crítica
CVE-2018-3750
nodejs-deep-extend: Prototype pollution can allow attackers to modify object properties
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.2CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA. Más baja según AlmaLinux (media), Rocky Linux (media), Ubuntu (media), Red Hat (baja).
Descripción
The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| npm::GitHub Security Advisory npm | deep-extend | 0.5.1 |
| alma 8 | nodejs:10::nodejs-nodemon, nodejs:10::nodejs-packaging | 2.0.3-1.module_el8.4.0+2521+c668cc9f y 1 más |
| debian 11 | node-deep-extend | 0.4.1-2 |
| debian 12 | node-deep-extend | 0.4.1-2 |
| debian 13 | node-deep-extend | 0.4.1-2 |
| debian 14 | node-deep-extend | 0.4.1-2 |
| echo | node-deep-extend | 0.4.1-2 |
| Red Hat | nodejs:10::nodejs-nodemon | sin corrección indicada |
| rocky 8 | nodejs:12::nodejs-nodemon, nodejs:12::nodejs-packaging | 2.0.3-1.module+el8.6.0+982+9fdca2d4 y 1 más |
| ubuntu 18.04-ESM | node-deep-extend | sin corrección indicada |
Mostrar las 12 entradas de 10 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| npm::GitHub Security Advisory npm | deep-extend | 0.5.1 |
| alma 8 | nodejs:10::nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| alma 8 | nodejs:10::nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| debian 11 | node-deep-extend | 0.4.1-2 |
| debian 12 | node-deep-extend | 0.4.1-2 |
| debian 13 | node-deep-extend | 0.4.1-2 |
| debian 14 | node-deep-extend | 0.4.1-2 |
| echo | node-deep-extend | 0.4.1-2 |
| Red Hat | nodejs:10::nodejs-nodemon | sin corrección indicada |
| rocky 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module+el8.6.0+982+9fdca2d4 |
| rocky 8 | nodejs:12::nodejs-packaging | 17-3.module+el8.3.0+101+f84c7154 |
| ubuntu 18.04-ESM | node-deep-extend | sin corrección indicada |
Referencias
- https://access.redhat.com/security/cve/CVE-2018-3750
- https://bugzilla.redhat.com/show_bug.cgi?id=1795475
- https://bugzilla.redhat.com/show_bug.cgi?id=1795479
- https://bugzilla.redhat.com/show_bug.cgi?id=1892430
- https://bugzilla.redhat.com/show_bug.cgi?id=1907444
- https://bugzilla.redhat.com/show_bug.cgi?id=1912854
- https://bugzilla.redhat.com/show_bug.cgi?id=1912863
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3750
Las 25 referencias
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10746
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10747
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7754
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8265
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8287
- https://errata.almalinux.org/8/ALSA-2021-0549.html
- https://errata.rockylinux.org/RLSA-2021:0549
- https://github.com/advisories/GHSA-hr2v-3952-633q
- https://github.com/unclechu/node-deep-extend/commit/9423fae877e2ab6b4aecc4db79a0ed63039d4703
- https://github.com/unclechu/node-deep-extend/issues/39
- https://github.com/unclechu/node-deep-extend/pull/40
- https://hackerone.com/reports/311333
- https://nodesecurity.io/advisories/612
- https://nvd.nist.gov/vuln/detail/CVE-2018-3750
- https://www.cve.org/CVERecord?id=CVE-2018-3750
- https://www.npmjs.com/advisories/612