[Security] DOS vulnerability in requirement ws@1.1.5

See original GitHub issue

Description

https://nodesecurity.io/advisories/550

What type of issue is this? (place an `x` in one of the `[ ]`)

bug
enhancement (feature request)
question
documentation related
testing related
discussion
security

Requirements (place an `x` in each of the `[ ]`)

I’ve read and understood the Contributing guidelines and have done my best effort to follow them.
I’ve read and agree to the Code of Conduct.
I’ve searched for any related issues and avoided creating a duplicate issue.

Bug Report

The ws module needs to be updated to >= 3.3.1

Reproducible in:

@slack/client version: 3.14.1

node version:

OS version(s): 6.9.1 (all)

Steps to reproduce:

Expected result:

What you expected to happen

Actual result:

What actually happened

Attachments:

Logs, screenshots, screencast, sample project, funny gif, etc.

Issue Analytics

State:
Created 6 years ago
Reactions:1
Comments:8 (1 by maintainers)

Top GitHub Comments

1reaction

gunarcommented, Nov 10, 2017

I’ve asked nsp to update the advisory regarding 1.1.15, just in case. Not sure their format accepts such conditions (>=3.3.1 or>=1.1.5).

1reaction

lpincacommented, Nov 10, 2017

@aoberoi I agree on the major version bump. ws >= 2 only supports Node.js 4 or greater.

Top Results From Across the Web

CVE-2022-0028 PAN-OS: Reflected Amplification Denial-of ...

The misconfiguration exposes the vulnerability which enables remote network based attackers to conduct reflected denial of service (RDoS) ...

VMSA-2022-0007 - VMware

An uncontrolled search path vulnerability in VMware Tools for Windows was privately reported to VMware. Updates are available to remediate this ...

Accepted Manuscript

for SDN based on risk assessment. The proposed security function determines threat value of different SDN entities by analyzing vulnerability and exposure ......

Quantifying and managing the risk of... breaches to the supply chain

This thesis proposes a methodology for quantifying information security ... If there is no exploit available, the skill level required would be very...

Behavioural Correlation for Malicious Bot Detection - CiteSeerX

rithms have been used in this work to achieve the required task. ... coming threat to Internet security due to the fact that...