CVE-2024-4067 and CVE-2024-4068 - Real vulnerabilities or just non-security bugs? about micromatch HOT 5 CLOSED

1. Do you have plans to request a DISPUTE from mitre?

On one hand this isn't that big of a problem for me. It's pretty simple for me to patch the library. On the other hand, I care more that the community will have to spend time updating their projects and it seems to be causing a lot of stress for devs who are concerned about the security of their projects. I'm not sure if disputing it makes sense yet.

Given the amount of effort involved in disputes, I'm unlikely to do this formally as I'm very limited in my time at the moment.

2. Does this attitude make any sense?

Yes, lowering it from HIGH to LOW does make sense.

from micromatch.

Fine, thanks.
I see that braces 3.0.3 and micromatch 4.0.6 were released, so I see both issues as resolved. We can close this discussion for now.

from micromatch.

@jonschlinkert Has CVE-2024-4067 been addresses in the lastest version of micromatch 4.0.7? My security report shows there still a vulnerability.

from micromatch.

Hi @noren95, thanks for looking into this and creating the issue.

1. Should those CVEs be revoked? (or at least disputed in Mitre?) - are they a complete False Positive?

My opinion is that GHSA-grv7-fg5c-xmjg should be revoked. Both should at least be downgraded.

2. If we choose to take the CVEs into account - do you recommend lowering the CVSS score, since 7.5 does not make any sense.

Yes, I think it would make sense to lower the score on both, if not revoked.

3. Regardless of vuls/bugs - can you confirm that those are the fixes for the issues?

Yes, 81e4d93 is a solution.

There are a couple of optimizations being discussed for GHSA-grv7-fg5c-xmjg.

Let me know if you have any more questions.

from micromatch.

@jonschlinkert Thank you for the prompt response!

1. Do you have plans to request a DISPUTE from mitre?
2. Assuming we're going with score decrease- If we consider the attack complexity as high, it drops from HIGH to LOW - as this is not that reasonable to leverage it to a real attack or exploit that puts security aspect in danger. Does this attitude make any sense?

from micromatch.