GHSA-vpq5-4rc8-c222

Source

https://github.com/advisories/GHSA-vpq5-4rc8-c222

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-vpq5-4rc8-c222/GHSA-vpq5-4rc8-c222.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vpq5-4rc8-c222

Published

2019-06-05T14:10:45Z

Modified

2020-08-31T18:36:22Z

Summary

Denial of Service in canvas

Details

Versions of canvas prior to 1.6.10 are vulnerable to Denial of Service. Processing malicious JPEGs or GIFs could crash the node process.

Recommendation

Upgrade to version 1.6.10

Database specific

{
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2019-06-05T12:48:28Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}

References

Affected packages

npm / canvas

Package

Name: canvas; View open source insights on deps.dev
Purl: pkg:npm/canvas

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.6.10

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-vpq5-4rc8-c222/GHSA-vpq5-4rc8-c222.json"