critique
CVE-2020-7788
nodejs-ini: Prototype pollution via malicious INI file
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Red Hat7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon GHSA (élevée), Red Hat (moyenne), AlmaLinux (moyenne), Oracle (moyenne), Rocky Linux (moyenne), Ubuntu (moyenne).
Description
This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| alma 8 | nodejs:10::nodejs-nodemon, nodejs:10::nodejs-packaging, nodejs:12::nodejs-nodemon et 15 autres | 2.0.3-1.module_el8.4.0+2521+c668cc9f et 10 autres |
| alma 9 | nodejs, nodejs-docs, nodejs-full-i18n et 3 autres | 1:16.16.0-1.el9_0 et 2 autres |
| chainguard | code-server, commercial-gitlab-rails-ee-19.2, commercial-gitlab-rails-ee-19.3 et 38 autres | 0 |
| debian 10 | node-ini | 1.3.5-1+deb10u1 |
| debian 11 | node-ini | 2.0.0-1 |
| debian 12 | node-ini | 2.0.0-1 |
| debian 13 | node-ini | 2.0.0-1 |
| debian 14 | node-ini | 2.0.0-1 |
| debian 9 | node-ini | 1.1.0-1+deb9u1 |
| echo | node-ini | 2.0.0-1 |
| npm::GitHub Security Advisory npm | ini | 1.3.6 |
| Oracle Linux 8 | nodejs, nodejs-devel, nodejs-docs et 4 autres | 1:16.13.1-3.0.1.module+el8.5.0+20457+52828f44 et 3 autres |
Afficher les 124 entrées de 23 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| alma 8 | nodejs:10::nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| alma 8 | nodejs:10::nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| alma 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| alma 8 | nodejs:12::nodejs-packaging | 23-3.module_el8.4.0+2522+3bd42762 |
| alma 8 | nodejs:14::nodejs | 1:14.18.2-2.module_el8.5.0+2618+8d46dafd |
| alma 8 | nodejs:14::nodejs-devel | 1:14.18.2-2.module_el8.5.0+2618+8d46dafd |
| alma 8 | nodejs:14::nodejs-docs | 1:14.18.2-2.module_el8.5.0+254+b4526b16 |
| alma 8 | nodejs:14::nodejs-full-i18n | 1:14.18.2-2.module_el8.5.0+2618+8d46dafd |
| alma 8 | nodejs:14::nodejs-nodemon | 2.0.15-1.module_el8.5.0+2605+45d748af |
| alma 8 | nodejs:14::nodejs-packaging | 23-3.module_el8.4.0+2522+3bd42762 |
| alma 8 | nodejs:14::npm | 1:6.14.15-1.14.18.2.2.module_el8.5.0+2618+8d46dafd |
| alma 8 | nodejs:16::nodejs | 1:16.13.1-3.module_el8.5.0+2605+45d748af |
| alma 8 | nodejs:16::nodejs-devel | 1:16.13.1-3.module_el8.5.0+2605+45d748af |
| alma 8 | nodejs:16::nodejs-docs | 1:16.13.1-3.module_el8.5.0+246+05401605 |
| alma 8 | nodejs:16::nodejs-full-i18n | 1:16.13.1-3.module_el8.5.0+2605+45d748af |
| alma 8 | nodejs:16::nodejs-nodemon | 2.0.15-1.module_el8.5.0+2605+45d748af |
| alma 8 | nodejs:16::nodejs-packaging | 25-1.module_el8.5.0+246+05401605 |
| alma 8 | nodejs:16::npm | 1:8.1.2-1.16.13.1.3.module_el8.5.0+2605+45d748af |
| alma 9 | nodejs | 1:16.16.0-1.el9_0 |
| alma 9 | nodejs-docs | 1:16.16.0-1.el9_0 |
| alma 9 | nodejs-full-i18n | 1:16.16.0-1.el9_0 |
| alma 9 | nodejs-libs | 1:16.16.0-1.el9_0 |
| alma 9 | nodejs-nodemon | 2.0.19-1.el9_0 |
| alma 9 | npm | 1:8.11.0-1.16.16.0.1.el9_0 |
| chainguard | code-server | 0 |
| chainguard | commercial-gitlab-rails-ee-19.2 | 0 |
| chainguard | commercial-gitlab-rails-ee-19.3 | 0 |
| chainguard | commercial-gitlab-rails-ee-19.4 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.2 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.3 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.4 | 0 |
| chainguard | gitlab-rails-ce-18.1 | 0 |
| chainguard | gitlab-rails-ce-18.10 | 0 |
| chainguard | gitlab-rails-ce-18.11 | 0 |
| chainguard | gitlab-rails-ce-18.2 | 0 |
| chainguard | gitlab-rails-ce-18.3 | 0 |
| chainguard | gitlab-rails-ce-18.4 | 0 |
| chainguard | gitlab-rails-ce-18.5 | 0 |
| chainguard | gitlab-rails-ce-18.6 | 0 |
| chainguard | gitlab-rails-ce-18.7 | 0 |
| chainguard | gitlab-rails-ce-18.8 | 0 |
| chainguard | gitlab-rails-ce-18.9 | 0 |
| chainguard | gitlab-rails-ce-19.0 | 0 |
| chainguard | gitlab-rails-ce-19.1 | 0 |
| chainguard | gitlab-rails-ce-19.2 | 0 |
| chainguard | gitlab-rails-ce-19.3 | 0 |
| chainguard | gitlab-rails-ce-19.4 | 0 |
| chainguard | gitlab-rails-ce-19.5 | 0 |
| chainguard | gitlab-rails-ce-fips-18.1 | 0 |
| chainguard | gitlab-rails-ce-fips-18.10 | 0 |
| chainguard | gitlab-rails-ce-fips-18.11 | 0 |
| chainguard | gitlab-rails-ce-fips-18.2 | 0 |
| chainguard | gitlab-rails-ce-fips-18.3 | 0 |
| chainguard | gitlab-rails-ce-fips-18.4 | 0 |
| chainguard | gitlab-rails-ce-fips-18.5 | 0 |
| chainguard | gitlab-rails-ce-fips-18.6 | 0 |
| chainguard | gitlab-rails-ce-fips-18.7 | 0 |
| chainguard | gitlab-rails-ce-fips-18.8 | 0 |
| chainguard | gitlab-rails-ce-fips-18.9 | 0 |
| chainguard | gitlab-rails-ce-fips-19.0 | 0 |
| chainguard | gitlab-rails-ce-fips-19.1 | 0 |
| chainguard | gitlab-rails-ce-fips-19.2 | 0 |
| chainguard | gitlab-rails-ce-fips-19.3 | 0 |
| chainguard | gitlab-rails-ce-fips-19.4 | 0 |
| chainguard | gitlab-rails-ce-fips-19.5 | 0 |
| debian 10 | node-ini | 1.3.5-1+deb10u1 |
| debian 11 | node-ini | 2.0.0-1 |
| debian 12 | node-ini | 2.0.0-1 |
| debian 13 | node-ini | 2.0.0-1 |
| debian 14 | node-ini | 2.0.0-1 |
| debian 9 | node-ini | 1.1.0-1+deb9u1 |
| echo | node-ini | 2.0.0-1 |
| npm::GitHub Security Advisory npm | ini | 1.3.6 |
| Oracle Linux 8 | nodejs | 1:16.13.1-3.0.1.module+el8.5.0+20457+52828f44 |
| Oracle Linux 8 | nodejs-devel | 1:16.13.1-3.0.1.module+el8.5.0+20457+52828f44 |
| Oracle Linux 8 | nodejs-docs | 1:16.13.1-3.0.1.module+el8.5.0+20457+52828f44 |
| Oracle Linux 8 | nodejs-full-i18n | 1:16.13.1-3.0.1.module+el8.5.0+20457+52828f44 |
| Oracle Linux 8 | nodejs-nodemon | 2.0.15-1.module+el8.5.0+20489+261d51d3 |
| Oracle Linux 8 | nodejs-packaging | 25-1.module+el8.5.0+20388+4b61e68d |
| Oracle Linux 8 | npm | 1:8.1.2-1.16.13.1.3.0.1.module+el8.5.0+20457+52828f44 |
| Oracle Linux 9 | nodejs | 1:16.16.0-1.el9_0 |
| Oracle Linux 9 | nodejs-docs | 1:16.16.0-1.el9_0 |
| Oracle Linux 9 | nodejs-full-i18n | 1:16.16.0-1.el9_0 |
| Oracle Linux 9 | nodejs-libs | 1:16.16.0-1.el9_0 |
| Oracle Linux 9 | nodejs-nodemon | 2.0.19-1.el9_0 |
| Oracle Linux 9 | npm | 1:8.11.0-1.16.16.0.1.el9_0 |
| rapidfort Oracle Linux 9 | nodejs | 1:16.16.0-1.el9_0 |
| rapidfort Oracle Linux 9 | nodejs-docs | 1:16.16.0-1.el9_0 |
| rapidfort Oracle Linux 9 | nodejs-full-i18n | 1:16.16.0-1.el9_0 |
| rapidfort Oracle Linux 9 | nodejs-libs | 1:16.16.0-1.el9_0 |
| rapidfort Oracle Linux 9 | nodejs-nodemon | 0:2.0.19-1.el9_0 |
| rapidfort Oracle Linux 9 | npm | 1:8.11.0-1.16.16.0.1.el9_0 |
| rocky 8 | nodejs | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs-devel | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs-docs | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs-full-i18n | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs-nodemon | 2.0.15-1.module+el8.6.0+978+59f26232 |
| rocky 8 | nodejs:10::nodejs-nodemon | 1.18.3-1.module+el8.3.0+101+f84c7154 |
| rocky 8 | nodejs:10::nodejs-packaging | 17-3.module+el8.3.0+101+f84c7154 |
| rocky 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module+el8.6.0+982+9fdca2d4 |
| rocky 8 | nodejs:12::nodejs-packaging | 23-3.module+el8.7.0+1071+4bdda2a8 |
| rocky 8 | nodejs:14::nodejs | 1:14.18.2-2.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:14::nodejs-devel | 1:14.18.2-2.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:14::nodejs-docs | 1:14.18.2-2.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:14::nodejs-full-i18n | 1:14.18.2-2.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:14::nodejs-nodemon | 2.0.15-1.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:14::nodejs-packaging | 23-3.module+el8.7.0+1071+4bdda2a8 |
| rocky 8 | nodejs:14::npm | 1:6.14.15-1.14.18.2.2.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:16::nodejs | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:16::nodejs-devel | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:16::nodejs-docs | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:16::nodejs-full-i18n | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:16::nodejs-nodemon | 2.0.15-1.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:16::nodejs-packaging | 25-1.module+el8.6.0+1046+80feca58 |
| rocky 8 | nodejs:16::npm | 1:8.1.2-1.16.13.1.3.module+el8.5.0+721+4c107270 |
| rocky 8 | npm | 1:8.1.2-1.16.13.1.3.module+el8.5.0+721+4c107270 |
| rocky 9 | nodejs-nodemon | 2.0.19-1.el9_0 |
| ubuntu 18.04-ESM | node-ini | pas de correctif indiqué |
| ubuntu 20.04-ESM | node-ini | pas de correctif indiqué |
| ubuntu 22.04 | node-ini | pas de correctif indiqué |
| ubuntu 24.04 | node-ini | pas de correctif indiqué |
| ubuntu 26.04 | node-ini | pas de correctif indiqué |
| ubuntu 26.10 | node-ini | pas de correctif indiqué |
| wolfi | code-server | 0 |
Références
- https://access.redhat.com/errata/RHSA-2022:6595
- https://access.redhat.com/security/cve/CVE-2020-7788
- https://bugzilla.redhat.com/1907444
- https://bugzilla.redhat.com/1945459
- https://bugzilla.redhat.com/1964461
- https://bugzilla.redhat.com/2007557
- https://bugzilla.redhat.com/2098556
- https://bugzilla.redhat.com/2102001
Les 47 références
- https://bugzilla.redhat.com/2105422
- https://bugzilla.redhat.com/2105426
- https://bugzilla.redhat.com/2105428
- https://bugzilla.redhat.com/2105430
- https://bugzilla.redhat.com/show_bug.cgi?id=1907444
- https://bugzilla.redhat.com/show_bug.cgi?id=1945459
- https://bugzilla.redhat.com/show_bug.cgi?id=1964461
- https://bugzilla.redhat.com/show_bug.cgi?id=2007557
- https://bugzilla.redhat.com/show_bug.cgi?id=2098556
- https://bugzilla.redhat.com/show_bug.cgi?id=2102001
- https://bugzilla.redhat.com/show_bug.cgi?id=2105422
- https://bugzilla.redhat.com/show_bug.cgi?id=2105426
- https://bugzilla.redhat.com/show_bug.cgi?id=2105428
- https://bugzilla.redhat.com/show_bug.cgi?id=2105430
- https://bugzilla.redhat.com/show_bug.cgi?id=2121019
- https://bugzilla.redhat.com/show_bug.cgi?id=2124299
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33502
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3807
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29244
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32213
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32214
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32215
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33987
- https://errata.almalinux.org/9/ALSA-2022-6595.html
- https://errata.rockylinux.org/RLSA-2022:6595
- https://github.com/npm/ini
- https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1
- https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1%20%28v1.3.6%29
- https://linux.oracle.com/cve/CVE-2020-7788.html
- https://linux.oracle.com/errata/ELSA-2022-6595.html
- https://lists.debian.org/debian-lts-announce/2020/12/msg00032.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-7788
- https://snyk.io/vuln/SNYK-JS-INI-1048974
- https://www.cve.org/CVERecord?id=CVE-2020-7788
- https://www.npmjs.com/advisories/1589