Bug 2268370 (CVE-2024-27307)
| Summary: | CVE-2024-27307 jsonata: malicious expression can pollute the "Object" prototype | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | TEJ RATHI <trathi> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | dhanak, dsimansk, gsuckevi, jchui, kingland, ktsao, kverlaen, matzew, mnovotny, nboldt, oezr, pierdipi, rguimara, rhuss, rtaniwa, skontopo, tkral |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | jsonata 1.8.7, jsonata 2.0.4 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A vulnerability was found in JSONata. A malicious expression can exploit the transform operator to override properties on the Object constructor and prototype. This issue can result in denial of service, remote code execution, or other unforeseen behavior in applications that assess user-provided JSONata expressions.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 2268371 | ||
|
Description
TEJ RATHI
2024-03-07 06:31:07 UTC
|