Bug 2129802 (CVE-2020-36604)

Summary:	CVE-2020-36604 hapi/hoek: Prototype Pollution in @hapi/hoek
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	alazarot, chazlett, cluster-maint, dwhatley, dymurray, emingora, etirelli, extras-orphan, go-sig, gparvin, ibek, ibolton, idevat, jmatthew, jmontleo, jramanat, jrokos, jshaughn, jwendell, jwon, kmalyjur, kverlaen, link, michel, mlisik, mnovotny, mpospisi, nboldt, njean, omular, openstack-sig, oskutka, pabelanger, pahickey, pjindal, rcernich, rguimara, scorneli, slucidi, sseago, stcannon, tojeline, tzimanyi, zebob.m
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	hoek 8.5.1, hoek 9.0.3	Doc Type:	If docs needed, set a value
Doc Text:	A prototype pollution flaw was found the clone() function of the hapi/hoek package. By adding or modifying properties of Object.prototype using a __proto__ or constructor payload, an attacker could execute arbitrary code or cause a denial of service condition on the system.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2132517, 2132514, 2132515, 2132516, 2132518, 2132519, 2159188
Bug Blocks:	2129803

Description Avinash Hanwate 2022-09-26 10:12:45 UTC

hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.

https://security.snyk.io/vuln/SNYK-JS-HAPIHOEK-548452)
https://github.com/hapijs/hoek/issues/352

Comment 1 Avinash Hanwate 2022-10-06 02:52:03 UTC

Created cockatrice tracking bugs for this issue:

Affects: fedora-all [bug 2132514]


Created golang-entgo-ent tracking bugs for this issue:

Affects: fedora-all [bug 2132515]


Created golang-github-prometheus tracking bugs for this issue:

Affects: epel-7 [bug 2132517]


Created zuul tracking bugs for this issue:

Affects: fedora-all [bug 2132516]

Comment 3 TEJ RATHI 2022-10-11 06:58:52 UTC

Upstream Commit: https://github.com/hapijs/hoek/commit/948baf98634a5c206875b67d11368f133034fa90