From b0f825f4488ee7d78b3ea77c4bc2343da3a84ea9 Mon Sep 17 00:00:00 2001 From: Fabrice Fontaine Date: Sat, 23 Jul 2022 22:10:14 +0200 Subject: [PATCH] package/jquery-validation: security bump to version 1.19.5 - Fix CVE-2021-43306: An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method - Fix CVE-2022-31147: The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of service (ReDoS) when an attacker is able to supply arbitrary input to the url2 method. This is due to an incomplete fix for CVE-2021-43306. Users should upgrade to version 1.19.5 to receive a patch. - Use LICENSE.md instead of README.md which is available since version 1.14.0 and https://github.com/jquery-validation/jquery-validation/commit/96b7036eb45375eb4861082d8ca442d94a9c666c https://github.com/jquery-validation/jquery-validation/releases/tag/1.19.4 https://github.com/jquery-validation/jquery-validation/releases/tag/1.19.5 Signed-off-by: Fabrice Fontaine Signed-off-by: Arnout Vandecappelle (Essensium/Mind) --- package/jquery-validation/jquery-validation.hash | 4 ++-- package/jquery-validation/jquery-validation.mk | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package/jquery-validation/jquery-validation.hash b/package/jquery-validation/jquery-validation.hash index 4dbe07e218..31ecd62bcb 100644 --- a/package/jquery-validation/jquery-validation.hash +++ b/package/jquery-validation/jquery-validation.hash @@ -1,3 +1,3 @@ # Locally computed -sha256 01ad2ef0a7f9cd413aeb51081651293916da47d20e5c0a59ec62587e58b03564 jquery-validation-1.19.3.zip -sha256 3e5a99460077c16bf75f6821a30cdac9baa339119ebf63b2a6c49f4f50421ca4 README.md +sha256 52381e080f266f8bca1a17acd6a4a68be4c2606a8b16f8a12e597cc69f2c0584 jquery-validation-1.19.5.zip +sha256 f398878cab338b869638bdac1aeae76bf3ac11b2b89da6e0b68bc1a645733440 LICENSE.md diff --git a/package/jquery-validation/jquery-validation.mk b/package/jquery-validation/jquery-validation.mk index 920ed1cece..1ed37ee73b 100644 --- a/package/jquery-validation/jquery-validation.mk +++ b/package/jquery-validation/jquery-validation.mk @@ -4,11 +4,11 @@ # ################################################################################ -JQUERY_VALIDATION_VERSION = 1.19.3 +JQUERY_VALIDATION_VERSION = 1.19.5 JQUERY_VALIDATION_SITE = https://github.com/jquery-validation/jquery-validation/releases/download/$(JQUERY_VALIDATION_VERSION) JQUERY_VALIDATION_SOURCE = jquery-validation-$(JQUERY_VALIDATION_VERSION).zip JQUERY_VALIDATION_LICENSE = MIT -JQUERY_VALIDATION_LICENSE_FILES = README.md +JQUERY_VALIDATION_LICENSE_FILES = LICENSE.md JQUERY_VALIDATION_CPE_ID_VENDOR = jqueryvalidation JQUERY_VALIDATION_CPE_ID_PRODUCT = jquery_validation