Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update dependency elliptic to v6.5.7 #318

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Update dependency elliptic to v6.5.7

bb5db68
Select commit
Loading
Failed to load commit list.
Open

Update dependency elliptic to v6.5.7 #318

Update dependency elliptic to v6.5.7
bb5db68
Select commit
Loading
Failed to load commit list.
Mend for GitHub.com / WhiteSource Security Check failed Oct 26, 2024 in 4m 57s

Security Report

You have successfully remediated 281 vulnerabilities, but introduced 14 new vulnerabilities in this branch.

❌ New vulnerabilities:

CVE Severity CVSS Score Vulnerable Library Suggested Fix Issue
CVE-2021-42740

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

-> uswds-1.6.10.tgz (Root Library)

   -> browserify-13.3.0.tgz

     -> ❌ shell-quote-1.7.2.tgz (Vulnerable Library)

Critical 9.8 shell-quote-1.7.2.tgz Upgrade to version: shell-quote - 1.7.3 None
WS-2020-0042

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

-> uswds-1.6.10.tgz (Root Library)

   -> browserify-13.3.0.tgz

     -> module-deps-4.1.1.tgz

       -> detective-4.7.1.tgz

         -> ❌ acorn-5.7.4.tgz (Vulnerable Library)

High 7.5 acorn-5.7.4.tgz Upgrade to version: acorn - 5.7.4,6.4.1,7.1.1 #7
CVE-2024-48948

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

-> uswds-1.6.10.tgz (Root Library)

   -> browserify-13.3.0.tgz

     -> crypto-browserify-3.12.0.tgz

       -> browserify-sign-4.0.4.tgz

         -> ❌ elliptic-6.5.7.tgz (Vulnerable Library)

High 7.5 elliptic-6.5.7.tgz #337
CVE-2021-33623

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

-> mapbox-sdk-0.10.0.tgz (Root Library)

   -> polyline-1.1.0.tgz

     -> meow-5.0.0.tgz

       -> ❌ trim-newlines-2.0.0.tgz (Vulnerable Library)

High 7.5 trim-newlines-2.0.0.tgz Upgrade to version: trim-newlines - 3.0.1, 4.0.1 #86
CVE-2021-23518

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

-> uswds-1.6.10.tgz (Root Library)

   -> browserify-13.3.0.tgz

     -> ❌ cached-path-relative-1.0.2.tgz (Vulnerable Library)

High 7.3 cached-path-relative-1.0.2.tgz Upgrade to version: cached-path-relative - 1.1.0 None
CVE-2023-44270

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

-> web-components-0.2.2.tgz (Root Library)

   -> postcss-2.0.0.tgz

     -> ❌ postcss-8.2.6.tgz (Vulnerable Library)

Medium 5.3 postcss-8.2.6.tgz Upgrade to version: postcss - 8.4.31 #308
CVE-2022-21670

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

-> metalsmith-markdownit-0.4.0.tgz (Root Library)

   -> ❌ markdown-it-7.0.1.tgz (Vulnerable Library)

Medium 5.3 markdown-it-7.0.1.tgz Upgrade to version: markdown-it - 12.3.2 #122
CVE-2021-23382

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

-> web-components-0.2.2.tgz (Root Library)

   -> postcss-2.0.0.tgz

     -> ❌ postcss-8.2.6.tgz (Vulnerable Library)

Medium 5.3 postcss-8.2.6.tgz Upgrade to version: postcss - 8.2.13 #78
CVE-2021-23368

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

-> web-components-0.2.2.tgz (Root Library)

   -> postcss-2.0.0.tgz

     -> ❌ postcss-8.2.6.tgz (Vulnerable Library)

Medium 5.3 postcss-8.2.6.tgz Upgrade to version: postcss -8.2.10 #77
CVE-2020-7608

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

-> uswds-1.6.10.tgz (Root Library)

   -> yargs-12.0.5.tgz

     -> ❌ yargs-parser-11.1.1.tgz (Vulnerable Library)

Medium 5.3 yargs-parser-11.1.1.tgz Upgrade to version: 5.0.1;13.1.2;15.0.1;18.1.1 #68
CVE-2020-7608

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

-> mapbox-sdk-0.10.0.tgz (Root Library)

   -> polyline-1.1.0.tgz

     -> meow-5.0.0.tgz

       -> ❌ yargs-parser-10.1.0.tgz (Vulnerable Library)

Medium 5.3 yargs-parser-10.1.0.tgz Upgrade to version: 5.0.1;13.1.2;15.0.1;18.1.1 #68
CVE-2024-43800

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

-> express-4.17.1.tgz (Root Library)

   -> ❌ serve-static-1.14.1.tgz (Vulnerable Library)

Medium 5.0 serve-static-1.14.1.tgz Upgrade to version: serve-static - 1.16.0,2.1.0 None
CVE-2021-23566

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

-> web-components-0.2.2.tgz (Root Library)

   -> postcss-2.0.0.tgz

     -> postcss-8.2.6.tgz

       -> ❌ nanoid-3.1.20.tgz (Vulnerable Library)

Medium 4.0 nanoid-3.1.20.tgz Upgrade to version: nanoid - 3.1.31 #126
CVE-2021-23358

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

-> metalsmith-sitemap-1.2.2.tgz (Root Library)

   -> sitemap-1.13.0.tgz

     -> ❌ underscore-1.9.1.tgz (Vulnerable Library)

Low 3.3 underscore-1.9.1.tgz Upgrade to version: underscore - 1.12.1,1.13.0-2 #60

✔️ Remediated vulnerabilities:

CVE Vulnerable Library
CVE-2021-32640 ws-5.2.2.tgz
CVE-2022-24773 node-forge-0.10.0.tgz
CVE-2021-23386 dns-packet-1.3.1.tgz
CVE-2021-32803 tar-2.2.2.tgz
CVE-2024-28849 follow-redirects-1.13.1.tgz
CVE-2024-33883 ejs-2.5.7.tgz
CVE-2022-24785 moment-2.29.1.tgz
CVE-2021-3803 nth-check-1.0.1.tgz
WS-2020-0344 is-my-json-valid-2.20.0.tgz
CVE-2018-19797 node-sass-4.14.1.tgz
CVE-2024-4067 micromatch-3.1.9.tgz
WS-2021-0153 ejs-2.6.1.tgz
CVE-2022-24771 node-forge-0.10.0.tgz
CVE-2018-20190 node-sass-4.14.1.tgz
CVE-2024-28863 tar-6.0.2.tgz
CVE-2022-37603 loader-utils-2.0.0.tgz
CVE-2021-3807 ansi-regex-4.1.0.tgz
WS-2018-0347 eslint-2.13.1.tgz
CVE-2020-11023 jquery-1.8.2.min.js
CVE-2020-13619 locutus-2.0.11.tgz
CVE-2023-26136 tough-cookie-3.0.1.tgz
CVE-2024-21536 http-proxy-middleware-0.19.1.tgz
CVE-2022-0512 url-parse-1.4.7.tgz
CVE-2023-28155 request-2.88.5.tgz
CVE-2022-29078 ejs-2.6.1.tgz
CVE-2022-37601 loader-utils-1.1.0.tgz
CVE-2018-16489 just-extend-1.1.22.tgz
CVE-2022-25883 semver-5.0.3.tgz
WS-2022-0008 node-forge-0.10.0.tgz
CVE-2020-7751 pathval-1.1.0.tgz
CVE-2021-37701 tar-6.0.2.tgz
CVE-2021-32803 tar-4.4.2.tgz
CVE-2022-0639 url-parse-1.4.7.tgz
CVE-2018-11694 node-sass-4.14.1.tgz
CVE-2015-9251 jquery-1.7.1.min.js
CVE-2023-44270 postcss-6.0.23.tgz
CVE-2021-3918 json-schema-0.2.3.tgz
CVE-2022-0536 follow-redirects-1.7.0.tgz
CVE-2021-37701 tar-4.4.2.tgz
CVE-2023-26156 chromedriver-89.0.0.tgz
CVE-2017-16028 randomatic-1.1.6.tgz
CVE-2021-32803 tar-6.0.2.tgz
CVE-2022-24999 qs-6.5.2.tgz
WS-2019-0066 ecstatic-1.4.1.tgz
CVE-2019-11358 jquery-1.7.2.min.js
CVE-2021-23566 nanoid-3.1.12.tgz
CVE-2021-23406 degenerator-1.0.4.tgz
CVE-2021-43138 async-2.6.3.tgz
CVE-2022-3517 minimatch-0.3.0.tgz
CVE-2021-23424 ansi-html-0.0.7.tgz
CVE-2022-33987 got-6.7.1.tgz
CVE-2024-28863 tar-2.2.2.tgz
CVE-2021-3517 gettext-v0.20.1
CVE-2019-6286 node-sass-4.14.1.tgz
CVE-2024-42460 elliptic-6.5.4.tgz
CVE-2021-33623 trim-newlines-1.0.0.tgz
CVE-2022-37601 loader-utils-2.0.0.tgz
CVE-2024-28863 tar-4.4.2.tgz
CVE-2020-28469 glob-parent-2.0.0.tgz
CVE-2022-0155 follow-redirects-1.7.0.tgz
CVE-2020-7656 jquery-1.8.2.min.js
CVE-2021-3777 tmpl-1.0.4.tgz
CVE-2012-6708 jquery-1.8.2.min.js
CVE-2022-24999 qs-2.3.3.tgz
CVE-2021-37701 tar-2.2.2.tgz
CVE-2024-33883 ejs-2.6.1.tgz
CVE-2020-15366 ajv-4.11.7.tgz
CVE-2022-33987 got-7.1.0.tgz
CVE-2021-23358 underscore-1.10.2.tgz
CVE-2024-37890 ws-5.2.2.tgz
CVE-2024-48949 elliptic-6.5.4.tgz
CVE-2012-6708 jquery-1.7.2.min.js
CVE-2024-42459 elliptic-6.5.4.tgz
CVE-2021-37712 tar-6.0.2.tgz
CVE-2022-25858 terser-4.6.6.tgz
CVE-2023-45133 traverse-7.10.1.tgz
CVE-2022-24785 moment-2.20.1.js
WS-2021-0638 mocha-8.2.1.tgz
CVE-2022-0144 shelljs-0.8.3.tgz
WS-2019-0605 CSS::Sass-v3.4.11
CVE-2022-46175 json5-1.0.1.tgz
CVE-2022-21680 marked-0.8.2.tgz
CVE-2021-32804 tar-4.4.2.tgz
CVE-2021-29060 color-string-1.5.3.tgz
CVE-2019-18797 opennms-opennms-source-26.0.0-1
CVE-2024-29180 webpack-dev-middleware-3.7.2.tgz
CVE-2020-7598 minimist-1.1.3.tgz
CVE-2022-46175 json5-0.5.1.tgz
CVE-2020-11022 jquery-1.7.1.min.js
CVE-2021-37712 tar-4.4.2.tgz
CVE-2024-42461 elliptic-6.5.4.tgz
CVE-2019-6284 node-sass-4.14.1.tgz
CVE-2019-10747 set-value-0.4.3.tgz
CVE-2018-19827 node-sass-4.14.1.tgz
CVE-2018-20190 opennms-opennms-source-26.0.0-1
CVE-2021-27290 ssri-6.0.1.tgz
CVE-2019-11358 jquery-2.1.4.min.js
CVE-2019-10775 ecstatic-1.4.1.tgz
CVE-2021-3749 axios-0.21.1.tgz
CVE-2021-23364 browserslist-4.5.4.tgz
CVE-2021-32804 tar-6.0.2.tgz
CVE-2023-45133 traverse-7.9.6.tgz
CVE-2018-19838 opennms-opennms-source-26.0.0-1
CVE-2023-34104 fast-xml-parser-3.19.0.tgz
WS-2021-0153 ejs-2.5.7.tgz
CVE-2022-0536 follow-redirects-1.13.1.tgz
CVE-2023-26136 tough-cookie-2.5.0.tgz
CVE-2021-3807 ansi-regex-5.0.0.tgz
CVE-2020-7598 minimist-0.0.8.tgz
CVE-2017-16042 growl-1.9.2.tgz
WS-2020-0341 front-matter-2.1.2.tgz
CVE-2021-23440 set-value-2.0.0.tgz
CVE-2024-48948 elliptic-6.5.4.tgz
CVE-2023-45857 axios-0.21.1.tgz
CVE-2024-43788 webpack-4.43.0.tgz
CVE-2020-7700 locutus-2.0.11.tgz
CVE-2020-24025 node-sass-4.14.1.tgz
CVE-2024-41818 fast-xml-parser-3.19.0.tgz
CVE-2024-4067 micromatch-4.0.2.tgz
CVE-2021-27515 url-parse-1.4.7.tgz
CVE-2022-37599 loader-utils-2.0.0.tgz
CVE-2019-20388 gettext-v0.20.1
CVE-2022-25883 semver-7.3.2.tgz
CVE-2024-27088 es5-ext-0.10.53.tgz
CVE-2012-6708 jquery-1.6.1.min.js
CVE-2021-37713 tar-4.4.2.tgz
CVE-2018-19839 node-sass-4.14.1.tgz
CVE-2017-16137 debug-4.1.1.tgz
CVE-2022-0122 node-forge-0.10.0.tgz
CVE-2024-28849 follow-redirects-1.7.0.tgz
CVE-2022-0155 follow-redirects-1.13.1.tgz
CVE-2017-16137 debug-0.8.1.tgz
WS-2020-0042 acorn-5.7.3.tgz
CVE-2019-20149 kind-of-6.0.2.tgz
CVE-2020-7789 node-notifier-5.3.0.tgz
CVE-2020-7719 locutus-2.0.11.tgz
CVE-2021-37713 tar-6.0.2.tgz
CVE-2024-4068 braces-3.0.2.tgz
CVE-2022-26592 opennms-opennms-source-26.0.0-1
CVE-2021-44906 minimist-0.0.8.tgz
CVE-2022-37603 loader-utils-1.1.0.tgz
CVE-2018-14404 libxmljs2-v0.26.5
CVE-2023-28155 request-2.88.2.tgz
CVE-2022-25858 terser-4.6.10.tgz
CVE-2022-29078 ejs-2.5.7.tgz
CVE-2021-23364 browserslist-4.12.0.tgz
CVE-2024-27088 es5-ext-0.10.15.tgz
CVE-2021-3516 voyamedia-libxml2-2.9.9
CVE-2021-29060 color-string-1.5.4.tgz
CVE-2022-37601 loader-utils-1.4.0.tgz
CVE-2024-29415 ip-1.1.5.tgz
CVE-2020-7656 jquery-1.6.1.min.js
CVE-2022-21670 markdown-it-10.0.0.tgz
CVE-2017-16137 debug-4.2.0.tgz
CVE-2022-24772 node-forge-0.10.0.tgz
CVE-2016-3709 gettext-v0.20.1
CVE-2021-32640 ws-7.3.0.tgz
CVE-2022-0691 url-parse-1.4.7.tgz
CVE-2022-21681 marked-0.8.2.tgz
CVE-2022-21222 css-what-2.1.0.tgz
CVE-2021-3664 url-parse-1.4.7.tgz
MSC-2023-16609 fsevents-1.2.9.tgz
CVE-2024-4068 braces-1.8.5.tgz
CVE-2021-23368 postcss-7.0.14.tgz
CVE-2022-31129 moment-2.20.1.js
CVE-2024-25062 voyamedia-libxml2-2.9.9
CVE-2015-9251 jquery-1.6.1.min.js
CVE-2020-7788 ini-1.3.5.tgz
CVE-2021-44906 minimist-0.0.10.tgz
CVE-2021-43307 semver-regex-1.0.0.tgz
CVE-2020-11022 jquery-1.8.2.min.js
CVE-2023-26159 follow-redirects-1.7.0.tgz
CVE-2022-46175 json5-2.1.0.tgz
CVE-2023-45311 fsevents-1.2.9.tgz
CVE-2021-44906 minimist-1.1.3.tgz
CVE-2023-26159 follow-redirects-1.13.1.tgz
CVE-2022-37603 loader-utils-1.4.0.tgz
CVE-2015-9251 jquery-1.7.2.min.js
CVE-2022-1650 eventsource-1.0.7.tgz
CVE-2018-20821 node-sass-4.14.1.tgz
CVE-2018-3739 https-proxy-agent-1.0.0.tgz
CVE-2019-10747 set-value-2.0.0.tgz
CVE-2024-47764 cookie-0.4.1.tgz
CVE-2021-43138 async-3.2.0.tgz
CVE-2019-6283 opennms-opennms-source-26.0.0-1
CVE-2022-31129 moment-2.29.1.tgz
CVE-2023-45133 babel-traverse-6.26.0.tgz
CVE-2021-23382 postcss-6.0.23.tgz
WS-2019-0310 https-proxy-agent-1.0.0.tgz
CVE-2015-9251 jquery-2.1.4.min.js
CVE-2021-23382 postcss-6.0.19.tgz
WS-2021-0152 color-string-1.5.3.tgz
CVE-2017-16137 debug-4.1.0.tgz
CVE-2020-7598 minimist-0.0.10.tgz
CVE-2022-25758 scss-tokenizer-0.2.3.tgz
CVE-2022-25883 semver-7.0.0.tgz
CVE-2021-23807 jsonpointer-4.0.1.tgz
CVE-2024-37890 ws-6.2.1.tgz
CVE-2021-23364 browserslist-4.14.5.tgz
CVE-2022-25883 semver-5.3.0.tgz
CVE-2022-0235 node-fetch-2.6.1.tgz
CVE-2023-45133 traverse-7.8.4.tgz
CVE-2021-3803 nth-check-1.0.2.tgz
CVE-2024-4067 micromatch-2.3.11.tgz
CVE-2019-6284 opennms-opennms-source-26.0.0-1
CVE-2022-25851 jpeg-js-0.4.3.tgz
CVE-2024-4068 braces-2.3.2.tgz
CVE-2021-3795 semver-regex-1.0.0.tgz
CVE-2021-23369 handlebars-4.7.6.tgz
CVE-2019-11358 jquery-1.8.2.min.js
CVE-2023-28484 gettext-v0.20.1
CVE-2023-26136 tough-cookie-2.4.3.tgz
CVE-2012-6708 jquery-1.7.1.min.js
CVE-2020-7608 yargs-parser-16.1.0.tgz
CVE-2023-44270 postcss-6.0.19.tgz
WS-2018-0590 diff-1.4.0.tgz
CVE-2024-37890 ws-7.3.0.tgz
CVE-2022-0686 url-parse-1.4.7.tgz
CVE-2024-21536 http-proxy-middleware-0.19.2.tgz
CVE-2020-8244 bl-1.2.2.tgz
CVE-2020-7608 yargs-parser-9.0.2.tgz
CVE-2023-44270 postcss-7.0.35.tgz
CVE-2023-43646 get-func-name-2.0.0.tgz
CVE-2020-11022 jquery-1.7.2.min.js
CVE-2023-26115 word-wrap-1.2.3.tgz
CVE-2016-10540 minimatch-0.3.0.tgz
CVE-2021-27290 ssri-8.0.0.tgz
CVE-2022-23308 gettext-v0.20.1
CVE-2021-3518 gettext-v0.20.1
CVE-2015-9251 jquery-1.8.2.min.js
CVE-2019-10196 http-proxy-agent-1.0.0.tgz
CVE-2021-23440 set-value-0.4.3.tgz
CVE-2020-7660 serialize-javascript-2.1.2.tgz
WS-2019-0425 mocha-2.2.5.js
WS-2020-0042 acorn-6.0.2.tgz
CVE-2018-19797 opennms-opennms-source-26.0.0-1
CVE-2021-23406 pac-resolver-1.2.6.tgz
CVE-2021-32640 ws-6.2.1.tgz
CVE-2023-26920 fast-xml-parser-3.19.0.tgz
CVE-2021-23382 postcss-7.0.35.tgz
CVE-2018-16492 extend-1.3.0.tgz
CVE-2021-25949 set-getter-0.1.0.tgz
CVE-2020-24977 gettext-v0.20.1
WS-2018-0590 diff-3.2.0.tgz
CVE-2020-28469 glob-parent-3.1.0.tgz
CVE-2011-4969 jquery-1.6.1.min.js
CVE-2021-23382 postcss-7.0.14.tgz
WS-2019-0307 mem-1.1.0.tgz
CVE-2020-15366 ajv-6.12.2.tgz
CVE-2021-37712 tar-2.2.2.tgz
CVE-2022-40304 gettext-v0.20.1
CVE-2021-37713 tar-2.2.2.tgz
CVE-2022-29824 gettext-v0.20.1
CVE-2019-6286 opennms-opennms-source-26.0.0-1
WS-2020-0345 jsonpointer-4.0.1.tgz
CVE-2020-15366 ajv-5.5.2.tgz
CVE-2020-28469 glob-parent-5.1.1.tgz
CVE-2021-23358 underscore-1.8.3.tgz
CVE-2020-7656 jquery-1.7.2.min.js
CVE-2018-20821 opennms-opennms-source-26.0.0-1
CVE-2017-1000048 qs-2.3.3.tgz
CVE-2023-28155 request-2.88.0.tgz
CVE-2020-3846 gettext-v0.20.1
CVE-2021-32804 tar-2.2.2.tgz
WS-2020-0163 marked-0.8.2.tgz
CVE-2019-6283 node-sass-4.14.1.tgz
CVE-2017-20165 debug-0.8.1.tgz
CVE-2023-44270 postcss-7.0.14.tgz
CVE-2024-4067 micromatch-3.1.10.tgz
CVE-2022-46175 json5-2.1.3.tgz
CVE-2021-23368 postcss-7.0.35.tgz
WS-2020-0342 is-my-json-valid-2.20.0.tgz
CVE-2022-0144 shelljs-0.6.1.tgz
CVE-2023-29469 gettext-v0.20.1
CVE-2020-11023 jquery-1.7.2.min.js
CVE-2020-11022 jquery-2.1.4.min.js
CVE-2018-20822 opennms-opennms-source-26.0.0-1
CVE-2021-23392 locutus-2.0.11.tgz
WS-2021-0152 color-string-1.5.4.tgz
CVE-2023-42282 ip-1.1.5.tgz
CVE-2021-23383 handlebars-4.7.6.tgz

Base branch total remaining vulnerabilities: 331
Base branch commit: null


Total libraries scanned: 685

Scan token: f8e20ac2e7e64b75bb99701796c98dc4