apk package
chainguard/lerna
pkg:apk/chainguard/lerna
Vulnerabilities (65)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2024-33883 | Med | 4.0 | < 8.1.3-r0 | 8.1.3-r0 | Apr 28, 2024 | The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection. | |
| CVE-2024-28863 | — | < 8.1.3-r0 | 8.1.3-r0 | Mar 21, 2024 | node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js cl | ||
| CVE-2024-28849 | — | < 8.1.2-r1 | 8.1.2-r1 | Mar 14, 2024 | follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which | ||
| CVE-2023-42282 | — | < 8.1.2-r1 | 8.1.2-r1 | Feb 8, 2024 | The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic. | ||
| CVE-2023-26159 | Hig | 7.3 | < 8.0.2-r0 | 8.0.2-r0 | Jan 2, 2024 | Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this |
- affected < 8.1.3-r0fixed 8.1.3-r0
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
- CVE-2024-28863Mar 21, 2024affected < 8.1.3-r0fixed 8.1.3-r0
node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js cl
- CVE-2024-28849Mar 14, 2024affected < 8.1.2-r1fixed 8.1.2-r1
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which
- CVE-2023-42282Feb 8, 2024affected < 8.1.2-r1fixed 8.1.2-r1
The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.
- affected < 8.0.2-r0fixed 8.0.2-r0
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this
Page 4 of 4