kritisch
CVE-2018-3750
nodejs-deep-extend: Prototype pollution can allow attackers to modify object properties
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.2CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA. Niedriger laut AlmaLinux (mittel), Rocky Linux (mittel), Ubuntu (mittel), Red Hat (niedrig).
Beschreibung
The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| npm::GitHub Security Advisory npm | deep-extend | 0.5.1 |
| alma 8 | nodejs:10::nodejs-nodemon, nodejs:10::nodejs-packaging | 2.0.3-1.module_el8.4.0+2521+c668cc9f und 1 weitere |
| debian 11 | node-deep-extend | 0.4.1-2 |
| debian 12 | node-deep-extend | 0.4.1-2 |
| debian 13 | node-deep-extend | 0.4.1-2 |
| debian 14 | node-deep-extend | 0.4.1-2 |
| echo | node-deep-extend | 0.4.1-2 |
| Red Hat | nodejs:10::nodejs-nodemon | kein Fix angegeben |
| rocky 8 | nodejs:12::nodejs-nodemon, nodejs:12::nodejs-packaging | 2.0.3-1.module+el8.6.0+982+9fdca2d4 und 1 weitere |
| ubuntu 18.04-ESM | node-deep-extend | kein Fix angegeben |
Alle 12 Einträge aus 10 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| npm::GitHub Security Advisory npm | deep-extend | 0.5.1 |
| alma 8 | nodejs:10::nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| alma 8 | nodejs:10::nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| debian 11 | node-deep-extend | 0.4.1-2 |
| debian 12 | node-deep-extend | 0.4.1-2 |
| debian 13 | node-deep-extend | 0.4.1-2 |
| debian 14 | node-deep-extend | 0.4.1-2 |
| echo | node-deep-extend | 0.4.1-2 |
| Red Hat | nodejs:10::nodejs-nodemon | kein Fix angegeben |
| rocky 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module+el8.6.0+982+9fdca2d4 |
| rocky 8 | nodejs:12::nodejs-packaging | 17-3.module+el8.3.0+101+f84c7154 |
| ubuntu 18.04-ESM | node-deep-extend | kein Fix angegeben |
Referenzen
- https://access.redhat.com/security/cve/CVE-2018-3750
- https://bugzilla.redhat.com/show_bug.cgi?id=1795475
- https://bugzilla.redhat.com/show_bug.cgi?id=1795479
- https://bugzilla.redhat.com/show_bug.cgi?id=1892430
- https://bugzilla.redhat.com/show_bug.cgi?id=1907444
- https://bugzilla.redhat.com/show_bug.cgi?id=1912854
- https://bugzilla.redhat.com/show_bug.cgi?id=1912863
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3750
Alle 25 Referenzen
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10746
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10747
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7754
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8265
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8287
- https://errata.almalinux.org/8/ALSA-2021-0549.html
- https://errata.rockylinux.org/RLSA-2021:0549
- https://github.com/advisories/GHSA-hr2v-3952-633q
- https://github.com/unclechu/node-deep-extend/commit/9423fae877e2ab6b4aecc4db79a0ed63039d4703
- https://github.com/unclechu/node-deep-extend/issues/39
- https://github.com/unclechu/node-deep-extend/pull/40
- https://hackerone.com/reports/311333
- https://nodesecurity.io/advisories/612
- https://nvd.nist.gov/vuln/detail/CVE-2018-3750
- https://www.cve.org/CVERecord?id=CVE-2018-3750
- https://www.npmjs.com/advisories/612