kritik
CVE-2020-7788
nodejs-ini: Prototype pollution via malicious INI file
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Red Hat7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: GHSA (yüksek), Red Hat (orta), AlmaLinux (orta), Oracle (orta), Rocky Linux (orta), Ubuntu (orta).
Açıklama
This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alma 8 | nodejs:10::nodejs-nodemon, nodejs:10::nodejs-packaging, nodejs:12::nodejs-nodemon ve 15 tane daha | 2.0.3-1.module_el8.4.0+2521+c668cc9f ve 10 tane daha |
| alma 9 | nodejs, nodejs-docs, nodejs-full-i18n ve 3 tane daha | 1:16.16.0-1.el9_0 ve 2 tane daha |
| chainguard | code-server, commercial-gitlab-rails-ee-19.2, commercial-gitlab-rails-ee-19.3 ve 38 tane daha | 0 |
| debian 10 | node-ini | 1.3.5-1+deb10u1 |
| debian 11 | node-ini | 2.0.0-1 |
| debian 12 | node-ini | 2.0.0-1 |
| debian 13 | node-ini | 2.0.0-1 |
| debian 14 | node-ini | 2.0.0-1 |
| debian 9 | node-ini | 1.1.0-1+deb9u1 |
| echo | node-ini | 2.0.0-1 |
| npm::GitHub Security Advisory npm | ini | 1.3.6 |
| Oracle Linux 8 | nodejs, nodejs-devel, nodejs-docs ve 4 tane daha | 1:16.13.1-3.0.1.module+el8.5.0+20457+52828f44 ve 3 tane daha |
23 kaynaktaki 124 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alma 8 | nodejs:10::nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| alma 8 | nodejs:10::nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| alma 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module_el8.4.0+2521+c668cc9f |
| alma 8 | nodejs:12::nodejs-packaging | 23-3.module_el8.4.0+2522+3bd42762 |
| alma 8 | nodejs:14::nodejs | 1:14.18.2-2.module_el8.5.0+2618+8d46dafd |
| alma 8 | nodejs:14::nodejs-devel | 1:14.18.2-2.module_el8.5.0+2618+8d46dafd |
| alma 8 | nodejs:14::nodejs-docs | 1:14.18.2-2.module_el8.5.0+254+b4526b16 |
| alma 8 | nodejs:14::nodejs-full-i18n | 1:14.18.2-2.module_el8.5.0+2618+8d46dafd |
| alma 8 | nodejs:14::nodejs-nodemon | 2.0.15-1.module_el8.5.0+2605+45d748af |
| alma 8 | nodejs:14::nodejs-packaging | 23-3.module_el8.4.0+2522+3bd42762 |
| alma 8 | nodejs:14::npm | 1:6.14.15-1.14.18.2.2.module_el8.5.0+2618+8d46dafd |
| alma 8 | nodejs:16::nodejs | 1:16.13.1-3.module_el8.5.0+2605+45d748af |
| alma 8 | nodejs:16::nodejs-devel | 1:16.13.1-3.module_el8.5.0+2605+45d748af |
| alma 8 | nodejs:16::nodejs-docs | 1:16.13.1-3.module_el8.5.0+246+05401605 |
| alma 8 | nodejs:16::nodejs-full-i18n | 1:16.13.1-3.module_el8.5.0+2605+45d748af |
| alma 8 | nodejs:16::nodejs-nodemon | 2.0.15-1.module_el8.5.0+2605+45d748af |
| alma 8 | nodejs:16::nodejs-packaging | 25-1.module_el8.5.0+246+05401605 |
| alma 8 | nodejs:16::npm | 1:8.1.2-1.16.13.1.3.module_el8.5.0+2605+45d748af |
| alma 9 | nodejs | 1:16.16.0-1.el9_0 |
| alma 9 | nodejs-docs | 1:16.16.0-1.el9_0 |
| alma 9 | nodejs-full-i18n | 1:16.16.0-1.el9_0 |
| alma 9 | nodejs-libs | 1:16.16.0-1.el9_0 |
| alma 9 | nodejs-nodemon | 2.0.19-1.el9_0 |
| alma 9 | npm | 1:8.11.0-1.16.16.0.1.el9_0 |
| chainguard | code-server | 0 |
| chainguard | commercial-gitlab-rails-ee-19.2 | 0 |
| chainguard | commercial-gitlab-rails-ee-19.3 | 0 |
| chainguard | commercial-gitlab-rails-ee-19.4 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.2 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.3 | 0 |
| chainguard | commercial-gitlab-rails-ee-fips-19.4 | 0 |
| chainguard | gitlab-rails-ce-18.1 | 0 |
| chainguard | gitlab-rails-ce-18.10 | 0 |
| chainguard | gitlab-rails-ce-18.11 | 0 |
| chainguard | gitlab-rails-ce-18.2 | 0 |
| chainguard | gitlab-rails-ce-18.3 | 0 |
| chainguard | gitlab-rails-ce-18.4 | 0 |
| chainguard | gitlab-rails-ce-18.5 | 0 |
| chainguard | gitlab-rails-ce-18.6 | 0 |
| chainguard | gitlab-rails-ce-18.7 | 0 |
| chainguard | gitlab-rails-ce-18.8 | 0 |
| chainguard | gitlab-rails-ce-18.9 | 0 |
| chainguard | gitlab-rails-ce-19.0 | 0 |
| chainguard | gitlab-rails-ce-19.1 | 0 |
| chainguard | gitlab-rails-ce-19.2 | 0 |
| chainguard | gitlab-rails-ce-19.3 | 0 |
| chainguard | gitlab-rails-ce-19.4 | 0 |
| chainguard | gitlab-rails-ce-19.5 | 0 |
| chainguard | gitlab-rails-ce-fips-18.1 | 0 |
| chainguard | gitlab-rails-ce-fips-18.10 | 0 |
| chainguard | gitlab-rails-ce-fips-18.11 | 0 |
| chainguard | gitlab-rails-ce-fips-18.2 | 0 |
| chainguard | gitlab-rails-ce-fips-18.3 | 0 |
| chainguard | gitlab-rails-ce-fips-18.4 | 0 |
| chainguard | gitlab-rails-ce-fips-18.5 | 0 |
| chainguard | gitlab-rails-ce-fips-18.6 | 0 |
| chainguard | gitlab-rails-ce-fips-18.7 | 0 |
| chainguard | gitlab-rails-ce-fips-18.8 | 0 |
| chainguard | gitlab-rails-ce-fips-18.9 | 0 |
| chainguard | gitlab-rails-ce-fips-19.0 | 0 |
| chainguard | gitlab-rails-ce-fips-19.1 | 0 |
| chainguard | gitlab-rails-ce-fips-19.2 | 0 |
| chainguard | gitlab-rails-ce-fips-19.3 | 0 |
| chainguard | gitlab-rails-ce-fips-19.4 | 0 |
| chainguard | gitlab-rails-ce-fips-19.5 | 0 |
| debian 10 | node-ini | 1.3.5-1+deb10u1 |
| debian 11 | node-ini | 2.0.0-1 |
| debian 12 | node-ini | 2.0.0-1 |
| debian 13 | node-ini | 2.0.0-1 |
| debian 14 | node-ini | 2.0.0-1 |
| debian 9 | node-ini | 1.1.0-1+deb9u1 |
| echo | node-ini | 2.0.0-1 |
| npm::GitHub Security Advisory npm | ini | 1.3.6 |
| Oracle Linux 8 | nodejs | 1:16.13.1-3.0.1.module+el8.5.0+20457+52828f44 |
| Oracle Linux 8 | nodejs-devel | 1:16.13.1-3.0.1.module+el8.5.0+20457+52828f44 |
| Oracle Linux 8 | nodejs-docs | 1:16.13.1-3.0.1.module+el8.5.0+20457+52828f44 |
| Oracle Linux 8 | nodejs-full-i18n | 1:16.13.1-3.0.1.module+el8.5.0+20457+52828f44 |
| Oracle Linux 8 | nodejs-nodemon | 2.0.15-1.module+el8.5.0+20489+261d51d3 |
| Oracle Linux 8 | nodejs-packaging | 25-1.module+el8.5.0+20388+4b61e68d |
| Oracle Linux 8 | npm | 1:8.1.2-1.16.13.1.3.0.1.module+el8.5.0+20457+52828f44 |
| Oracle Linux 9 | nodejs | 1:16.16.0-1.el9_0 |
| Oracle Linux 9 | nodejs-docs | 1:16.16.0-1.el9_0 |
| Oracle Linux 9 | nodejs-full-i18n | 1:16.16.0-1.el9_0 |
| Oracle Linux 9 | nodejs-libs | 1:16.16.0-1.el9_0 |
| Oracle Linux 9 | nodejs-nodemon | 2.0.19-1.el9_0 |
| Oracle Linux 9 | npm | 1:8.11.0-1.16.16.0.1.el9_0 |
| rapidfort Oracle Linux 9 | nodejs | 1:16.16.0-1.el9_0 |
| rapidfort Oracle Linux 9 | nodejs-docs | 1:16.16.0-1.el9_0 |
| rapidfort Oracle Linux 9 | nodejs-full-i18n | 1:16.16.0-1.el9_0 |
| rapidfort Oracle Linux 9 | nodejs-libs | 1:16.16.0-1.el9_0 |
| rapidfort Oracle Linux 9 | nodejs-nodemon | 0:2.0.19-1.el9_0 |
| rapidfort Oracle Linux 9 | npm | 1:8.11.0-1.16.16.0.1.el9_0 |
| rocky 8 | nodejs | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs-devel | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs-docs | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs-full-i18n | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs-nodemon | 2.0.15-1.module+el8.6.0+978+59f26232 |
| rocky 8 | nodejs:10::nodejs-nodemon | 1.18.3-1.module+el8.3.0+101+f84c7154 |
| rocky 8 | nodejs:10::nodejs-packaging | 17-3.module+el8.3.0+101+f84c7154 |
| rocky 8 | nodejs:12::nodejs-nodemon | 2.0.3-1.module+el8.6.0+982+9fdca2d4 |
| rocky 8 | nodejs:12::nodejs-packaging | 23-3.module+el8.7.0+1071+4bdda2a8 |
| rocky 8 | nodejs:14::nodejs | 1:14.18.2-2.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:14::nodejs-devel | 1:14.18.2-2.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:14::nodejs-docs | 1:14.18.2-2.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:14::nodejs-full-i18n | 1:14.18.2-2.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:14::nodejs-nodemon | 2.0.15-1.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:14::nodejs-packaging | 23-3.module+el8.7.0+1071+4bdda2a8 |
| rocky 8 | nodejs:14::npm | 1:6.14.15-1.14.18.2.2.module+el8.5.0+733+de4fee6c |
| rocky 8 | nodejs:16::nodejs | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:16::nodejs-devel | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:16::nodejs-docs | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:16::nodejs-full-i18n | 1:16.13.1-3.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:16::nodejs-nodemon | 2.0.15-1.module+el8.5.0+721+4c107270 |
| rocky 8 | nodejs:16::nodejs-packaging | 25-1.module+el8.6.0+1046+80feca58 |
| rocky 8 | nodejs:16::npm | 1:8.1.2-1.16.13.1.3.module+el8.5.0+721+4c107270 |
| rocky 8 | npm | 1:8.1.2-1.16.13.1.3.module+el8.5.0+721+4c107270 |
| rocky 9 | nodejs-nodemon | 2.0.19-1.el9_0 |
| ubuntu 18.04-ESM | node-ini | düzeltme belirtilmemiş |
| ubuntu 20.04-ESM | node-ini | düzeltme belirtilmemiş |
| ubuntu 22.04 | node-ini | düzeltme belirtilmemiş |
| ubuntu 24.04 | node-ini | düzeltme belirtilmemiş |
| ubuntu 26.04 | node-ini | düzeltme belirtilmemiş |
| ubuntu 26.10 | node-ini | düzeltme belirtilmemiş |
| wolfi | code-server | 0 |
Referanslar
- https://access.redhat.com/errata/RHSA-2022:6595
- https://access.redhat.com/security/cve/CVE-2020-7788
- https://bugzilla.redhat.com/1907444
- https://bugzilla.redhat.com/1945459
- https://bugzilla.redhat.com/1964461
- https://bugzilla.redhat.com/2007557
- https://bugzilla.redhat.com/2098556
- https://bugzilla.redhat.com/2102001
47 referansın hepsi
- https://bugzilla.redhat.com/2105422
- https://bugzilla.redhat.com/2105426
- https://bugzilla.redhat.com/2105428
- https://bugzilla.redhat.com/2105430
- https://bugzilla.redhat.com/show_bug.cgi?id=1907444
- https://bugzilla.redhat.com/show_bug.cgi?id=1945459
- https://bugzilla.redhat.com/show_bug.cgi?id=1964461
- https://bugzilla.redhat.com/show_bug.cgi?id=2007557
- https://bugzilla.redhat.com/show_bug.cgi?id=2098556
- https://bugzilla.redhat.com/show_bug.cgi?id=2102001
- https://bugzilla.redhat.com/show_bug.cgi?id=2105422
- https://bugzilla.redhat.com/show_bug.cgi?id=2105426
- https://bugzilla.redhat.com/show_bug.cgi?id=2105428
- https://bugzilla.redhat.com/show_bug.cgi?id=2105430
- https://bugzilla.redhat.com/show_bug.cgi?id=2121019
- https://bugzilla.redhat.com/show_bug.cgi?id=2124299
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33502
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3807
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29244
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32213
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32214
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32215
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33987
- https://errata.almalinux.org/9/ALSA-2022-6595.html
- https://errata.rockylinux.org/RLSA-2022:6595
- https://github.com/npm/ini
- https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1
- https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1%20%28v1.3.6%29
- https://linux.oracle.com/cve/CVE-2020-7788.html
- https://linux.oracle.com/errata/ELSA-2022-6595.html
- https://lists.debian.org/debian-lts-announce/2020/12/msg00032.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-7788
- https://snyk.io/vuln/SNYK-JS-INI-1048974
- https://www.cve.org/CVERecord?id=CVE-2020-7788
- https://www.npmjs.com/advisories/1589