CVE-2020-15256
object-path: Prototype pollution could result in DoS or RCE
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según GHSA (alta), Red Hat (alta), Ubuntu (baja).
Descripción
A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInheritedProps` mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of `object-path` and setting the option `includeInheritedProps: true`, or by using the default `withInheritedProps` instance. The default operating mode is not affected by the vulnerability if version >= 0.11.0 is used. Any usage of `set()` in versions < 0.11.0 is vulnerable. The issue is fixed in object-path version 0.11.5 As a workaround, don't use the `includeInheritedProps: true` options or the `withInheritedProps` instance if using a version >= 0.11.0.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 10 | node-object-path | 0.11.4-2+deb10u1 |
| debian 11 | node-object-path | 0.11.5-3 |
| debian 12 | node-object-path | 0.11.5-3 |
| debian 13 | node-object-path | 0.11.5-3 |
| debian 14 | node-object-path | 0.11.5-3 |
| debian 9 | node-object-path | sin corrección indicada |
| echo | node-object-path | 0.11.5-3 |
| npm::GitHub Security Advisory npm | object-path | 0.11.5 |
| ubuntu 18.04 | node-object-path | 0.11.3-1ubuntu0.1 |
| ubuntu 18.04-ESM | node-object-path | 0.11.3-1ubuntu0.1 |
| ubuntu 20.04 | node-object-path | 0.11.4-2ubuntu0.1 |
| ubuntu 20.04-ESM | node-object-path | 0.11.4-2ubuntu0.1 |
Referencias
- https://access.redhat.com/security/cve/CVE-2020-15256
- https://github.com/mariocasciaro/object-path
- https://github.com/mariocasciaro/object-path/commit/2be3354c6c46215c7635eb1b76d80f1319403c68
- https://github.com/mariocasciaro/object-path/security/advisories/GHSA-cwx2-736x-mf6w
- https://nvd.nist.gov/vuln/detail/CVE-2020-15256
- https://ubuntu.com/security/notices/USN-5967-1
- https://www.cve.org/CVERecord?id=CVE-2020-15256