CVE-2020-7789 (Medium) detected in node-notifier-6.0.0.tgz #2017
Comments
|
ℹ️ This issue was automatically closed by WhiteSource because it is a duplicate of an existing issue: #2030 |
mend-bolt-for-github
bot
changed the title
mend-bolt-for-github
bot
changed the title
|
ℹ️ This issue was automatically closed by WhiteSource because it is a duplicate of an existing issue: #2030 |
|
👋 Thanks for reporting! |
Sorry, friend. As far as this ol' bot can tell, your issue does not properly use one of this repo's available issue templates. Please try again, if you like. (And if I'm confused, please let us know. 😬)
|
|
This issue is potentially a duplicate of one of the following issues:
|
|
Thank you for your report, the issue you have reported has just been fixed.
|
1 similar comment
|
Thank you for your report, the issue you have reported has just been fixed.
|
|
This issue is potentially a duplicate of one of the following issues:
|
mend-bolt-for-github
bot
changed the title
|
ℹ️ This issue was automatically re-opened by WhiteSource because the vulnerable library in the specific branch(es) has been detected in the WhiteSource inventory. |
|
This issue is potentially a duplicate of one of the following issues:
|
1 similar comment
|
This issue is potentially a duplicate of one of the following issues:
|
|
This issue is potentially a duplicate of one of the following issues:
|
|
This issue is potentially a duplicate of one of the following issues:
|
|
This issue is potentially a duplicate of one of the following issues:
|
This was referenced Nov 30, 2021
This was referenced Dec 8, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
CVE-2020-7789 - Medium Severity Vulnerability
A Node.js module for sending notifications on native Mac, Windows (post and pre 8) and Linux (or Growl as fallback)
Library home page: https://registry.npmjs.org/node-notifier/-/node-notifier-6.0.0.tgz
Path to dependency file: typescript-tools/package.json
Path to vulnerable library: typescript-tools/node_modules/node-notifier/package.json
Dependency Hierarchy:
Found in HEAD commit: 94a055e45bd6419b98a3f6c030632bac663aa978
This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.
Publish Date: 2020-12-11
URL: CVE-2020-7789
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7789
Release Date: 2020-12-11
Fix Resolution: 9.0.0
Step up your Open Source Security Game with WhiteSource here
The text was updated successfully, but these errors were encountered: