kritik
CVE-2018-3750
nodejs-deep-extend: Prototype pollution can allow attackers to modify object properties
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat4.2CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA. Daha düşük diyenler: AlmaLinux (orta), Rocky Linux (orta), Ubuntu (orta), Red Hat (düşük).
Açıklama
The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| npm::GitHub Security Advisory npm | deep-extend | 0.5.1 |
| alma 8 | nodejs:10::nodejs-nodemon, nodejs:10::nodejs-packaging | 2.0.3-1.module_el8.4.0+2521+c668cc9f ve 1 tane daha |
| debian 11 | node-deep-extend | 0.4.1-2 |
| debian 12 | node-deep-extend | 0.4.1-2 |
| debian 13 | node-deep-extend | 0.4.1-2 |
| debian 14 | node-deep-extend | 0.4.1-2 |
| echo | node-deep-extend | 0.4.1-2 |
| Red Hat | nodejs:10::nodejs-nodemon | düzeltme belirtilmemiş |
| rocky 8 | nodejs:12::nodejs-nodemon, nodejs:12::nodejs-packaging | 2.0.3-1.module+el8.6.0+982+9fdca2d4 ve 1 tane daha |
| ubuntu 18.04-ESM | node-deep-extend | düzeltme belirtilmemiş |
10 kaynaktaki 12 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| npm::GitHub Security Advisory npm | deep-extend | 0.5.1 |
| alma 8 | nodejs:10::nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| alma 8 | nodejs:10::nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| debian 11 | node-deep-extend | 0.4.1-2 |
| debian 12 | node-deep-extend | 0.4.1-2 |
| debian 13 | node-deep-extend | 0.4.1-2 |
| debian 14 | node-deep-extend | 0.4.1-2 |
| echo | node-deep-extend | 0.4.1-2 |
| Red Hat | nodejs:10::nodejs-nodemon | düzeltme belirtilmemiş |
| rocky 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module+el8.6.0+982+9fdca2d4 |
| rocky 8 | nodejs:12::nodejs-packaging | 17-3.module+el8.3.0+101+f84c7154 |
| ubuntu 18.04-ESM | node-deep-extend | düzeltme belirtilmemiş |
Referanslar
- https://access.redhat.com/security/cve/CVE-2018-3750
- https://bugzilla.redhat.com/show_bug.cgi?id=1795475
- https://bugzilla.redhat.com/show_bug.cgi?id=1795479
- https://bugzilla.redhat.com/show_bug.cgi?id=1892430
- https://bugzilla.redhat.com/show_bug.cgi?id=1907444
- https://bugzilla.redhat.com/show_bug.cgi?id=1912854
- https://bugzilla.redhat.com/show_bug.cgi?id=1912863
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3750
25 referansın hepsi
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10746
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10747
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7754
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8265
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8287
- https://errata.almalinux.org/8/ALSA-2021-0549.html
- https://errata.rockylinux.org/RLSA-2021:0549
- https://github.com/advisories/GHSA-hr2v-3952-633q
- https://github.com/unclechu/node-deep-extend/commit/9423fae877e2ab6b4aecc4db79a0ed63039d4703
- https://github.com/unclechu/node-deep-extend/issues/39
- https://github.com/unclechu/node-deep-extend/pull/40
- https://hackerone.com/reports/311333
- https://nodesecurity.io/advisories/612
- https://nvd.nist.gov/vuln/detail/CVE-2018-3750
- https://www.cve.org/CVERecord?id=CVE-2018-3750
- https://www.npmjs.com/advisories/612