crítica
CVE-2019-10747
nodejs-set-value: prototype pollution in function set-value
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.2CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA. Más baja según Red Hat (alta), AlmaLinux (media), Oracle (media), Rocky Linux (media).
Descripción
set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and _proto_ payloads.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| npm::GitHub Security Advisory npm | set-value | 2.0.1, 3.0.1 |
| alma 8 | nodejs:10::nodejs-nodemon, nodejs:10::nodejs-packaging | 2.0.3-1.module_el8.4.0+2521+c668cc9f y 1 más |
| debian 10 | node-set-value | 0.4.0-1+deb10u1 |
| debian 11 | node-set-value | 0.4.0-2 |
| debian 12 | node-set-value | 0.4.0-2 |
| debian 13 | node-set-value | 0.4.0-2 |
| debian 14 | node-set-value | 0.4.0-2 |
| debian 9 | node-set-value | sin corrección indicada |
| echo | node-set-value | 0.4.0-2 |
| Oracle Linux 8 | nodejs, nodejs-devel, nodejs-docs y 4 más | 1:12.20.1-1.module+el8.3.0+9643+8c99e187 y 3 más |
| Red Hat | kibana, nodejs:10::nodejs-nodemon | sin corrección indicada |
| rocky 8 | nodejs:12::nodejs-nodemon, nodejs:12::nodejs-packaging | 2.0.3-1.module+el8.6.0+982+9fdca2d4 y 1 más |
Mostrar las 21 entradas de 12 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| npm::GitHub Security Advisory npm | set-value | 2.0.1, 3.0.1 |
| alma 8 | nodejs:10::nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| alma 8 | nodejs:10::nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| debian 10 | node-set-value | 0.4.0-1+deb10u1 |
| debian 11 | node-set-value | 0.4.0-2 |
| debian 12 | node-set-value | 0.4.0-2 |
| debian 13 | node-set-value | 0.4.0-2 |
| debian 14 | node-set-value | 0.4.0-2 |
| debian 9 | node-set-value | sin corrección indicada |
| echo | node-set-value | 0.4.0-2 |
| Oracle Linux 8 | nodejs | 1:12.20.1-1.module+el8.3.0+9643+8c99e187 |
| Oracle Linux 8 | nodejs-devel | 1:12.20.1-1.module+el8.3.0+9643+8c99e187 |
| Oracle Linux 8 | nodejs-docs | 1:12.20.1-1.module+el8.3.0+9643+8c99e187 |
| Oracle Linux 8 | nodejs-full-i18n | 1:12.20.1-1.module+el8.3.0+9643+8c99e187 |
| Oracle Linux 8 | nodejs-nodemon | 2.0.3-1.module+el8.3.0+9643+8c99e187 |
| Oracle Linux 8 | nodejs-packaging | 17-3.module+el8.1.0+5393+aaf413e3 |
| Oracle Linux 8 | npm | 1:6.14.10-1.12.20.1.1.module+el8.3.0+9643+8c99e187 |
| Red Hat | kibana | sin corrección indicada |
| Red Hat | nodejs:10::nodejs-nodemon | sin corrección indicada |
| rocky 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module+el8.6.0+982+9fdca2d4 |
| rocky 8 | nodejs:12::nodejs-packaging | 17-3.module+el8.3.0+101+f84c7154 |
Referencias
- https://access.redhat.com/security/cve/CVE-2019-10747
- https://bugzilla.redhat.com/show_bug.cgi?id=1795475
- https://bugzilla.redhat.com/show_bug.cgi?id=1795479
- https://bugzilla.redhat.com/show_bug.cgi?id=1892430
- https://bugzilla.redhat.com/show_bug.cgi?id=1907444
- https://bugzilla.redhat.com/show_bug.cgi?id=1912854
- https://bugzilla.redhat.com/show_bug.cgi?id=1912863
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3750
Las 29 referencias
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10746
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10747
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7754
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8265
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8287
- https://errata.almalinux.org/8/ALSA-2021-0549.html
- https://errata.rockylinux.org/RLSA-2021:0549
- https://github.com/jonschlinkert/set-value/commit/95e9d9923f8a8b4a01da1ea138fcc39ec7b6b15f
- https://github.com/jonschlinkert/set-value/commit/cb12f14955dde6e61829d70d1851bfea6a3c31ad
- https://linux.oracle.com/cve/CVE-2019-10747.html
- https://linux.oracle.com/errata/ELSA-2021-0549.html
- https://lists.apache.org/thread.html/b46f35559c4a97cf74d2dd7fe5a48f8abf2ff37f879083920af9b292@%3Cdev.drat.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EJ36KV6MXQPUYTFCCTDY54E5Y7QP3AV
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3EJ36KV6MXQPUYTFCCTDY54E5Y7QP3AV/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E3HNLQZQINMZK6GYB2UTKK4VU7WBV2OT
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E3HNLQZQINMZK6GYB2UTKK4VU7WBV2OT/
- https://nvd.nist.gov/vuln/detail/CVE-2019-10747
- https://snyk.io/vuln/SNYK-JS-SETVALUE-450213
- https://www.cve.org/CVERecord?id=CVE-2019-10747
- https://www.npmjs.com/advisories/1012