Bug 1974701 (CVE-2021-25949)

Summary:	CVE-2021-25949 set-getter: prototype pollution in ‘set-getter may lead to DoS
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	extras-orphan, jcantril, jsmith.fedora, nodejs-sig, periklis
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	set-getter 0.1.1	Doc Type:	If docs needed, set a value
Doc Text:	A prototype pollution vulnerability was found in ‘set-getter’. This issue allows an attacker to cause a denial of service and may also lead to remote code execution.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-06-22 16:40:49 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1974702
Bug Blocks:

Description Marian Rehak 2021-06-22 10:39:02 UTC

Prototype pollution vulnerability in ‘set-getter’ version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.

Reference:

https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25949
https://github.com/doowb/set-getter/blob/5bc2750fe1c3db9651d936131be187744111378d/index.js#L56

Comment 1 Marian Rehak 2021-06-22 10:42:36 UTC

Created nodejs-set-getter tracking bugs for this issue:

Affects: fedora-33 [bug 1974702]

Comment 2 Product Security DevOps Team 2021-06-22 16:40:49 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.