Regular Expression Denial of Service (ReDoS)

[larrycameron80]

Regular Expression Denial of Service (ReDoS)
Vulnerable module: diff
Introduced through: truffle@4.1.5
Detailed paths
Introduced through: erc20-tokens@ConsenSys/Tokens#df959c7db75cc5fbb1591775353733958b3ceca1 › truffle@4.1.5 › mocha@3.5.3 › diff@3.2.0
Remediation: Upgrade to truffle@5.0.24.
Overview
diff is a javascript text differencing implementation.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks. This can cause an impact of about 10 seconds matching time for data 48K characters long.