Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZoNXctZmc2OS1yYzht

Improper Input Validation in Google Closure Library

A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation -- update your library to version v20200315.

Permalink: https://github.com/advisories/GHSA-vh5w-fg69-rc8m
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZoNXctZmc2OS1yYzht
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 3 years ago
Updated: over 1 year ago

CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Identifiers: GHSA-vh5w-fg69-rc8m, CVE-2020-8910
References:

• https://nvd.nist.gov/vuln/detail/CVE-2020-8910
• https://github.com/google/closure-library/commit/294fc00b01d248419d8f8de37580adf2a0024fc9
• https://github.com/google/closure-library/releases/tag/v20200315
• https://github.com/advisories/GHSA-vh5w-fg69-rc8m

Repository: https://github.com/google/closure-library
Blast Radius: 21.5

Affected Packages