Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[CVE-2022-37603]/ReDoS found in interpolateName.js #213

Closed
secdevlpr26 opened this issue Oct 5, 2022 · 9 comments
Closed

[CVE-2022-37603]/ReDoS found in interpolateName.js #213

secdevlpr26 opened this issue Oct 5, 2022 · 9 comments

Comments

@secdevlpr26
Copy link

A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
The prototype pollution vulnerability can be mitigated with several best practices described here: https://learn.snyk.io/lessons/prototype-pollution/javascript/

@alexander-akait
Copy link
Member

Please migrate to 3 version, 2 version is deprecated and doesn't supported, thank you

@LucasLopesr
Copy link

same problem in version 3.2.0

@Ginxo
Copy link

Ginxo commented Nov 8, 2022

@JSMike @alexander-akait
what about this PR #217 where v2 is also fixed?
Version 2.0.3 already published https://www.npmjs.com/package/loader-utils/v/2.0.3
Thanks

@TomasHofman
Copy link

PR #217 doesn't fix this vulnerability. It's for CVE-2022-37601.

@carnil
Copy link

carnil commented Nov 14, 2022

#225 fixes as well this issue for the 2.0.x version?

@alexander-akait
Copy link
Member

Yes, backported to all versions (except 0.x)

@carnil
Copy link

carnil commented Nov 15, 2022 via email

@esther0012
Copy link

How can I change the version?

@alexander-akait
Copy link
Member

alexander-akait commented Nov 20, 2022

Just update transitive deps - rm -rf package-lock.json && rm -rf node_modules && npm i (note - it will update all transitive deps)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

7 participants