Security update get-func-name (CVE-2023-43646)

$ yarn audit yarn audit v1.22.19 ┌───────────────┬──────────────────────────────────────────────────────────────┐ │ high │ Chaijs/get-func-name vulnerable to ReDoS │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Package │ get-func-name │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Patched in │ >=2.0.1 │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Dependency of │ nightwatch │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Path │ nightwatch > @nightwatch/chai > loupe > get-func-name │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ More info │ https://www.npmjs.com/advisories/1094183 │ └───────────────┴──────────────────────────────────────────────────────────────┘ 1 vulnerabilities found - Packages audited: 822 Severity: 1 High

Comments & Activities

Issue created by @Spokje
Comment 12 months ago →
🇳🇱Netherlands Spokje
Open in Jenkins → Open on Drupal.org →
Environment: PHP 8.2 & MySQL 8
last update 12 months ago
30,365 pass
Status changed to Needs review 12 months ago10:19am 28 September 2023
Comment 12 months ago →
🇳🇱Netherlands Spokje
Status changed to Needs work 12 months ago10:29am 28 September 2023
Comment 12 months ago →
🇳🇱Netherlands Spokje
Needs backports

Comment 12 months ago →

🇳🇱Netherlands Spokje

$  yarn-lock-diff -o yarn.old.lock -n yarn.lock
┌───────────────┬────────────────┬─────────────────┐
│ package name  │ old version(s) │ new version(s)  │
├───────────────┼────────────────┼─────────────────┤
│ get-func-name │ 2.0.0          │ 2.0.2           │
└───────────────┴────────────────┴─────────────────┘

Open in Jenkins → Open on Drupal.org →
Environment: PHP 8.2 & MySQL 8
last update 12 months ago
29,644 pass
Comment 12 months ago →
🇳🇱Netherlands Spokje
Looking at 📌 Security update get-func-name (CVE-2023-43646) Needs work we don't do 10.0.x anymore
Status changed to Needs review 12 months ago11:25am 28 September 2023
Comment 12 months ago →
🇳🇱Netherlands Spokje
Status changed to RTBC 12 months ago4:39pm 28 September 2023
Comment 12 months ago →
🇺🇸United States smustgrave
Applies cleanly to 11.x also.
Status changed to Fixed 11 months ago9:57am 29 September 2023
Comment 11 months ago →
🇬🇧United Kingdom longwave UK
Committed and pushed b164d5c575 to 11.x and c23f214501 to 10.1.x. Thanks!

Comment 11 months ago →

System Message

longwave → committed c23f2145 on 10.1.x

Issue #3390380 by Spokje: Security update get-func-name (CVE-2023-43646...

Comment 11 months ago →

System Message

longwave → committed b164d5c5 on 11.x

Issue #3390380 by Spokje: Security update get-func-name (CVE-2023-43646)

Comment 11 months ago →
System Message
Automatically closed - issue fixed for 2 weeks with no activity.

Security update get-func-name (CVE-2023-43646)

Problem/Motivation

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

Comments & Activities