Bug 1857412 (CVE-2020-8203)
| Summary: | CVE-2020-8203 nodejs-lodash: prototype pollution in zipObjectDeep function | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Guilherme de Almeida Suckevicz <gsuckevi> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | abenaiss, abonas, alegrand, anpicker, aos-bugs, apattich, bdettelb, bmontgom, dblechte, dfediuck, eedri, emarcus, eparis, erooth, extras-orphan, gbrown, irosenzw, jburrell, jcantril, jhadvig, jokerman, jschorr, kakkoyun, kconner, lcosic, mgoldboi, michal.skrivanek, mloibl, nodejs-sig, nstielau, omachace, pbhattac, pkrupa, proguski, rcernich, sbonazzo, sd-operator-metering, security-response-team, sgratch, sherold, sponnaga, surbania, tflannag, tkasparek, tomckay, vbobade, yturgema |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| See Also: |
https://issues.redhat.com/browse/MAISTRA-1663 https://issues.redhat.com/browse/MAISTRA-1664 https://issues.redhat.com/browse/PROJQUAY-911 https://issues.redhat.com/browse/TRACING-1334 https://issues.redhat.com/browse/TRACING-1335 |
||
| Whiteboard: | |||
| Fixed In Version: | nodejs-lodash 4.17.16 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in nodejs-lodash in versions 4.17.15 and earlier. A prototype pollution attack is possible which can lead to arbitrary code execution. The primary threat from this vulnerability is to data integrity and system availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-08-07 01:27:46 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1857565, 1857566, 1857567, 1857568, 1857569, 1857570, 1857571, 1857591, 1857592, 1857593, 1859559, 1859560, 1859561, 1859562, 1859563, 1859564, 1859565, 1859566, 1859567, 1859568, 1859582, 1859861 | ||
| Bug Blocks: | 1857413 | ||
|
Description
Guilherme de Almeida Suckevicz
2020-07-15 19:45:32 UTC
External References: https://hackerone.com/reports/712065 https://www.npmjs.com/advisories/1523 Changing the CVSS: AC:L -> AC:H To exploit this vulnerability the attacker must to zip object based on user-provided property arrays, which means somehow must to guess the array properties first. Statement: In OpenShift ServiceMesh (OSSM), Red Hat OpenShift Jaeger (RHOSJ) and Red Hat OpenShift Container Platform (RHOCP), the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-lodash library to authenticated users only, therefore the impact is low. Red Hat OpenShift Container Platform 4 delivers the kibana package where the nodejs-lodash library is used, but due to the code changing to the container first content the kibana package is marked as wontfix. This may be fixed in the future. Red Hat Virtualization uses vulnerable version of nodejs-lodash, however zipObjectDeep is not used, therefore the impact is low. Created nodejs-lodash tracking bugs for this issue: Affects: epel-all [bug 1859861] This issue has been addressed in the following products: Jaeger-1.17 Via RHSA-2020:3370 https://access.redhat.com/errata/RHSA-2020:3370 This issue has been addressed in the following products: OpenShift Service Mesh 1.1 Openshift Service Mesh 1.1 Via RHSA-2020:3369 https://access.redhat.com/errata/RHSA-2020:3369 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-8203 This issue has been addressed in the following products: Red Hat Virtualization Engine 4.4 Via RHSA-2020:3807 https://access.redhat.com/errata/RHSA-2020:3807 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.6 Via RHSA-2020:4298 https://access.redhat.com/errata/RHSA-2020:4298 This issue has been addressed in the following products: Red Hat Virtualization Engine 4.4 Via RHSA-2020:5179 https://access.redhat.com/errata/RHSA-2020:5179 This issue has been addressed in the following products: Red Hat Virtualization 4 for Red Hat Enterprise Linux 8 Via RHSA-2020:5611 https://access.redhat.com/errata/RHSA-2020:5611 This issue has been addressed in the following products: Red Hat Quay 3 Via RHSA-2021:3917 https://access.redhat.com/errata/RHSA-2021:3917 |