[Git][security-tracker-team/security-tracker][master] new node-yargs-parser issue

[Moritz Muehlenhoff]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
cd8f8e44 by Moritz Muehlenhoff at 2020-03-23T22:08:21+01:00
new node-yargs-parser issue

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -7597,7 +7597,10 @@ CVE-2020-7610
 CVE-2020-7609
 	RESERVED
 CVE-2020-7608 (yargs-parser could be tricked into adding or modifying properties of O ...)
-	TODO: check
+	- node-yargs-parser <unfixed>
+	NOTE: https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381
+	NOTE: https://github.com/yargs/yargs-parser/commit/63810ca1ae1a24b08293a4d971e70e058c7a41e2
+	NOTE: https://gist.github.com/Kirill89/dcd8100d010896157a36624119439832
 CVE-2020-7607 (gulp-styledocco through 0.0.3 allows execution of arbitrary commands.  ...)
 	TODO: check
 CVE-2020-7606 (docker-compose-remote-api through 0.1.4 allows execution of arbitrary  ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cd8f8e44cd4cffca426f2bfd8e44ae910bf4c3d1

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cd8f8e44cd4cffca426f2bfd8e44ae910bf4c3d1
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20200323/780fddb3/attachment.html>