diff --git a/package.json b/package.json index 267a13692..29f13e814 100644 --- a/package.json +++ b/package.json @@ -30,8 +30,7 @@ "test:addons-rose": "cd addons/rose && yarn test", "test:ui-admin": "cd ui/admin && yarn test", "test:ui-desktop": "cd ui/desktop && yarn test", - "compliance:audit": "bash ./scripts/yarn-audit.sh", - "precommit": "yarn compliance:licenses && yarn compliance:audit && yarn lint && yarn test", + "precommit": "yarn compliance:licenses && yarn lint && yarn test", "commit": "git-cz", "compliance:licenses": "license-checker --onlyAllow 'Apache*;Apache License, Version 2.0;Apache-2.0;Apache 2.0;Artistic-2.0;BSD;BSD-3-Clause;CC-BY-3.0;CC-BY-4.0;CC0-1.0;ISC;MIT;MPL-2.0;Public Domain;Python-2.0;Unicode-TOU;Unlicense;WTFPL' --excludePackages 'boundary-ui;admin@0.0.0;desktop@0.0.0;base64-js@0.0.2;cycle@1.0.3'", "doc:toc": "doctoc README.md" diff --git a/scripts/yarn-audit.sh b/scripts/yarn-audit.sh deleted file mode 100644 index 4b5bd702c..000000000 --- a/scripts/yarn-audit.sh +++ /dev/null @@ -1,38 +0,0 @@ -#!/usr/bin/env bash - -# Workaround to suppress yarn audit report for issues without known resolutions. -# Audit level: Moderate -# https://github.com/yarnpkg/yarn/issues/6669 - -set -u - -set +e -output=$(yarn audit --level=moderate --json) -result=$? -set -e - -if [ $result -eq 0 ]; then - # everything is fine - exit 0 -fi - -if [ -f yarn-audit-known-issues ] && echo "$output" | grep auditAdvisory | diff -q yarn-audit-known-issues - > /dev/null 2>&1; then - echo - echo Ignorning known vulnerabilities - exit 0 -fi - -echo -echo Security vulnerabilities were found that were not ignored -echo -echo Check to see if these vulnerabilities apply to production -echo and/or if they have fixes available. If they do not have -echo fixes and they do not apply to production, you may ignore them -echo -echo To ignore these vulnerabilities, run: -echo -echo "yarn audit --level=moderate --json | grep auditAdvisory > yarn-audit-known-issues" -echo -echo and commit the yarn-audit-known-issues file - -exit "$result" diff --git a/yarn-audit-known-issues b/yarn-audit-known-issues deleted file mode 100644 index 74ce49273..000000000 --- a/yarn-audit-known-issues +++ /dev/null @@ -1,14 +0,0 @@ -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":1648,"path":"rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.5.3","paths":["api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>browserify-sign>elliptic","api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>api>ember-cli-mirage>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>ember-intl>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>ember-focus-trap>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","core>rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic","rose>emberx-select>ember-auto-import>webpack>node-libs-browser>crypto-browserify>create-ecdh>elliptic"]}],"id":1648,"created":"2021-03-08T16:08:52.414Z","updated":"2021-03-08T16:08:52.414Z","deleted":null,"title":"Use of a Broken or Risky Cryptographic Algorithm","found_by":{"link":"","name":"Anonymous","email":""},"reported_by":{"link":"","name":"Anonymous","email":""},"module_name":"elliptic","cves":["CVE-2020-28498"],"vulnerable_versions":"<6.5.4","patched_versions":">=6.5.4","overview":"`elliptic` before version 6.5.4 is vulnerable to Cryptographic Issues via the secp256k1 implementation in `elliptic/ec/key.js`. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.","recommendation":"Upgrade to version 6.5.4 or later","references":"- [Snyk Advisory](https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899)\n- [GitHub Advisory](https://github.com/advisories/GHSA-r9p9-mrjm-926w)\n- [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498)","access":"public","severity":"moderate","cwe":"CWE-327","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/1648"}}}