GHSA-9r3m-mhfm-39cm

Source

https://github.com/advisories/GHSA-9r3m-mhfm-39cm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-9r3m-mhfm-39cm/GHSA-9r3m-mhfm-39cm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9r3m-mhfm-39cm

Published

2020-09-11T21:10:29Z

Modified

2020-08-31T18:42:08Z

Summary

Incorrect Calculation in bigint-money

Details

Versions of bigint-money prior to 0.6.2 are vulnerable to an Incorrect Calculation. The package incorrectly rounded certain numbers, which could have drastic consequences due to its usage in financial systems.

Recommendation

Upgrade to version 0.6.2 or later.

Database specific

{
    "cwe_ids":  [
        "CWE-682"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:42:08Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}

References

https://www.npmjs.com/advisories/962

Affected packages

npm / bigint-money

Package

Name: bigint-money; View open source insights on deps.dev
Purl: pkg:npm/bigint-money

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.6.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-9r3m-mhfm-39cm/GHSA-9r3m-mhfm-39cm.json"