Affected versions of this package are vulnerable to Prototype Pollution. The utilities function allow modification of the Object prototype. If an attacker can control part of the structure passed to this function, they could add or modify an existing property leading to potential denial of service. References: https://snyk.io/vuln/npm:hoek:20180212 https://hackerone.com/reports/310439
Created nodejs-hoek tracking bugs for this issue: Affects: epel-all [bug 1545894] Affects: fedora-all [bug 1545895]
Most RHMAP usages come from dependency on nodejs-requests and therefore nodejs-hawk. NodeJS Hawk 3.1.x don't make use of the vulnerable 'merge' function. It's possible RHAMP/supercore could be affected through use of the joi package in jsonwebtoken. Upgrade to jsonwebtoken version 8 or later where joi was removed.
The package, jsonwebtoken, is also potentially vulnernable to a similar issue in lodash, see: https://bugzilla.redhat.com/show_bug.cgi?id=1545884
(In reply to Jason Shepherd from comment #5) > The package, jsonwebtoken, is also potentially vulnernable to a similar > issue in lodash, see: > > https://bugzilla.redhat.com/show_bug.cgi?id=1545884 Actually 'jsonwebtoken' doesn't use any of the vulnerable methods from lodash, merge, mergeWith, or defaultsDeep, see: https://github.com/auth0/node-jsonwebtoken/blob/7b0a010e8a8ede7b2d31a702cf4fbab1cfc774b7/package.json#L21
This issue has been addressed in the following products: Red Hat Mobile Application Platform 4.6 Via RHSA-2018:1264 https://access.redhat.com/errata/RHSA-2018:1264
This issue has been addressed in the following products: Red Hat Mobile Application Platform 4.6 Via RHSA-2018:1263 https://access.redhat.com/errata/RHSA-2018:1263
Statement: Red Hat Quay includes hoek as a dependency of protractor which is only used at build time. The vulnerable library is not used at runtime meaning this has a low impact on Red Hat Quay.
This issue has been addressed in the following products: Red Hat Quay 3 Via RHSA-2021:3917 https://access.redhat.com/errata/RHSA-2021:3917