WS-2017-0266 Medium Severity Vulnerability detected by WhiteSource

[mend-bolt-for-github]

WS-2017-0266 - Medium Severity Vulnerability

Vulnerable Library - http-signature-0.10.1.tgz

Reference implementation of Joyent's HTTP Signature scheme.

path: /tmp/git/jenkins-material-theme/node_modules/grunt-image-embed/node_modules/http-signature/package.json

Library home page: http://registry.npmjs.org/http-signature/-/http-signature-0.10.1.tgz

Dependency Hierarchy:

• grunt-image-embed-0.3.3.tgz (Root Library)
  • request-2.51.0.tgz
    • ❌ http-signature-0.10.1.tgz (Vulnerable Library)

Vulnerability Details

Affected versions (before 1.0.0) of the http-signature package are vulnerable to Timing Attacks.

Publish Date: 2017-06-28

URL: WS-2017-0266

CVSS 2 Score Details (5.5)

Base Score Metrics not available

Suggested Fix

Type: Change files

Origin: TritonDataCenter/node-http-signature@78ab1da

Release Date: 2015-09-21

Fix Resolution: Replace or update the following file: verify.js

---

Step up your Open Source Security Game with WhiteSource here