Bug 2000982 (CVE-2021-23438)

Summary:	CVE-2021-23438 mpath: type confusion can lead to a bypass of CVE-2018-16490
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	gghezzo, gparvin, jramanat, pahickey, stcannon
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	mpath 0.8.4	Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability CVE-2018-16490 allowed for prototype pollution module mpath <0.5.1. The vulnerability allowed an attacker to inject arbitrary properties onto Object.prototype. The issue was resolved in mpath 0.5.1, however the proposed fix was vulnerable to type confusion. The type confusion allows for bypassing the existing protection leading to prototype pollution.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-09-16 18:21:14 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2000984

Description Marian Rehak 2021-09-03 13:29:17 UTC

A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['__proto__'].

External Reference:

https://snyk.io/vuln/SNYK-JS-MPATH-1577289

Comment 1 Jan Werner 2021-09-16 16:11:45 UTC

The vulnerable component is not longer shipped with RHACM. Marking RHACM as not affected.

Comment 2 Product Security DevOps Team 2021-09-16 18:21:14 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-23438