crítica
CVE-2020-7788
nodejs-ini: Prototype pollution via malicious INI file
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Red Hat7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según GHSA (alta), Red Hat (media), AlmaLinux (media), Oracle (media), Rocky Linux (media), Ubuntu (media).
Descripción
This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 8 | nodejs:10::nodejs-nodemon, nodejs:10::nodejs-packaging, nodejs:12::nodejs-nodemon y 15 más | 2.0.3-1.module_el8.4.0+2521+c668cc9f y 10 más |
| alma 9 | nodejs, nodejs-docs, nodejs-full-i18n y 3 más | 1:16.16.0-1.el9_0 y 2 más |
| chainguard | code-server, commercial-gitlab-rails-ee-19.2, commercial-gitlab-rails-ee-19.3 y 38 más | 0 |
| debian 10 | node-ini | 1.3.5-1+deb10u1 |
| debian 11 | node-ini | 2.0.0-1 |
| debian 12 | node-ini | 2.0.0-1 |
| debian 13 | node-ini | 2.0.0-1 |
| debian 14 | node-ini | 2.0.0-1 |
| debian 9 | node-ini | 1.1.0-1+deb9u1 |
| echo | node-ini | 2.0.0-1 |
| npm::GitHub Security Advisory npm | ini | 1.3.6 |
| Oracle Linux 8 | nodejs, nodejs-devel, nodejs-docs y 4 más | 1:16.13.1-3.0.1.module+el8.5.0+20457+52828f44 y 3 más |
Mostrar las 124 entradas de 23 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 8 | nodejs:10::nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| alma 8 | nodejs:10::nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| alma 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| alma 8 | nodejs:12::nodejs-packaging | 23-3.module_el8.4.0+2522+3bd42762 |
| alma 8 | nodejs:14::nodejs | 1:14.18.2-2.module_el8.5.0+2618+8d46dafd |
| alma 8 | nodejs:14::nodejs-devel | 1:14.18.2-2.module_el8.5.0+2618+8d46dafd |
| alma 8 | nodejs:14::nodejs-docs | 1:14.18.2-2.module_el8.5.0+254+b4526b16 |
| alma 8 | nodejs:14::nodejs-full-i18n | 1:14.18.2-2.module_el8.5.0+2618+8d46dafd |
| alma 8 | nodejs:14::nodejs-nodemon | 2.0.15-1.module_el8.5.0+2605+45d748af |
| alma 8 | nodejs:14::nodejs-packaging | 23-3.module_el8.4.0+2522+3bd42762 |
| alma 8 | nodejs:14::npm | 1:6.14.15-1.14.18.2.2.module_el8.5.0+2618+8d46dafd |
| alma 8 | nodejs:16::nodejs | 1:16.13.1-3.module_el8.5.0+2605+45d748af |
| alma 8 | nodejs:16::nodejs-devel | 1:16.13.1-3.module_el8.5.0+2605+45d748af |
| alma 8 | nodejs:16::nodejs-docs | 1:16.13.1-3.module_el8.5.0+246+05401605 |
| alma 8 | nodejs:16::nodejs-full-i18n | 1:16.13.1-3.module_el8.5.0+2605+45d748af |
| alma 8 | nodejs:16::nodejs-nodemon | 2.0.15-1.module_el8.5.0+2605+45d748af |
| alma 8 | nodejs:16::nodejs-packaging | 25-1.module_el8.5.0+246+05401605 |
| alma 8 | nodejs:16::npm | 1:8.1.2-1.16.13.1.3.module_el8.5.0+2605+45d748af |
| alma 9 | nodejs | 1:16.16.0-1.el9_0 |
| alma 9 | nodejs-docs | 1:16.16.0-1.el9_0 |
| alma 9 | nodejs-full-i18n | 1:16.16.0-1.el9_0 |
| alma 9 | nodejs-libs | 1:16.16.0-1.el9_0 |
| alma 9 | nodejs-nodemon | 2.0.19-1.el9_0 |
| alma 9 | npm | 1:8.11.0-1.16.16.0.1.el9_0 |
| chainguard | code-server | 0 |
| chainguard | commercial-gitlab-rails-ee-19.2 | 0 |
| chainguard | commercial-gitlab-rails-ee-19.3 | 0 |
| chainguard | commercial-gitlab-rails-ee-19.4 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.2 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.3 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.4 | 0 |
| chainguard | gitlab-rails-ce-18.1 | 0 |
| chainguard | gitlab-rails-ce-18.10 | 0 |
| chainguard | gitlab-rails-ce-18.11 | 0 |
| chainguard | gitlab-rails-ce-18.2 | 0 |
| chainguard | gitlab-rails-ce-18.3 | 0 |
| chainguard | gitlab-rails-ce-18.4 | 0 |
| chainguard | gitlab-rails-ce-18.5 | 0 |
| chainguard | gitlab-rails-ce-18.6 | 0 |
| chainguard | gitlab-rails-ce-18.7 | 0 |
| chainguard | gitlab-rails-ce-18.8 | 0 |
| chainguard | gitlab-rails-ce-18.9 | 0 |
| chainguard | gitlab-rails-ce-19.0 | 0 |
| chainguard | gitlab-rails-ce-19.1 | 0 |
| chainguard | gitlab-rails-ce-19.2 | 0 |
| chainguard | gitlab-rails-ce-19.3 | 0 |
| chainguard | gitlab-rails-ce-19.4 | 0 |
| chainguard | gitlab-rails-ce-19.5 | 0 |
| chainguard | gitlab-rails-ce-fips-18.1 | 0 |
| chainguard | gitlab-rails-ce-fips-18.10 | 0 |
| chainguard | gitlab-rails-ce-fips-18.11 | 0 |
| chainguard | gitlab-rails-ce-fips-18.2 | 0 |
| chainguard | gitlab-rails-ce-fips-18.3 | 0 |
| chainguard | gitlab-rails-ce-fips-18.4 | 0 |
| chainguard | gitlab-rails-ce-fips-18.5 | 0 |
| chainguard | gitlab-rails-ce-fips-18.6 | 0 |
| chainguard | gitlab-rails-ce-fips-18.7 | 0 |
| chainguard | gitlab-rails-ce-fips-18.8 | 0 |
| chainguard | gitlab-rails-ce-fips-18.9 | 0 |
| chainguard | gitlab-rails-ce-fips-19.0 | 0 |
| chainguard | gitlab-rails-ce-fips-19.1 | 0 |
| chainguard | gitlab-rails-ce-fips-19.2 | 0 |
| chainguard | gitlab-rails-ce-fips-19.3 | 0 |
| chainguard | gitlab-rails-ce-fips-19.4 | 0 |
| chainguard | gitlab-rails-ce-fips-19.5 | 0 |
| debian 10 | node-ini | 1.3.5-1+deb10u1 |
| debian 11 | node-ini | 2.0.0-1 |
| debian 12 | node-ini | 2.0.0-1 |
| debian 13 | node-ini | 2.0.0-1 |
| debian 14 | node-ini | 2.0.0-1 |
| debian 9 | node-ini | 1.1.0-1+deb9u1 |
| echo | node-ini | 2.0.0-1 |
| npm::GitHub Security Advisory npm | ini | 1.3.6 |
| Oracle Linux 8 | nodejs | 1:16.13.1-3.0.1.module+el8.5.0+20457+52828f44 |
| Oracle Linux 8 | nodejs-devel | 1:16.13.1-3.0.1.module+el8.5.0+20457+52828f44 |
| Oracle Linux 8 | nodejs-docs | 1:16.13.1-3.0.1.module+el8.5.0+20457+52828f44 |
| Oracle Linux 8 | nodejs-full-i18n | 1:16.13.1-3.0.1.module+el8.5.0+20457+52828f44 |
| Oracle Linux 8 | nodejs-nodemon | 2.0.15-1.module+el8.5.0+20489+261d51d3 |
| Oracle Linux 8 | nodejs-packaging | 25-1.module+el8.5.0+20388+4b61e68d |
| Oracle Linux 8 | npm | 1:8.1.2-1.16.13.1.3.0.1.module+el8.5.0+20457+52828f44 |
| Oracle Linux 9 | nodejs | 1:16.16.0-1.el9_0 |
| Oracle Linux 9 | nodejs-docs | 1:16.16.0-1.el9_0 |
| Oracle Linux 9 | nodejs-full-i18n | 1:16.16.0-1.el9_0 |
| Oracle Linux 9 | nodejs-libs | 1:16.16.0-1.el9_0 |
| Oracle Linux 9 | nodejs-nodemon | 2.0.19-1.el9_0 |
| Oracle Linux 9 | npm | 1:8.11.0-1.16.16.0.1.el9_0 |
| rapidfort Oracle Linux 9 | nodejs | 1:16.16.0-1.el9_0 |
| rapidfort Oracle Linux 9 | nodejs-docs | 1:16.16.0-1.el9_0 |
| rapidfort Oracle Linux 9 | nodejs-full-i18n | 1:16.16.0-1.el9_0 |
| rapidfort Oracle Linux 9 | nodejs-libs | 1:16.16.0-1.el9_0 |
| rapidfort Oracle Linux 9 | nodejs-nodemon | 0:2.0.19-1.el9_0 |
| rapidfort Oracle Linux 9 | npm | 1:8.11.0-1.16.16.0.1.el9_0 |
| rocky 8 | nodejs | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs-devel | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs-docs | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs-full-i18n | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs-nodemon | 2.0.15-1.module+el8.6.0+978+59f26232 |
| rocky 8 | nodejs:10::nodejs-nodemon | 1.18.3-1.module+el8.3.0+101+f84c7154 |
| rocky 8 | nodejs:10::nodejs-packaging | 17-3.module+el8.3.0+101+f84c7154 |
| rocky 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module+el8.6.0+982+9fdca2d4 |
| rocky 8 | nodejs:12::nodejs-packaging | 23-3.module+el8.7.0+1071+4bdda2a8 |
| rocky 8 | nodejs:14::nodejs | 1:14.18.2-2.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:14::nodejs-devel | 1:14.18.2-2.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:14::nodejs-docs | 1:14.18.2-2.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:14::nodejs-full-i18n | 1:14.18.2-2.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:14::nodejs-nodemon | 2.0.15-1.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:14::nodejs-packaging | 23-3.module+el8.7.0+1071+4bdda2a8 |
| rocky 8 | nodejs:14::npm | 1:6.14.15-1.14.18.2.2.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:16::nodejs | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:16::nodejs-devel | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:16::nodejs-docs | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:16::nodejs-full-i18n | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:16::nodejs-nodemon | 2.0.15-1.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:16::nodejs-packaging | 25-1.module+el8.6.0+1046+80feca58 |
| rocky 8 | nodejs:16::npm | 1:8.1.2-1.16.13.1.3.module+el8.5.0+721+4c107270 |
| rocky 8 | npm | 1:8.1.2-1.16.13.1.3.module+el8.5.0+721+4c107270 |
| rocky 9 | nodejs-nodemon | 2.0.19-1.el9_0 |
| ubuntu 18.04-ESM | node-ini | sin corrección indicada |
| ubuntu 20.04-ESM | node-ini | sin corrección indicada |
| ubuntu 22.04 | node-ini | sin corrección indicada |
| ubuntu 24.04 | node-ini | sin corrección indicada |
| ubuntu 26.04 | node-ini | sin corrección indicada |
| ubuntu 26.10 | node-ini | sin corrección indicada |
| wolfi | code-server | 0 |
Referencias
- https://access.redhat.com/errata/RHSA-2022:6595
- https://access.redhat.com/security/cve/CVE-2020-7788
- https://bugzilla.redhat.com/1907444
- https://bugzilla.redhat.com/1945459
- https://bugzilla.redhat.com/1964461
- https://bugzilla.redhat.com/2007557
- https://bugzilla.redhat.com/2098556
- https://bugzilla.redhat.com/2102001
Las 47 referencias
- https://bugzilla.redhat.com/2105422
- https://bugzilla.redhat.com/2105426
- https://bugzilla.redhat.com/2105428
- https://bugzilla.redhat.com/2105430
- https://bugzilla.redhat.com/show_bug.cgi?id=1907444
- https://bugzilla.redhat.com/show_bug.cgi?id=1945459
- https://bugzilla.redhat.com/show_bug.cgi?id=1964461
- https://bugzilla.redhat.com/show_bug.cgi?id=2007557
- https://bugzilla.redhat.com/show_bug.cgi?id=2098556
- https://bugzilla.redhat.com/show_bug.cgi?id=2102001
- https://bugzilla.redhat.com/show_bug.cgi?id=2105422
- https://bugzilla.redhat.com/show_bug.cgi?id=2105426
- https://bugzilla.redhat.com/show_bug.cgi?id=2105428
- https://bugzilla.redhat.com/show_bug.cgi?id=2105430
- https://bugzilla.redhat.com/show_bug.cgi?id=2121019
- https://bugzilla.redhat.com/show_bug.cgi?id=2124299
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33502
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3807
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29244
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32213
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32214
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32215
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33987
- https://errata.almalinux.org/9/ALSA-2022-6595.html
- https://errata.rockylinux.org/RLSA-2022:6595
- https://github.com/npm/ini
- https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1
- https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1%20%28v1.3.6%29
- https://linux.oracle.com/cve/CVE-2020-7788.html
- https://linux.oracle.com/errata/ELSA-2022-6595.html
- https://lists.debian.org/debian-lts-announce/2020/12/msg00032.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-7788
- https://snyk.io/vuln/SNYK-JS-INI-1048974
- https://www.cve.org/CVERecord?id=CVE-2020-7788
- https://www.npmjs.com/advisories/1589