[Pkg-javascript-devel] Bug#985841: node-ssri: CVE-2021-27290

[Salvatore Bonaccorso]

Source: node-ssri
Version: 8.0.0-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for node-ssri.

CVE-2021-27290[0]:
| ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular
| expression which is vulnerable to a denial of service. Malicious SRIs
| could take an extremely long time to process, leading to denial of
| service. This issue only affects consumers using the strict option.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-27290
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27290
[1] https://github.com/npm/ssri/commit/76e223317d971

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore