resolve-url-loader-4.0.0.tgz: 6 vulnerabilities (highest severity is: 9.8) unreachable

<details><summary><img src='https://whitesource-resources.whitesourcesoftware.com/vulnerability_details.png' width=19 height=20> Vulnerable Library - resolve-url-loader-4.0.0.tgz</summary>


Path to dependency file: /package.json
Path to vulnerable library: /node_modules/coffee-loader/node_modules/loader-utils/package.json,/node_modules/sass-loader/node_modules/loader-utils/package.json,/node_modules/resolve-url-loader/node_modules/loader-utils/package.json,/node_modules/@rails/webpacker/node_modules/style-loader/node_modules/loader-utils/package.json,/node_modules/css-loader/node_modules/loader-utils/package.json,/node_modules/file-loader/node_modules/loader-utils/package.json,/node_modules/style-loader/node_modules/loader-utils/package.json



Found in HEAD commit: <a href="https://github.com/Nexmo/station/commit/1e5781423c543a0c9bfedb4c5a57ca049920974b">1e5781423c543a0c9bfedb4c5a57ca049920974b</a></details>

## Vulnerabilities

| CVE | Severity | <img src='https://whitesource-resources.whitesourcesoftware.com/cvss3.png' width=19 height=20> CVSS | Exploit Maturity | EPSS | Dependency | Type | Fixed in (resolve-url-loader version) | Remediation Possible** | Reachability |
| ------------- | ------------- | ----- | ----- | ----- | ----- | ----- | ------------- | --- | --- |
| [CVE-2022-37601](https://www.mend.io/vulnerability-database/CVE-2022-37601) | <img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> Critical | 9.8 | Not Defined | 2.3% | loader-utils-2.0.0.tgz | Transitive | 5.0.0 | &#9989;|<img src='https://whitesource-resources.whitesourcesoftware.com/viaGreen.png' width=19 height=20> Unreachable |
| [CVE-2022-37603](https://www.mend.io/vulnerability-database/CVE-2022-37603) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | Not Defined | 1.5% | loader-utils-2.0.0.tgz | Transitive | 5.0.0 | &#9989;|<img src='https://whitesource-resources.whitesourcesoftware.com/viaGreen.png' width=19 height=20> Unreachable |
| [CVE-2022-37599](https://www.mend.io/vulnerability-database/CVE-2022-37599) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | Not Defined | 0.3% | loader-utils-2.0.0.tgz | Transitive | 5.0.0 | &#9989;|<img src='https://whitesource-resources.whitesourcesoftware.com/viaGreen.png' width=19 height=20> Unreachable |
| [CVE-2023-44270](https://www.mend.io/vulnerability-database/CVE-2023-44270) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 5.3 | Not Defined | 0.1% | postcss-7.0.35.tgz | Transitive | N/A* | &#10060;|<img src='https://whitesource-resources.whitesourcesoftware.com/viaGreen.png' width=19 height=20> Unreachable |
| [CVE-2021-23382](https://www.mend.io/vulnerability-database/CVE-2021-23382) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 5.3 | Not Defined | 0.2% | postcss-7.0.35.tgz | Transitive | 5.0.0 | &#9989;|<img src='https://whitesource-resources.whitesourcesoftware.com/viaGreen.png' width=19 height=20> Unreachable |
| [CVE-2021-23368](https://www.mend.io/vulnerability-database/CVE-2021-23368) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 5.3 | Not Defined | 0.3% | postcss-7.0.35.tgz | Transitive | 5.0.0 | &#9989;|<img src='https://whitesource-resources.whitesourcesoftware.com/viaGreen.png' width=19 height=20> Unreachable |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

## Details

<details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> <img src='https://whitesource-resources.whitesourcesoftware.com/viaGreen.png' width=19 height=20> CVE-2022-37601</summary>


### Vulnerable Library - loader-utils-2.0.0.tgz

utils for webpack loaders
Library home page: <a href="https://registry.npmjs.org/loader-utils/-/loader-utils-2.0.0.tgz">https://registry.npmjs.org/loader-utils/-/loader-utils-2.0.0.tgz</a>
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/coffee-loader/node_modules/loader-utils/package.json,/node_modules/sass-loader/node_modules/loader-utils/package.json,/node_modules/resolve-url-loader/node_modules/loader-utils/package.json,/node_modules/@rails/webpacker/node_modules/style-loader/node_modules/loader-utils/package.json,/node_modules/css-loader/node_modules/loader-utils/package.json,/node_modules/file-loader/node_modules/loader-utils/package.json,/node_modules/style-loader/node_modules/loader-utils/package.json


Dependency Hierarchy:
 - resolve-url-loader-4.0.0.tgz (Root Library)
 - :x: **loader-utils-2.0.0.tgz** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Nexmo/station/commit/1e5781423c543a0c9bfedb4c5a57ca049920974b">1e5781423c543a0c9bfedb4c5a57ca049920974b</a>
Found in base branch: main




### Reachability Analysis
The vulnerable code is unreachable






### Vulnerability Details
 
 
Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

Publish Date: 2022-10-12
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2022-37601>CVE-2022-37601</a>




### Threat Assessment
 

Exploit Maturity: Not Defined
EPSS: 2.3%




### CVSS 3 Score Details (9.8)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/advisories/GHSA-76p3-8jx3-jpfq">https://github.com/advisories/GHSA-76p3-8jx3-jpfq</a>
Release Date: 2022-10-12
Fix Resolution (loader-utils): 2.0.3
Direct dependency fix Resolution (resolve-url-loader): 5.0.0






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> <img src='https://whitesource-resources.whitesourcesoftware.com/viaGreen.png' width=19 height=20> CVE-2022-37603</summary>


### Vulnerable Library - loader-utils-2.0.0.tgz

utils for webpack loaders
Library home page: <a href="https://registry.npmjs.org/loader-utils/-/loader-utils-2.0.0.tgz">https://registry.npmjs.org/loader-utils/-/loader-utils-2.0.0.tgz</a>
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/coffee-loader/node_modules/loader-utils/package.json,/node_modules/sass-loader/node_modules/loader-utils/package.json,/node_modules/resolve-url-loader/node_modules/loader-utils/package.json,/node_modules/@rails/webpacker/node_modules/style-loader/node_modules/loader-utils/package.json,/node_modules/css-loader/node_modules/loader-utils/package.json,/node_modules/file-loader/node_modules/loader-utils/package.json,/node_modules/style-loader/node_modules/loader-utils/package.json


Dependency Hierarchy:
 - resolve-url-loader-4.0.0.tgz (Root Library)
 - :x: **loader-utils-2.0.0.tgz** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Nexmo/station/commit/1e5781423c543a0c9bfedb4c5a57ca049920974b">1e5781423c543a0c9bfedb4c5a57ca049920974b</a>
Found in base branch: main




### Reachability Analysis
The vulnerable code is unreachable






### Vulnerability Details
 
 
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.

Publish Date: 2022-10-14
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2022-37603>CVE-2022-37603</a>




### Threat Assessment
 

Exploit Maturity: Not Defined
EPSS: 1.5%




### CVSS 3 Score Details (7.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/advisories/GHSA-3rfm-jhwj-7488">https://github.com/advisories/GHSA-3rfm-jhwj-7488</a>
Release Date: 2022-10-14
Fix Resolution (loader-utils): 2.0.4
Direct dependency fix Resolution (resolve-url-loader): 5.0.0






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> <img src='https://whitesource-resources.whitesourcesoftware.com/viaGreen.png' width=19 height=20> CVE-2022-37599</summary>


### Vulnerable Library - loader-utils-2.0.0.tgz

utils for webpack loaders
Library home page: <a href="https://registry.npmjs.org/loader-utils/-/loader-utils-2.0.0.tgz">https://registry.npmjs.org/loader-utils/-/loader-utils-2.0.0.tgz</a>
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/coffee-loader/node_modules/loader-utils/package.json,/node_modules/sass-loader/node_modules/loader-utils/package.json,/node_modules/resolve-url-loader/node_modules/loader-utils/package.json,/node_modules/@rails/webpacker/node_modules/style-loader/node_modules/loader-utils/package.json,/node_modules/css-loader/node_modules/loader-utils/package.json,/node_modules/file-loader/node_modules/loader-utils/package.json,/node_modules/style-loader/node_modules/loader-utils/package.json


Dependency Hierarchy:
 - resolve-url-loader-4.0.0.tgz (Root Library)
 - :x: **loader-utils-2.0.0.tgz** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Nexmo/station/commit/1e5781423c543a0c9bfedb4c5a57ca049920974b">1e5781423c543a0c9bfedb4c5a57ca049920974b</a>
Found in base branch: main




### Reachability Analysis
The vulnerable code is unreachable






### Vulnerability Details
 
 
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js.

Publish Date: 2022-10-11
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2022-37599>CVE-2022-37599</a>




### Threat Assessment
 

Exploit Maturity: Not Defined
EPSS: 0.3%




### CVSS 3 Score Details (7.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/advisories/GHSA-hhq3-ff78-jv3g">https://github.com/advisories/GHSA-hhq3-ff78-jv3g</a>
Release Date: 2022-10-11
Fix Resolution (loader-utils): 2.0.3
Direct dependency fix Resolution (resolve-url-loader): 5.0.0






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> <img src='https://whitesource-resources.whitesourcesoftware.com/viaGreen.png' width=19 height=20> CVE-2023-44270</summary>


### Vulnerable Library - postcss-7.0.35.tgz

Tool for transforming styles with JS plugins
Library home page: <a href="https://registry.npmjs.org/postcss/-/postcss-7.0.35.tgz">https://registry.npmjs.org/postcss/-/postcss-7.0.35.tgz</a>
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/postcss/package.json


Dependency Hierarchy:
 - resolve-url-loader-4.0.0.tgz (Root Library)
 - :x: **postcss-7.0.35.tgz** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Nexmo/station/commit/1e5781423c543a0c9bfedb4c5a57ca049920974b">1e5781423c543a0c9bfedb4c5a57ca049920974b</a>
Found in base branch: main




### Reachability Analysis
The vulnerable code is unreachable






### Vulnerability Details
 
 
An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.

Publish Date: 2023-09-29
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2023-44270>CVE-2023-44270</a>




### Threat Assessment
 

Exploit Maturity: Not Defined
EPSS: 0.1%




### CVSS 3 Score Details (5.3)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: Low
 - Availability Impact: None

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/advisories/GHSA-7fh5-64p2-3v2j">https://github.com/advisories/GHSA-7fh5-64p2-3v2j</a>
Release Date: 2023-09-29
Fix Resolution: postcss - 8.4.31





</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> <img src='https://whitesource-resources.whitesourcesoftware.com/viaGreen.png' width=19 height=20> CVE-2021-23382</summary>


### Vulnerable Library - postcss-7.0.35.tgz

Tool for transforming styles with JS plugins
Library home page: <a href="https://registry.npmjs.org/postcss/-/postcss-7.0.35.tgz">https://registry.npmjs.org/postcss/-/postcss-7.0.35.tgz</a>
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/postcss/package.json


Dependency Hierarchy:
 - resolve-url-loader-4.0.0.tgz (Root Library)
 - :x: **postcss-7.0.35.tgz** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Nexmo/station/commit/1e5781423c543a0c9bfedb4c5a57ca049920974b">1e5781423c543a0c9bfedb4c5a57ca049920974b</a>
Found in base branch: main




### Reachability Analysis
The vulnerable code is unreachable






### Vulnerability Details
 
 
The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).

Publish Date: 2021-04-26
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2021-23382>CVE-2021-23382</a>




### Threat Assessment
 

Exploit Maturity: Not Defined
EPSS: 0.2%




### CVSS 3 Score Details (5.3)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: Low

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23382">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23382</a>
Release Date: 2021-04-26
Fix Resolution (postcss): 7.0.36
Direct dependency fix Resolution (resolve-url-loader): 5.0.0






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> <img src='https://whitesource-resources.whitesourcesoftware.com/viaGreen.png' width=19 height=20> CVE-2021-23368</summary>


### Vulnerable Library - postcss-7.0.35.tgz

Tool for transforming styles with JS plugins
Library home page: <a href="https://registry.npmjs.org/postcss/-/postcss-7.0.35.tgz">https://registry.npmjs.org/postcss/-/postcss-7.0.35.tgz</a>
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/postcss/package.json


Dependency Hierarchy:
 - resolve-url-loader-4.0.0.tgz (Root Library)
 - :x: **postcss-7.0.35.tgz** (Vulnerable Library)
Found in HEAD commit: <a href="https://github.com/Nexmo/station/commit/1e5781423c543a0c9bfedb4c5a57ca049920974b">1e5781423c543a0c9bfedb4c5a57ca049920974b</a>
Found in base branch: main




### Reachability Analysis
The vulnerable code is unreachable






### Vulnerability Details
 
 
The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.

Publish Date: 2021-04-12
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2021-23368>CVE-2021-23368</a>




### Threat Assessment
 

Exploit Maturity: Not Defined
EPSS: 0.3%




### CVSS 3 Score Details (5.3)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: Low

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23368">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23368</a>
Release Date: 2021-04-12
Fix Resolution (postcss): 7.0.36
Direct dependency fix Resolution (resolve-url-loader): 5.0.0






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details>

***

:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.

CVE	Severity	CVSS	Exploit Maturity	EPSS	Dependency	Type	Fixed in (resolve-url-loader version)	Remediation Possible**	Reachability
CVE-2022-37601	Critical	9.8	Not Defined	2.3%	loader-utils-2.0.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2022-37603	High	7.5	Not Defined	1.5%	loader-utils-2.0.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2022-37599	High	7.5	Not Defined	0.3%	loader-utils-2.0.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2023-44270	Medium	5.3	Not Defined	0.1%	postcss-7.0.35.tgz	Transitive	N/A*	❌	Unreachable
CVE-2021-23382	Medium	5.3	Not Defined	0.2%	postcss-7.0.35.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-23368	Medium	5.3	Not Defined	0.3%	postcss-7.0.35.tgz	Transitive	5.0.0	✅	Unreachable

resolve-url-loader-4.0.0.tgz: 6 vulnerabilities (highest severity is: 9.8) unreachable #1991

Description

Vulnerabilities

Details

Vulnerable Library - loader-utils-2.0.0.tgz

Reachability Analysis

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (9.8)

Suggested Fix

Vulnerable Library - loader-utils-2.0.0.tgz

Reachability Analysis

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - loader-utils-2.0.0.tgz

Reachability Analysis

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - postcss-7.0.35.tgz

Reachability Analysis

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (5.3)

Suggested Fix

Vulnerable Library - postcss-7.0.35.tgz

Reachability Analysis

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (5.3)

Suggested Fix

Vulnerable Library - postcss-7.0.35.tgz

Reachability Analysis

Vulnerability Details

Threat Assessment

CVSS 3 Score Details (5.3)

Suggested Fix

Activity

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions