[Pkg-javascript-devel] Bug#901277: node-mime: CVE-2017-16138

[Salvatore Bonaccorso]

Source: node-mime
Version: 1.3.4-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/broofa/node-mime/issues/167

Hi,

The following vulnerability was published for node-mime.

CVE-2017-16138[0]:
| The mime module is vulnerable to regular expression denial of service
| when a mime lookup is performed on untrusted user input.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-16138
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16138
[1] https://github.com/broofa/node-mime/issues/167
[2] https://nodesecurity.io/advisories/535

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore