Skip to content
GitLab
Next
    • Why GitLab
    • Pricing
    • Contact Sales
    • Explore
  • Why GitLab
  • Pricing
  • Contact Sales
  • Explore
  • Sign in
  • Get free trial
  • GitLab.orgGitLab.org
  • security-productssecurity-products
  • advisory-database
  • Issues
  • #179

jsonpointer security vulnerability CVE-2021-23820 has link pointing to incorrect repository

The link on the referenced security advisory appears to point to repository for "json-pointer" (whereas the package in question is "jsonpointer"). Checking the npm website here, the correct link should be https://github.com/janl/node-jsonpointer

Looking at the issues on the link just mentioned, I can see no open issue related to the security vulnerability highlighted in CVE-2021-23820. Also, when I run npm audit I am not seeing any security vulnerability on jsonpointer version 5.0.0. Is it possible the two packages "json-pointer" and "jsonpointer" have been confused?

Edited Dec 17, 2021 by Patrick Morton
Assignee
Assign to
Time tracking