Bug 1545893 (CVE-2018-3728)

Summary:	CVE-2018-3728 hoek: Prototype pollution in utilities function
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	bdettelb, bleanhar, ccoleman, dblechte, dedgar, dfediuck, dffrench, dmcphers, drusso, eedri, hhorak, jgoulding, jkeck, jmadigan, jorton, jshepherd, lgriffin, mgoldboi, michal.skrivanek, ngough, nodejs-sig, omachace, pwright, rhel8-maint, rrajasek, sbonazzo, sgratch, sherold, tchollingsworth, thrcka, tomckay, trepel, yturgema, zsvetlik
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	hoek 5.0.3	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:40:08 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1545894, 1545895, 1545896, 1578487, 1578488
Bug Blocks:	1545897

Description Pedro Sampaio 2018-02-15 19:09:05 UTC

Affected versions of this package are vulnerable to Prototype Pollution. The utilities function allow modification of the Object prototype. If an attacker can control part of the structure passed to this function, they could add or modify an existing property leading to potential denial of service.

References:

https://snyk.io/vuln/npm:hoek:20180212
https://hackerone.com/reports/310439

Comment 1 Pedro Sampaio 2018-02-15 19:09:54 UTC

Created nodejs-hoek tracking bugs for this issue:

Affects: epel-all [bug 1545894]
Affects: fedora-all [bug 1545895]

Comment 3 Jason Shepherd 2018-02-16 01:03:40 UTC

Most RHMAP usages come from dependency on nodejs-requests and therefore nodejs-hawk. NodeJS Hawk 3.1.x don't make use of the vulnerable 'merge' function. It's possible RHAMP/supercore could be affected through use of the joi package in jsonwebtoken. Upgrade to jsonwebtoken version 8 or later where joi was removed.

Comment 5 Jason Shepherd 2018-02-16 01:12:37 UTC

The package, jsonwebtoken, is also potentially vulnernable to a similar issue in lodash, see:

https://bugzilla.redhat.com/show_bug.cgi?id=1545884

Comment 6 Jason Shepherd 2018-02-19 05:27:38 UTC

(In reply to Jason Shepherd from comment #5)
> The package, jsonwebtoken, is also potentially vulnernable to a similar
> issue in lodash, see:
> 
> https://bugzilla.redhat.com/show_bug.cgi?id=1545884

Actually 'jsonwebtoken' doesn't use any of the vulnerable methods from lodash, merge, mergeWith, or defaultsDeep, see:

https://github.com/auth0/node-jsonwebtoken/blob/7b0a010e8a8ede7b2d31a702cf4fbab1cfc774b7/package.json#L21

Comment 7 errata-xmlrpc 2018-04-30 15:29:41 UTC

This issue has been addressed in the following products:

  Red Hat Mobile Application Platform 4.6

Via RHSA-2018:1264 https://access.redhat.com/errata/RHSA-2018:1264

Comment 8 errata-xmlrpc 2018-04-30 18:40:49 UTC

This issue has been addressed in the following products:

  Red Hat Mobile Application Platform 4.6

Via RHSA-2018:1263 https://access.redhat.com/errata/RHSA-2018:1263

Comment 12 Jason Shepherd 2021-05-04 00:23:44 UTC

Statement:

Red Hat Quay includes hoek as a dependency of protractor which is only used at build time. The vulnerable library is not used at runtime meaning this has a low impact on Red Hat Quay.

Comment 14 errata-xmlrpc 2021-10-19 12:10:05 UTC

This issue has been addressed in the following products:

  Red Hat Quay 3

Via RHSA-2021:3917 https://access.redhat.com/errata/RHSA-2021:3917