CVE-2021-23425

[klnSVM]

Hey,

https://snyk.io/vuln/SNYK-JS-TRIMOFFNEWLINES-1296850

Thank you

[rorteg]

Hi, is there any new version that solves the security issue?

CVE-2021-23425
moderate severity
Vulnerable versions: <= 1.0.1
Patched version: No fix
All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service (ReDoS) via string processing.

Thanks!

[Samarium150]

Hi, is there any new version that solves the security issue?

CVE-2021-23425
moderate severity
Vulnerable versions: <= 1.0.1
Patched version: No fix
All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service (ReDoS) via string processing.

Thanks!

I forked from #3 and created 1.0.2. Thanks to Trott. Yarn users could try to add the following to package.json to resolve the vulnerability

"resolutions": {
    "trim-off-newlines": "https://github.com/Samarium150/trim-off-newlines"
}

I'll delete my fork as soon as #3 is merged.

[Trott]

If you remove node_modules and package-lock.json and then run npm install, you may fix the Snyk/GitHub interface warning.

Explanation: For a lot of people, this is coming from conventional-commits-parser 3.2.1 or older. (This would not typically be a direct dependency. It would be a dependency of another package, such as semantic-release.) conventional-commits-parser 3.2.2 removed trim-off-newlines as a dependency, thus fixing this issue for that package. Ref: conventional-changelog/conventional-changelog#841

[Samarium150]

If you remove node_modules and package-lock.json and then run npm install, you may fix the Snyk/GitHub interface warning.

Explanation: For a lot of people, this is coming from conventional-commits-parser 3.2.1 or older. (This would not typically be a direct dependency. It would be a dependency of another package, such as semantic-release.) conventional-commits-parser 3.2.2 removed trim-off-newlines as a dependency, thus fixing this issue for that package. Ref: conventional-changelog/conventional-changelog#841

Yes, I use conventional-changelog-cli, which has conventional-commits-parser as a dependency. After a clean install, I also fixed CVE-2021-23425. Thanks a lot.