GHSA-83rx-c8cr-6j8q

Source

https://github.com/advisories/GHSA-83rx-c8cr-6j8q

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-83rx-c8cr-6j8q/GHSA-83rx-c8cr-6j8q.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-83rx-c8cr-6j8q

Published

2019-06-05T20:48:55Z

Modified

2021-08-04T21:33:58Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Insecure Default Configuration in tesseract.js

Details

Versions of tesseract.js prior to 1.0.19 default to using a third-party proxy. Requests may be proxied through crossorigin.me which clearly states is not suitable for production use. This may lead to instability and privacy violations.

Recommendation

Upgrade to version 1.0.19 or later.

Database specific

{
    "cwe_ids": [
        "CWE-829"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2019-06-05T20:48:43Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}

References

Affected packages

npm / tesseract.js

Package

Name: tesseract.js; View open source insights on deps.dev
Purl: pkg:npm/tesseract.js

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.0.19

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-83rx-c8cr-6j8q/GHSA-83rx-c8cr-6j8q.json"