[FP]: webpack@4.46.0 CVE-2023-28154

[aliu-vmware]

Package URl

pkg:npm/webpack@4.46.0

CPE

cpe:2.3:a:webpack.js:webpack:4.46.0:::::::*

CVE

CVE-2023-28154

ODC Integration

None

ODC Version

8.4.0

Description

CVE reports "Webpack 5 before 5.76.0", but the proper range is 5.0.0 -> 5.76.0, Webpack 4 is unaffected.

See: webpack/webpack#16500 (comment)

[github-actions]

Npm Coordinates

npm -i webpack@4.46.0

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #5933
   ]]></notes>
   <packageUrl regex="true">^pkg:npm/webpack@.*$</packageUrl>
   <cpe>cpe:/a:webpack.js:webpack</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/6178615557

[github-actions]

Npm Coordinates

npm -i webpack@4.46.0

Suppression rule:

<suppress base="true">
   <notes><![CDATA[
   FP per issue #5933
   ]]></notes>
   <packageUrl regex="true">^pkg:npm/webpack@.*$</packageUrl>
   <cpe>cpe:/a:webpack.js:webpack</cpe>
</suppress>

Link to test results: https://github.com/jeremylong/DependencyCheck/actions/runs/6178621246

[aikebah]

4.46 is currently labeled as vulnerable to the CVE. This is either a lack of version-info linking at Sonatype, or their researchers consider older versions vulnerable as well. You should raise your concerns with Sonatype. See https://ossindex.sonatype.org/component/pkg:npm/webpack@4.46.0

[aliu-vmware]

Thanks, I'll do that.