Auto-suppress CVEs

yarn-audit-known-issues

@@ -1 +1 @@
-{"actions":[],"advisories":{"1097548":{"findings":[{"version":"1.10.8","paths":["applicationinsights>@azure/monitor-opentelemetry>@opentelemetry/sdk-node>@opentelemetry/exporter-trace-otlp-grpc>@grpc/grpc-js","applicationinsights>@azure/monitor-opentelemetry>@opentelemetry/sdk-node>@opentelemetry/exporter-trace-otlp-grpc>@opentelemetry/otlp-grpc-exporter-base>@grpc/grpc-js"]}],"found_by":null,"deleted":null,"references":"- https://github.com/grpc/grpc-node/security/advisories/GHSA-7v5v-9h63-cj86\n- https://github.com/grpc/grpc-node/commit/08b0422dae56467ecae1007e899efe66a8c4a650\n- https://github.com/grpc/grpc-node/commit/674f4e351a619fd4532f84ae6dff96b8ee4e1ed3\n- https://github.com/grpc/grpc-node/commit/a8a020339c7eab1347a343a512ad17a4aea4bfdb\n- https://nvd.nist.gov/vuln/detail/CVE-2024-37168\n- https://github.com/advisories/GHSA-7v5v-9h63-cj86","created":"2024-06-10T21:38:05.000Z","id":1097548,"npm_advisory_id":null,"overview":"### Impact\nThere are two separate code paths in which memory can be allocated per message in excess of the `grpc.max_receive_message_length` channel option:\n\n 1. If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded.\n 2. If an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded.\n\n### Patches\n\nThis has been patched in versions 1.10.9, 1.9.15, and 1.8.22\n","reported_by":null,"title":"@grpc/grpc-js can allocate memory for incoming messages well above configured limits","metadata":null,"cves":["CVE-2024-37168"],"access":"public","severity":"moderate","module_name":"@grpc/grpc-js","vulnerable_versions":">=1.10.0 <1.10.9","github_advisory_id":"GHSA-7v5v-9h63-cj86","recommendation":"Upgrade to version 1.10.9 or later","patched_versions":">=1.10.9","updated":"2024-06-11T21:44:12.000Z","cvss":{"score":5.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},"cwe":["CWE-789"],"url":"https://github.com/advisories/GHSA-7v5v-9h63-cj86"},"1098455":{"findings":[{"version":"2.9.1","paths":["applicationinsights>@azure/identity>@azure/msal-node"]}],"found_by":null,"deleted":null,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2024-35255\n- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255\n- https://github.com/Azure/azure-sdk-for-go/commit/50774cd9709905523136fb05e8c85a50e8984499\n- https://github.com/Azure/azure-sdk-for-js/commit/c6aa75d312ae463e744163cedfd8fc480cc8d492\n- https://github.com/Azure/azure-sdk-for-python/commit/cb065acd7d0f957327dc4f02d1646d4e51a94178\n- https://github.com/Azure/azure-sdk-for-java/commit/5bf020d6ea056de40e2738e3647a4e06f902c18d\n- https://github.com/Azure/azure-sdk-for-net/commit/9279a4f38bf69b457cfb9b354f210e0a540a5c53\n- https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/4806#issuecomment-2178960340\n- https://github.com/advisories/GHSA-m5vv-6r4h-3vj9","created":"2024-06-11T18:30:50.000Z","id":1098455,"npm_advisory_id":null,"overview":"Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.","reported_by":null,"title":"Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability","metadata":null,"cves":["CVE-2024-35255"],"access":"public","severity":"moderate","module_name":"@azure/msal-node","vulnerable_versions":">=2.7.0 <2.9.2","github_advisory_id":"GHSA-m5vv-6r4h-3vj9","recommendation":"Upgrade to version 2.9.2 or later","patched_versions":">=2.9.2","updated":"2024-08-07T05:01:40.000Z","cvss":{"score":5.5,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-362"],"url":"https://github.com/advisories/GHSA-m5vv-6r4h-3vj9"},"1098456":{"findings":[{"version":"3.4.2","paths":["applicationinsights>@azure/identity"]}],"found_by":null,"deleted":null,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2024-35255\n- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255\n- https://github.com/Azure/azure-sdk-for-go/commit/50774cd9709905523136fb05e8c85a50e8984499\n- https://github.com/Azure/azure-sdk-for-js/commit/c6aa75d312ae463e744163cedfd8fc480cc8d492\n- https://github.com/Azure/azure-sdk-for-python/commit/cb065acd7d0f957327dc4f02d1646d4e51a94178\n- https://github.com/Azure/azure-sdk-for-java/commit/5bf020d6ea056de40e2738e3647a4e06f902c18d\n- https://github.com/Azure/azure-sdk-for-net/commit/9279a4f38bf69b457cfb9b354f210e0a540a5c53\n- https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/4806#issuecomment-2178960340\n- https://github.com/advisories/GHSA-m5vv-6r4h-3vj9","created":"2024-06-11T18:30:50.000Z","id":1098456,"npm_advisory_id":null,"overview":"Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.","reported_by":null,"title":"Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability","metadata":null,"cves":["CVE-2024-35255"],"access":"public","severity":"moderate","module_name":"@azure/identity","vulnerable_versions":"<4.2.1","github_advisory_id":"GHSA-m5vv-6r4h-3vj9","recommendation":"Upgrade to version 4.2.1 or later","patched_versions":">=4.2.1","updated":"2024-08-07T05:01:40.000Z","cvss":{"score":5.5,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-362"],"url":"https://github.com/advisories/GHSA-m5vv-6r4h-3vj9"},"1100563":{"findings":[{"version":"7.0.3","paths":["cross-env>cross-spawn"]}],"found_by":null,"deleted":null,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2024-21538\n- https://github.com/moxystudio/node-cross-spawn/pull/160\n- https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff\n- https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f\n- https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230\n- https://github.com/moxystudio/node-cross-spawn/issues/165\n- https://github.com/moxystudio/node-cross-spawn/commit/d35c865b877d2f9ded7c1ed87521c2fdb689c8dd\n- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349\n- https://github.com/advisories/GHSA-3xgq-45jj-v275","created":"2024-11-08T06:30:47.000Z","id":1100563,"npm_advisory_id":null,"overview":"Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.","reported_by":null,"title":"Regular Expression Denial of Service (ReDoS) in cross-spawn","metadata":null,"cves":["CVE-2024-21538"],"access":"public","severity":"high","module_name":"cross-spawn","vulnerable_versions":">=7.0.0 <7.0.5","github_advisory_id":"GHSA-3xgq-45jj-v275","recommendation":"Upgrade to version 7.0.5 or later","patched_versions":">=7.0.5","updated":"2024-11-19T16:19:50.000Z","cvss":{"score":7.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"cwe":["CWE-1333"],"url":"https://github.com/advisories/GHSA-3xgq-45jj-v275"}},"muted":[],"metadata":{"vulnerabilities":{"info":0,"low":0,"moderate":4,"high":1,"critical":0},"dependencies":312,"devDependencies":0,"optionalDependencies":0,"totalDependencies":312}}
+{"actions":[],"advisories":{"1100563":{"findings":[{"version":"7.0.3","paths":["cross-env>cross-spawn"]}],"found_by":null,"deleted":null,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2024-21538\n- https://github.com/moxystudio/node-cross-spawn/pull/160\n- https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff\n- https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f\n- https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230\n- https://github.com/moxystudio/node-cross-spawn/issues/165\n- https://github.com/moxystudio/node-cross-spawn/commit/d35c865b877d2f9ded7c1ed87521c2fdb689c8dd\n- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-8366349\n- https://github.com/advisories/GHSA-3xgq-45jj-v275","created":"2024-11-08T06:30:47.000Z","id":1100563,"npm_advisory_id":null,"overview":"Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.","reported_by":null,"title":"Regular Expression Denial of Service (ReDoS) in cross-spawn","metadata":null,"cves":["CVE-2024-21538"],"access":"public","severity":"high","module_name":"cross-spawn","vulnerable_versions":">=7.0.0 <7.0.5","github_advisory_id":"GHSA-3xgq-45jj-v275","recommendation":"Upgrade to version 7.0.5 or later","patched_versions":">=7.0.5","updated":"2024-11-19T16:19:50.000Z","cvss":{"score":7.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"cwe":["CWE-1333"],"url":"https://github.com/advisories/GHSA-3xgq-45jj-v275"}},"muted":[],"metadata":{"vulnerabilities":{"info":0,"low":0,"moderate":0,"high":1,"critical":0},"dependencies":203,"devDependencies":0,"optionalDependencies":0,"totalDependencies":203}}