4 matches found
@angular/bazel (>=5.0.0-beta.5, <=7.0.0), @atomist/sample-sdm (>=0.5.1-atomist-update-latest-1540938130032.20181101043939, <=0.5.1-master.20181101044648) +123 more potentially affected by CVE-2018-3738 via protobufjs (>=5.0.0, <=5.0.2)
protobufjs NPM version =5.0.0, =5.0.0-beta.5, =0.5.1-atomist-update-latest-1540938130032.20181101043939, =0.2.2-20180615211533, =0.2.4-20180621213746, =0.1.0-20180815155955, =0.0.6, =1.2.1, =1.0.2, =5.0.1, =1.3.1, =0.0.7, =1.3.0, =0.0.1, =0.0.1, =0.0.12 and more Source cves: CVE-2018-3738 Source...
@accordproject/cicero-cli (>=0.2.48, <=0.3.16), @accordproject/cicero-common (>=0.2.50, <=0.2.54) +114 more potentially affected by CVE-2018-3738 via protobufjs (>=6.1.0, <=6.8.5)
protobufjs NPM version =6.1.0, =0.2.48, =0.2.50, =0.2.46, =0.2.46, =0.2.46, =0.0.37, =0.0.36, =0.0.37, =0.1.0, =1.0.0, =2.2.0 - @ibmblockchain/composer-playground 0.16.2 and more Source cves: CVE-2018-3738 Source advisory: OSV:GHSA-762F-C2WG-M8C8...
CVE-2018-3738
protobufjs is affected by a Denial of Service via a regular expression denial of service when parsing crafted invalid .proto files. Affected versions are prior to 5.0.3 and prior to 6.8.6. Remediation: upgrade to protobufjs 5.0.3 or later, or 6.8.6 or later. The issue arises from ReDoS during par...
