kritisch
CVE-2020-7788
nodejs-ini: Prototype pollution via malicious INI file
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Red Hat7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut GHSA (hoch), Red Hat (mittel), AlmaLinux (mittel), Oracle (mittel), Rocky Linux (mittel), Ubuntu (mittel).
Beschreibung
This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| alma 8 | nodejs:10::nodejs-nodemon, nodejs:10::nodejs-packaging, nodejs:12::nodejs-nodemon und 15 weitere | 2.0.3-1.module_el8.4.0+2521+c668cc9f und 10 weitere |
| alma 9 | nodejs, nodejs-docs, nodejs-full-i18n und 3 weitere | 1:16.16.0-1.el9_0 und 2 weitere |
| chainguard | code-server, commercial-gitlab-rails-ee-19.2, commercial-gitlab-rails-ee-19.3 und 38 weitere | 0 |
| debian 10 | node-ini | 1.3.5-1+deb10u1 |
| debian 11 | node-ini | 2.0.0-1 |
| debian 12 | node-ini | 2.0.0-1 |
| debian 13 | node-ini | 2.0.0-1 |
| debian 14 | node-ini | 2.0.0-1 |
| debian 9 | node-ini | 1.1.0-1+deb9u1 |
| echo | node-ini | 2.0.0-1 |
| npm::GitHub Security Advisory npm | ini | 1.3.6 |
| Oracle Linux 8 | nodejs, nodejs-devel, nodejs-docs und 4 weitere | 1:16.13.1-3.0.1.module+el8.5.0+20457+52828f44 und 3 weitere |
Alle 124 Einträge aus 23 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| alma 8 | nodejs:10::nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| alma 8 | nodejs:10::nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| alma 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| alma 8 | nodejs:12::nodejs-packaging | 23-3.module_el8.4.0+2522+3bd42762 |
| alma 8 | nodejs:14::nodejs | 1:14.18.2-2.module_el8.5.0+2618+8d46dafd |
| alma 8 | nodejs:14::nodejs-devel | 1:14.18.2-2.module_el8.5.0+2618+8d46dafd |
| alma 8 | nodejs:14::nodejs-docs | 1:14.18.2-2.module_el8.5.0+254+b4526b16 |
| alma 8 | nodejs:14::nodejs-full-i18n | 1:14.18.2-2.module_el8.5.0+2618+8d46dafd |
| alma 8 | nodejs:14::nodejs-nodemon | 2.0.15-1.module_el8.5.0+2605+45d748af |
| alma 8 | nodejs:14::nodejs-packaging | 23-3.module_el8.4.0+2522+3bd42762 |
| alma 8 | nodejs:14::npm | 1:6.14.15-1.14.18.2.2.module_el8.5.0+2618+8d46dafd |
| alma 8 | nodejs:16::nodejs | 1:16.13.1-3.module_el8.5.0+2605+45d748af |
| alma 8 | nodejs:16::nodejs-devel | 1:16.13.1-3.module_el8.5.0+2605+45d748af |
| alma 8 | nodejs:16::nodejs-docs | 1:16.13.1-3.module_el8.5.0+246+05401605 |
| alma 8 | nodejs:16::nodejs-full-i18n | 1:16.13.1-3.module_el8.5.0+2605+45d748af |
| alma 8 | nodejs:16::nodejs-nodemon | 2.0.15-1.module_el8.5.0+2605+45d748af |
| alma 8 | nodejs:16::nodejs-packaging | 25-1.module_el8.5.0+246+05401605 |
| alma 8 | nodejs:16::npm | 1:8.1.2-1.16.13.1.3.module_el8.5.0+2605+45d748af |
| alma 9 | nodejs | 1:16.16.0-1.el9_0 |
| alma 9 | nodejs-docs | 1:16.16.0-1.el9_0 |
| alma 9 | nodejs-full-i18n | 1:16.16.0-1.el9_0 |
| alma 9 | nodejs-libs | 1:16.16.0-1.el9_0 |
| alma 9 | nodejs-nodemon | 2.0.19-1.el9_0 |
| alma 9 | npm | 1:8.11.0-1.16.16.0.1.el9_0 |
| chainguard | code-server | 0 |
| chainguard | commercial-gitlab-rails-ee-19.2 | 0 |
| chainguard | commercial-gitlab-rails-ee-19.3 | 0 |
| chainguard | commercial-gitlab-rails-ee-19.4 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.2 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.3 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.4 | 0 |
| chainguard | gitlab-rails-ce-18.1 | 0 |
| chainguard | gitlab-rails-ce-18.10 | 0 |
| chainguard | gitlab-rails-ce-18.11 | 0 |
| chainguard | gitlab-rails-ce-18.2 | 0 |
| chainguard | gitlab-rails-ce-18.3 | 0 |
| chainguard | gitlab-rails-ce-18.4 | 0 |
| chainguard | gitlab-rails-ce-18.5 | 0 |
| chainguard | gitlab-rails-ce-18.6 | 0 |
| chainguard | gitlab-rails-ce-18.7 | 0 |
| chainguard | gitlab-rails-ce-18.8 | 0 |
| chainguard | gitlab-rails-ce-18.9 | 0 |
| chainguard | gitlab-rails-ce-19.0 | 0 |
| chainguard | gitlab-rails-ce-19.1 | 0 |
| chainguard | gitlab-rails-ce-19.2 | 0 |
| chainguard | gitlab-rails-ce-19.3 | 0 |
| chainguard | gitlab-rails-ce-19.4 | 0 |
| chainguard | gitlab-rails-ce-19.5 | 0 |
| chainguard | gitlab-rails-ce-fips-18.1 | 0 |
| chainguard | gitlab-rails-ce-fips-18.10 | 0 |
| chainguard | gitlab-rails-ce-fips-18.11 | 0 |
| chainguard | gitlab-rails-ce-fips-18.2 | 0 |
| chainguard | gitlab-rails-ce-fips-18.3 | 0 |
| chainguard | gitlab-rails-ce-fips-18.4 | 0 |
| chainguard | gitlab-rails-ce-fips-18.5 | 0 |
| chainguard | gitlab-rails-ce-fips-18.6 | 0 |
| chainguard | gitlab-rails-ce-fips-18.7 | 0 |
| chainguard | gitlab-rails-ce-fips-18.8 | 0 |
| chainguard | gitlab-rails-ce-fips-18.9 | 0 |
| chainguard | gitlab-rails-ce-fips-19.0 | 0 |
| chainguard | gitlab-rails-ce-fips-19.1 | 0 |
| chainguard | gitlab-rails-ce-fips-19.2 | 0 |
| chainguard | gitlab-rails-ce-fips-19.3 | 0 |
| chainguard | gitlab-rails-ce-fips-19.4 | 0 |
| chainguard | gitlab-rails-ce-fips-19.5 | 0 |
| debian 10 | node-ini | 1.3.5-1+deb10u1 |
| debian 11 | node-ini | 2.0.0-1 |
| debian 12 | node-ini | 2.0.0-1 |
| debian 13 | node-ini | 2.0.0-1 |
| debian 14 | node-ini | 2.0.0-1 |
| debian 9 | node-ini | 1.1.0-1+deb9u1 |
| echo | node-ini | 2.0.0-1 |
| npm::GitHub Security Advisory npm | ini | 1.3.6 |
| Oracle Linux 8 | nodejs | 1:16.13.1-3.0.1.module+el8.5.0+20457+52828f44 |
| Oracle Linux 8 | nodejs-devel | 1:16.13.1-3.0.1.module+el8.5.0+20457+52828f44 |
| Oracle Linux 8 | nodejs-docs | 1:16.13.1-3.0.1.module+el8.5.0+20457+52828f44 |
| Oracle Linux 8 | nodejs-full-i18n | 1:16.13.1-3.0.1.module+el8.5.0+20457+52828f44 |
| Oracle Linux 8 | nodejs-nodemon | 2.0.15-1.module+el8.5.0+20489+261d51d3 |
| Oracle Linux 8 | nodejs-packaging | 25-1.module+el8.5.0+20388+4b61e68d |
| Oracle Linux 8 | npm | 1:8.1.2-1.16.13.1.3.0.1.module+el8.5.0+20457+52828f44 |
| Oracle Linux 9 | nodejs | 1:16.16.0-1.el9_0 |
| Oracle Linux 9 | nodejs-docs | 1:16.16.0-1.el9_0 |
| Oracle Linux 9 | nodejs-full-i18n | 1:16.16.0-1.el9_0 |
| Oracle Linux 9 | nodejs-libs | 1:16.16.0-1.el9_0 |
| Oracle Linux 9 | nodejs-nodemon | 2.0.19-1.el9_0 |
| Oracle Linux 9 | npm | 1:8.11.0-1.16.16.0.1.el9_0 |
| rapidfort Oracle Linux 9 | nodejs | 1:16.16.0-1.el9_0 |
| rapidfort Oracle Linux 9 | nodejs-docs | 1:16.16.0-1.el9_0 |
| rapidfort Oracle Linux 9 | nodejs-full-i18n | 1:16.16.0-1.el9_0 |
| rapidfort Oracle Linux 9 | nodejs-libs | 1:16.16.0-1.el9_0 |
| rapidfort Oracle Linux 9 | nodejs-nodemon | 0:2.0.19-1.el9_0 |
| rapidfort Oracle Linux 9 | npm | 1:8.11.0-1.16.16.0.1.el9_0 |
| rocky 8 | nodejs | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs-devel | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs-docs | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs-full-i18n | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs-nodemon | 2.0.15-1.module+el8.6.0+978+59f26232 |
| rocky 8 | nodejs:10::nodejs-nodemon | 1.18.3-1.module+el8.3.0+101+f84c7154 |
| rocky 8 | nodejs:10::nodejs-packaging | 17-3.module+el8.3.0+101+f84c7154 |
| rocky 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module+el8.6.0+982+9fdca2d4 |
| rocky 8 | nodejs:12::nodejs-packaging | 23-3.module+el8.7.0+1071+4bdda2a8 |
| rocky 8 | nodejs:14::nodejs | 1:14.18.2-2.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:14::nodejs-devel | 1:14.18.2-2.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:14::nodejs-docs | 1:14.18.2-2.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:14::nodejs-full-i18n | 1:14.18.2-2.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:14::nodejs-nodemon | 2.0.15-1.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:14::nodejs-packaging | 23-3.module+el8.7.0+1071+4bdda2a8 |
| rocky 8 | nodejs:14::npm | 1:6.14.15-1.14.18.2.2.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:16::nodejs | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:16::nodejs-devel | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:16::nodejs-docs | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:16::nodejs-full-i18n | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:16::nodejs-nodemon | 2.0.15-1.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:16::nodejs-packaging | 25-1.module+el8.6.0+1046+80feca58 |
| rocky 8 | nodejs:16::npm | 1:8.1.2-1.16.13.1.3.module+el8.5.0+721+4c107270 |
| rocky 8 | npm | 1:8.1.2-1.16.13.1.3.module+el8.5.0+721+4c107270 |
| rocky 9 | nodejs-nodemon | 2.0.19-1.el9_0 |
| ubuntu 18.04-ESM | node-ini | kein Fix angegeben |
| ubuntu 20.04-ESM | node-ini | kein Fix angegeben |
| ubuntu 22.04 | node-ini | kein Fix angegeben |
| ubuntu 24.04 | node-ini | kein Fix angegeben |
| ubuntu 26.04 | node-ini | kein Fix angegeben |
| ubuntu 26.10 | node-ini | kein Fix angegeben |
| wolfi | code-server | 0 |
Referenzen
- https://access.redhat.com/errata/RHSA-2022:6595
- https://access.redhat.com/security/cve/CVE-2020-7788
- https://bugzilla.redhat.com/1907444
- https://bugzilla.redhat.com/1945459
- https://bugzilla.redhat.com/1964461
- https://bugzilla.redhat.com/2007557
- https://bugzilla.redhat.com/2098556
- https://bugzilla.redhat.com/2102001
Alle 47 Referenzen
- https://bugzilla.redhat.com/2105422
- https://bugzilla.redhat.com/2105426
- https://bugzilla.redhat.com/2105428
- https://bugzilla.redhat.com/2105430
- https://bugzilla.redhat.com/show_bug.cgi?id=1907444
- https://bugzilla.redhat.com/show_bug.cgi?id=1945459
- https://bugzilla.redhat.com/show_bug.cgi?id=1964461
- https://bugzilla.redhat.com/show_bug.cgi?id=2007557
- https://bugzilla.redhat.com/show_bug.cgi?id=2098556
- https://bugzilla.redhat.com/show_bug.cgi?id=2102001
- https://bugzilla.redhat.com/show_bug.cgi?id=2105422
- https://bugzilla.redhat.com/show_bug.cgi?id=2105426
- https://bugzilla.redhat.com/show_bug.cgi?id=2105428
- https://bugzilla.redhat.com/show_bug.cgi?id=2105430
- https://bugzilla.redhat.com/show_bug.cgi?id=2121019
- https://bugzilla.redhat.com/show_bug.cgi?id=2124299
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33502
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3807
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29244
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32213
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32214
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32215
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33987
- https://errata.almalinux.org/9/ALSA-2022-6595.html
- https://errata.rockylinux.org/RLSA-2022:6595
- https://github.com/npm/ini
- https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1
- https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1%20%28v1.3.6%29
- https://linux.oracle.com/cve/CVE-2020-7788.html
- https://linux.oracle.com/errata/ELSA-2022-6595.html
- https://lists.debian.org/debian-lts-announce/2020/12/msg00032.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-7788
- https://snyk.io/vuln/SNYK-JS-INI-1048974
- https://www.cve.org/CVERecord?id=CVE-2020-7788
- https://www.npmjs.com/advisories/1589