Security update get-func-name (CVE-2023-43646)

$ yarn audit yarn audit v1.22.19 ┌───────────────┬──────────────────────────────────────────────────────────────┐ │ high │ Chaijs/get-func-name vulnerable to ReDoS │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Package │ get-func-name │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Patched in │ >=2.0.1 │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Dependency of │ nightwatch │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Path │ nightwatch > @nightwatch/chai > loupe > get-func-name │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ More info │ https://www.npmjs.com/advisories/1094183 │ └───────────────┴──────────────────────────────────────────────────────────────┘ 1 vulnerabilities found - Packages audited: 822 Severity: 1 High

Comments & Activities

Issue created by @spokje
Comment over 1 year ago →
🇳🇱Netherlands spokje
Open in Jenkins → Open on Drupal.org →
Environment: PHP 8.2 & MySQL 8
last update over 1 year ago
30,365 pass
Status changed to Needs review over 1 year ago10:19am 28 September 2023
Comment over 1 year ago →
🇳🇱Netherlands spokje
Status changed to Needs work over 1 year ago10:29am 28 September 2023
Comment over 1 year ago →
🇳🇱Netherlands spokje
Needs backports

Comment over 1 year ago →

🇳🇱Netherlands spokje

$  yarn-lock-diff -o yarn.old.lock -n yarn.lock
┌───────────────┬────────────────┬─────────────────┐
│ package name  │ old version(s) │ new version(s)  │
├───────────────┼────────────────┼─────────────────┤
│ get-func-name │ 2.0.0          │ 2.0.2           │
└───────────────┴────────────────┴─────────────────┘

Open in Jenkins → Open on Drupal.org →
Environment: PHP 8.2 & MySQL 8
last update over 1 year ago
29,644 pass
Comment over 1 year ago →
🇳🇱Netherlands spokje
Looking at 📌 Security update get-func-name (CVE-2023-43646) Needs work we don't do 10.0.x anymore
Status changed to Needs review over 1 year ago11:25am 28 September 2023
Comment over 1 year ago →
🇳🇱Netherlands spokje
Status changed to RTBC over 1 year ago4:39pm 28 September 2023
Comment over 1 year ago →
🇺🇸United States smustgrave
Applies cleanly to 11.x also.
Status changed to Fixed over 1 year ago9:57am 29 September 2023
Comment over 1 year ago →
🇬🇧United Kingdom longwave UK
Committed and pushed b164d5c575 to 11.x and c23f214501 to 10.1.x. Thanks!
Comment over 1 year ago →
System Message

longwave → committed c23f2145 on 10.1.x
Issue #3390380 by Spokje: Security update get-func-name (CVE-2023-43646...

Comment over 1 year ago →

System Message

longwave → committed b164d5c5 on 11.x

Issue #3390380 by Spokje: Security update get-func-name (CVE-2023-43646)

Comment over 1 year ago →
System Message
Automatically closed - issue fixed for 2 weeks with no activity.

Security update get-func-name (CVE-2023-43646)

Problem/Motivation

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

Comments & Activities