitespace

Library home page: https://registry.npmjs.org/trim/-/trim-0.0.1.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/trim/package.json

Dependency Hierarchy:

  • remark-preset-davidtheclark-0.12.0.tgz (Root Library)
    • remark-cli-7.0.1.tgz
      • remark-11.0.2.tgz
        • remark-parse-7.0.2.tgz
          • โŒ trim-0.0.1.tgz (Vulnerable Library)

Found in HEAD commit: f91c87f9fd3b11593751bed38d3c575b3db5f111

Found in base branch: master

Vulnerability Details

All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

Publish Date: 2020-10-27

URL: CVE-2020-7753

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: component/trim#8

Release Date: 2020-10-27

Fix Resolution: trim - 0.0.3


Step up your Open Source Security Game with WhiteSource here

CVE-2019-10744 (High) detected in lodash-2.4.2.tgz

CVE-2019-10744 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: ead7c7bfe90e64648164c715d8c8a4d50f95aa0b

Found in base branch: master

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-08

Fix Resolution: lodash-4.17.12, lodash-amd-4.17.12, lodash-es-4.17.12, lodash.defaultsdeep-4.6.1, lodash.merge- 4.6.2, lodash.mergewith-4.6.2, lodash.template-4.5.0


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23337 (High) detected in lodash-2.4.2.tgz

CVE-2021-23337 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: f91c87f9fd3b11593751bed38d3c575b3db5f111

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@3469357

Release Date: 2021-02-15

Fix Resolution: lodash - 4.17.21


Step up your Open Source Security Game with WhiteSource here

CVE-2018-16487 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-16487 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 5fc5f963f2befb187f903259f7dee376f5dc3628

Found in base branch: master

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23358 (High) detected in underscore-1.6.0.tgz

CVE-2021-23358 - High Severity Vulnerability

Vulnerable Library - underscore-1.6.0.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/underscore/package.json

Dependency Hierarchy:

  • jsonlint-1.6.3.tgz (Root Library)
    • nomnom-1.8.1.tgz
      • โŒ underscore-1.6.0.tgz (Vulnerable Library)

Found in HEAD commit: f91c87f9fd3b11593751bed38d3c575b3db5f111

Found in base branch: master

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2


Step up your Open Source Security Game with WhiteSource here

CVE-2020-7753 (High) detected in trim-0.0.1.tgz

CVE-2020-7753 - High Severity Vulnerability

Vulnerable Library - trim-0.0.1.tgz

Trim string whitespace

Library home page: https://registry.npmjs.org/trim/-/trim-0.0.1.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/trim/package.json

Dependency Hierarchy:

  • textlint-rule-alex-1.3.1.tgz (Root Library)
    • alex-5.1.0.tgz
      • remark-parse-4.0.0.tgz
        • โŒ trim-0.0.1.tgz (Vulnerable Library)

Found in HEAD commit: ead7c7bfe90e64648164c715d8c8a4d50f95aa0b

Found in base branch: master

Vulnerability Details

All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

Publish Date: 2020-10-27

URL: CVE-2020-7753

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: component/trim#8

Release Date: 2020-10-27

Fix Resolution: trim - 0.0.3


Step up your Open Source Security Game with WhiteSource here

CVE-2018-16487 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-16487 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 44ad98844a803d44f5b497fa1907ae9b9dadfaf9

Found in base branch: master

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23425 (Medium) detected in trim-off-newlines-1.0.1.tgz

CVE-2021-23425 - Medium Severity Vulnerability

Vulnerable Library - trim-off-newlines-1.0.1.tgz

Similar to String#trim() but removes only newlines

Library home page: https://registry.npmjs.org/trim-off-newlines/-/trim-off-newlines-1.0.1.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/trim-off-newlines/package.json

Dependency Hierarchy:

  • conventional-changelog-cli-2.1.1.tgz (Root Library)
    • conventional-changelog-3.1.24.tgz
      • conventional-changelog-core-4.2.3.tgz
        • conventional-commits-parser-3.2.1.tgz
          • โŒ trim-off-newlines-1.0.1.tgz (Vulnerable Library)

Found in HEAD commit: 44ad98844a803d44f5b497fa1907ae9b9dadfaf9

Found in base branch: master

Vulnerability Details

All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service (ReDoS) via string processing.

Publish Date: 2021-08-18

URL: CVE-2021-23425

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.


Step up your Open Source Security Game with WhiteSource here

CVE-2019-1010266 (Medium) detected in lodash-2.4.2.tgz

CVE-2019-1010266 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: f91c87f9fd3b11593751bed38d3c575b3db5f111

Found in base branch: master

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23337 (High) detected in lodash-2.4.2.tgz

CVE-2021-23337 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: e7381166be987377e72a21d5167e1b6ca947f502

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@3469357

Release Date: 2021-02-15

Fix Resolution: lodash - 4.17.21


Step up your Open Source Security Game with WhiteSource here

CVE-2020-7753 (High) detected in trim-0.0.1.tgz

CVE-2020-7753 - High Severity Vulnerability

Vulnerable Library - trim-0.0.1.tgz

Trim string whitespace

Library home page: https://registry.npmjs.org/trim/-/trim-0.0.1.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/trim/package.json

Dependency Hierarchy:

  • remark-preset-davidtheclark-0.12.0.tgz (Root Library)
    • remark-cli-7.0.1.tgz
      • remark-11.0.2.tgz
        • remark-parse-7.0.2.tgz
          • โŒ trim-0.0.1.tgz (Vulnerable Library)

Found in HEAD commit: 279e69e2482fcf69783e952d9efcf4492d91ae3c

Found in base branch: master

Vulnerability Details

All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

Publish Date: 2020-10-27

URL: CVE-2020-7753

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: component/trim#8

Release Date: 2020-10-27

Fix Resolution: trim - 0.0.3


Step up your Open Source Security Game with WhiteSource here

CVE-2020-8203 (High) detected in lodash-2.4.2.tgz

CVE-2020-8203 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: e7381166be987377e72a21d5167e1b6ca947f502

Found in base branch: master

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-10-21

Fix Resolution: lodash - 4.17.19


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23358 (High) detected in underscore-1.6.0.tgz

CVE-2021-23358 - High Severity Vulnerability

Vulnerable Library - underscore-1.6.0.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/underscore/package.json

Dependency Hierarchy:

  • jsonlint-1.6.3.tgz (Root Library)
    • nomnom-1.8.1.tgz
      • โŒ underscore-1.6.0.tgz (Vulnerable Library)

Found in HEAD commit: e7381166be987377e72a21d5167e1b6ca947f502

Found in base branch: master

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2


Step up your Open Source Security Game with WhiteSource here

CVE-2021-33623 (High) detected in trim-newlines-1.0.0.tgz

CVE-2021-33623 - High Severity Vulnerability

Vulnerable Library - trim-newlines-1.0.0.tgz

Trim newlines from the start and/or end of a string

Library home page: https://registry.npmjs.org/trim-newlines/-/trim-newlines-1.0.0.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/get-pkg-repo/node_modules/trim-newlines/package.json,android-patterns/node_modules/alex/node_modules/trim-newlines/package.json

Dependency Hierarchy:

  • textlint-rule-alex-1.3.1.tgz (Root Library)
    • alex-5.1.0.tgz
      • meow-3.7.0.tgz
        • โŒ trim-newlines-1.0.0.tgz (Vulnerable Library)

Found in HEAD commit: ead7c7bfe90e64648164c715d8c8a4d50f95aa0b

Found in base branch: master

Vulnerability Details

The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.

Publish Date: 2021-05-28

URL: CVE-2021-33623

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33623

Release Date: 2021-05-28

Fix Resolution: trim-newlines - 3.0.1, 4.0.1


Step up your Open Source Security Game with WhiteSource here

CVE-2020-7753 (High) detected in trim-0.0.1.tgz

CVE-2020-7753 - High Severity Vulnerability

Vulnerable Library - trim-0.0.1.tgz

Trim string whitespace

Library home page: https://registry.npmjs.org/trim/-/trim-0.0.1.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/trim/package.json

Dependency Hierarchy:

  • remark-preset-davidtheclark-0.12.0.tgz (Root Library)
    • remark-cli-7.0.1.tgz
      • remark-11.0.2.tgz
        • remark-parse-7.0.2.tgz
          • โŒ trim-0.0.1.tgz (Vulnerable Library)

Found in HEAD commit: c6f7159e9aa44b9aa1a20b59d61588aee56ee7b8

Found in base branch: master

Vulnerability Details

All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

Publish Date: 2020-10-27

URL: CVE-2020-7753

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: component/trim#8

Release Date: 2020-10-27

Fix Resolution: trim - 0.0.3


Step up your Open Source Security Game with WhiteSource here

CVE-2021-33623 (High) detected in trim-newlines-1.0.0.tgz

CVE-2021-33623 - High Severity Vulnerability

Vulnerable Library - trim-newlines-1.0.0.tgz

Trim newlines from the start and/or end of a string

Library home page: https://registry.npmjs.org/trim-newlines/-/trim-newlines-1.0.0.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/get-pkg-repo/node_modules/trim-newlines/package.json

Dependency Hierarchy:

  • conventional-changelog-cli-2.1.1.tgz (Root Library)
    • conventional-changelog-3.1.24.tgz
      • conventional-changelog-core-4.2.2.tgz
        • get-pkg-repo-1.4.0.tgz
          • meow-3.7.0.tgz
            • โŒ trim-newlines-1.0.0.tgz (Vulnerable Library)

Found in HEAD commit: f91c87f9fd3b11593751bed38d3c575b3db5f111

Found in base branch: master

Vulnerability Details

The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.

Publish Date: 2021-05-28

URL: CVE-2021-33623

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33623

Release Date: 2021-05-28

Fix Resolution: trim-newlines - 3.0.1, 4.0.1


Step up your Open Source Security Game with WhiteSource here

CVE-2018-3721 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-3721 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: ead7c7bfe90e64648164c715d8c8a4d50f95aa0b

Found in base branch: master

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution: 4.17.5


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23337 (High) detected in lodash-2.4.2.tgz

CVE-2021-23337 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 44ad98844a803d44f5b497fa1907ae9b9dadfaf9

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@3469357

Release Date: 2021-02-15

Fix Resolution: lodash - 4.17.21


Step up your Open Source Security Game with WhiteSource here

CVE-2019-10744 (High) detected in lodash-2.4.2.tgz

CVE-2019-10744 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: f91c87f9fd3b11593751bed38d3c575b3db5f111

Found in base branch: master

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-08

Fix Resolution: lodash-4.17.12, lodash-amd-4.17.12, lodash-es-4.17.12, lodash.defaultsdeep-4.6.1, lodash.merge- 4.6.2, lodash.mergewith-4.6.2, lodash.template-4.5.0


Step up your Open Source Security Game with WhiteSource here

CVE-2020-7753 (High) detected in trim-0.0.1.tgz

CVE-2020-7753 - High Severity Vulnerability

Vulnerable Library - trim-0.0.1.tgz

Trim string whitespace

Library home page: https://registry.npmjs.org/trim/-/trim-0.0.1.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/trim/package.json

Dependency Hierarchy:

  • alex-9.1.0.tgz (Root Library)
    • remark-parse-8.0.3.tgz
      • โŒ trim-0.0.1.tgz (Vulnerable Library)

Found in HEAD commit: 44ad98844a803d44f5b497fa1907ae9b9dadfaf9

Found in base branch: master

Vulnerability Details

All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

Publish Date: 2020-10-27

URL: CVE-2020-7753

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: component/trim#8

Release Date: 2020-10-27

Fix Resolution: trim - 0.0.3


Step up your Open Source Security Game with WhiteSource here

CVE-2020-8203 (High) detected in lodash-2.4.2.tgz

CVE-2020-8203 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 5fc5f963f2befb187f903259f7dee376f5dc3628

Found in base branch: master

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-10-21

Fix Resolution: lodash - 4.17.19


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23337 (High) detected in lodash-2.4.2.tgz

CVE-2021-23337 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: ead7c7bfe90e64648164c715d8c8a4d50f95aa0b

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@3469357

Release Date: 2021-02-15

Fix Resolution: lodash - 4.17.21


Step up your Open Source Security Game with WhiteSource here

CVE-2018-16487 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-16487 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: ead7c7bfe90e64648164c715d8c8a4d50f95aa0b

Found in base branch: master

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2019-1010266 (Medium) detected in lodash-2.4.2.tgz

CVE-2019-1010266 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 44ad98844a803d44f5b497fa1907ae9b9dadfaf9

Found in base branch: master

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2020-8203 (High) detected in lodash-2.4.2.tgz

CVE-2020-8203 - High Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: ead7c7bfe90e64648164c715d8c8a4d50f95aa0b

Found in base branch: master

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-10-21

Fix Resolution: lodash - 4.17.19


Step up your Open Source Security Game with WhiteSource here

CVE-2019-1010266 (Medium) detected in lodash-2.4.2.tgz

CVE-2019-1010266 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: ead7c7bfe90e64648164c715d8c8a4d50f95aa0b

Found in base branch: master

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution: 4.17.11


Step up your Open Source Security Game with WhiteSource here

CVE-2020-7753 (High) detected in trim-0.0.1.tgz

CVE-2020-7753 - High Severity Vulnerability

Vulnerable Library - trim-0.0.1.tgz

Trim string whitespace

Library home page: https://registry.npmjs.org/trim/-/trim-0.0.1.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/trim/package.json

Dependency Hierarchy:

  • remark-preset-davidtheclark-0.12.0.tgz (Root Library)
    • remark-cli-7.0.1.tgz
      • remark-11.0.2.tgz
        • remark-parse-7.0.2.tgz
          • โŒ trim-0.0.1.tgz (Vulnerable Library)

Found in HEAD commit: e7381166be987377e72a21d5167e1b6ca947f502

Found in base branch: master

Vulnerability Details

All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

Publish Date: 2020-10-27

URL: CVE-2020-7753

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: component/trim#8

Release Date: 2020-10-27

Fix Resolution: trim - 0.0.3


Step up your Open Source Security Game with WhiteSource here

CVE-2018-3721 (Medium) detected in lodash-2.4.2.tgz

CVE-2018-3721 - Medium Severity Vulnerability

Vulnerable Library - lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: android-patterns/package.json

Path to vulnerable library: android-patterns/node_modules/dockerfile_lint/node_modules/lodash/package.json

Dependency Hierarchy:

  • dockerfile_lint-0.3.4.tgz (Root Library)
    • โŒ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 5fc5f963f2befb187f903259f7dee376f5dc3628

Found in base branch: master

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution: 4.17.5


Step up your Open Source Security Game with WhiteSource here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.