Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Missing advisories for npm packages from CVE-2024-4067 #4548

Open
aarongoldenthal opened this issue Jun 23, 2024 · 1 comment
Open

Missing advisories for npm packages from CVE-2024-4067 #4548

aarongoldenthal opened this issue Jun 23, 2024 · 1 comment

Comments

@aarongoldenthal
Copy link

The npm packages braces and micromatch have been reported as susceptible to CVE-2024-4067. While the CVE and advisory are officially "unreviewed", the vulnerabilities have been clearly established and reported to the maintainers with no response here and here.

Given the current state of NVD data and the lengthy backlog of CVE's needing review, this advisory should be promoted and mapped to the applicable npm packages given the additional supporting data (it is currently not mapped to any npm packages, which is inaccurate).
@aarongoldenthal aarongoldenthal closed this as not planned Won't fix, can't repro, duplicate, stale Jun 30, 2024
@aarongoldenthal
Copy link
Author

After further review, while there seems to be some questions still floating around about the viability of this CVE, the packages themselves were updated to protect against it, so not sure why they should not be mapped to this advisory.
@An010299 An010299 mentioned this issue Jul 3, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
1 participant
@aarongoldenthal