Vulnerable Library - yamldotnet.3.3.0.nupkg

A .NET library for YAML. YamlDotNet provides low level parsing and emitting of YAML as well as a hig...

path: /CFI-LB/llvm-project/clang-tools-extra/clang-tidy-vs/ClangTidy/packages.config

Library home page: https://api.nuget.org/packages/yamldotnet.3.3.0.nupkg

Dependency Hierarchy:

• ❌ yamldotnet.3.3.0.nupkg (Vulnerable Library)

Vulnerability Details

YamlDotNet version 4.3.2 and earlier contains a Insecure Direct Object Reference vulnerability in The default behavior of Deserializer.Deserialize() will deserialize user-controlled types in the line "currentType = Type.GetType(nodeEvent.Tag.Substring(1), throwOnError: false);" and blindly instantiates them. that can result in Code execution in the context of the running process. This attack appear to be exploitable via Victim must parse a specially-crafted YAML file. This vulnerability appears to have been fixed in 5.0.0.

Publish Date: 2018-07-13

URL: CVE-2018-1000210

CVSS 3 Score Details (7.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Vulnerable Library - braces-1.8.5.tgz

Fastest brace expansion for node.js, with the most complete support for the Bash 4.3 braces specification.

path: /tmp/git/CFI-LB/llvm-project/lldb/tools/lldb-vscode/node_modules/braces/package.json

Library home page: https://registry.npmjs.org/braces/-/braces-1.8.5.tgz

Dependency Hierarchy:

• vscode-1.1.10.tgz (Root Library)
  • gulp-symdest-1.1.1.tgz
    • vinyl-fs-2.4.4.tgz
      • glob-stream-5.3.5.tgz
        • micromatch-2.3.11.tgz
          • ❌ braces-1.8.5.tgz (Vulnerable Library)

Vulnerability Details

Version of braces prior to 2.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.

Publish Date: 2019-03-25

URL: WS-2019-0019

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/786

Release Date: 2019-02-21

Fix Resolution: 2.3.1

Vulnerable Library - tar-2.2.1.tgz

tar for node

Library home page: http://registry.npmjs.org/tar/-/tar-2.2.1.tgz

Path to dependency file: /CFI-LB/llvm-project/lldb/tools/lldb-vscode/package.json

Path to vulnerable library: /tmp/git/CFI-LB/llvm-project/lldb/tools/lldb-vscode/node_modules/tar/package.json

Dependency Hierarchy:

• vscode-1.1.10.tgz (Root Library)
  • gulp-untar-0.0.6.tgz
    • ❌ tar-2.2.1.tgz (Vulnerable Library)

Found in HEAD commit: 2ce31b59ebbe26448653c04f936fe7d96f411472

Vulnerability Details

Versions of node-tar prior to 4.4.2 are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file.

Publish Date: 2019-04-05

URL: WS-2019-0047

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/803

Release Date: 2019-04-05

Fix Resolution: 4.4.2