Known vulnerability in d3-colour: Regular Expression Denial of Service (ReDoS)
See original GitHub issueI am submitting a…
- Feature request
- Design defect
- Source code defect
- Demo/documentation defect
- Other
charts version:
0.41.68
Issue description
As flagged by Snyk when we use Carbon in our product.
Issues to fix by upgrading:
Upgrade d3@5.16.0 to d3@7.0.0 to fix
✗ Regular Expression Denial of Service (ReDoS) (new) [Medium Severity][https://snyk.io/vuln/SNYK-JS-D3COLOR-1076592] in d3-color@1.4.1
introduced by d3@5.16.0 > d3-color@1.4.1
See https://snyk.io/vuln/SNYK-JS-D3COLOR-1076592 for details. It can be fixed by upgrading to later versions of d3
Steps to produce the issue
Run Snyk against a Carbon charts application
Current behavior
Expected behavior
Screenshot or recording
Issue Analytics
- State:
- Created 2 years ago
- Comments:7 (4 by maintainers)
Top Results From Across the Web
Regular Expression Denial of Service (ReDoS) in d3-color
Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the rgb() and hrc() functions. PoC by ...
Read more >Regular expression Denial of Service - ReDoS
The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may ......
Read more >GHSA-36jr-mh4h-2g58 - d3-color vulnerable to ReDoS - GitHub
0 are vulnerable to a Regular expression Denial of Service. This issue has been patched in version 3.1.0. There are no known workarounds....
Read more >Vulnerability 212233 - CERT Civis.NET
Vulnerability Summary for 212233 - d3-color is vulnerable to a denial of service, caused by improper input validation.
Read more >ReDoS - Wikipedia
A regular expression denial of service (ReDoS) is an algorithmic complexity attack that produces a denial-of-service by providing a regular expression ...
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Hi, I believe this was addressed ~26 days ago…
We migrated to d3v7 which uses updated versions of d3’s sub-packages…
Again, d3 is only a peer & dev-dependency in Carbon Charts… users have to manually install it in their apps, and they can choose the version of d3 that they install, and it seems like d3v7 depends on d3-color v3…
https://unpkg.com/browse/d3@7.0.0/package.json