Bug 1929338 (CVE-2020-35149)
| Summary: | CVE-2020-35149 mquery: Code injection via merge or clone operation | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Michael Kaplan <mkaplan> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | gghezzo, gparvin, jramanat, jweiser, stcannon, thee |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | mquery 3.2.3 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in mquery that allows a prototype pollution attack. This flaw allows an attacker to alter the code behavior by modifying the object prototype. A flaw in the lib/utils.js function allows cloning and merging objects without sanitizing their special properties, such as prototype defining "__proto__". The highest threat from this vulnerability is to integrity.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-04-26 16:46:32 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1939204 | ||
| Bug Blocks: | 1939088 | ||
|
Description
Michael Kaplan
2021-02-16 17:10:07 UTC
External References: https://github.com/advisories/GHSA-45q2-34rf-mr94 https://portswigger.net/daily-swig/prototype-pollution-the-dangerous-and-underrated-vulnerability-impacting-javascript-applications Statement: The affected version of mquery is a dependency of mongoose library. The exploitation of this vulnerability requires authenticated access, consequently the CVSSv3 score for RHACM is lower then the score of the flaw. This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.1 for RHEL 8 Red Hat Advanced Cluster Management for Kubernetes 2.1 for RHEL 7 Via RHSA-2021:1369 https://access.redhat.com/errata/RHSA-2021:1369 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-35149 |