Red Hat Bugzilla – Bug 1545893
CVE-2018-3728 hoek: Prototype pollution in utilities function
Last modified: 2018-06-29 18:32:29 EDT
Affected versions of this package are vulnerable to Prototype Pollution. The utilities function allow modification of the Object prototype. If an attacker can control part of the structure passed to this function, they could add or modify an existing property leading to potential denial of service. References: https://snyk.io/vuln/npm:hoek:20180212 https://hackerone.com/reports/310439
Created nodejs-hoek tracking bugs for this issue: Affects: epel-all [bug 1545894] Affects: fedora-all [bug 1545895]
Most RHMAP usages come from dependency on nodejs-requests and therefore nodejs-hawk. NodeJS Hawk 3.1.x don't make use of the vulnerable 'merge' function. It's possible RHAMP/supercore could be affected through use of the joi package in jsonwebtoken. Upgrade to jsonwebtoken version 8 or later where joi was removed.
The package, jsonwebtoken, is also potentially vulnernable to a similar issue in lodash, see: https://bugzilla.redhat.com/show_bug.cgi?id=1545884
(In reply to Jason Shepherd from comment #5) > The package, jsonwebtoken, is also potentially vulnernable to a similar > issue in lodash, see: > > https://bugzilla.redhat.com/show_bug.cgi?id=1545884 Actually 'jsonwebtoken' doesn't use any of the vulnerable methods from lodash, merge, mergeWith, or defaultsDeep, see: https://github.com/auth0/node-jsonwebtoken/blob/7b0a010e8a8ede7b2d31a702cf4fbab1cfc774b7/package.json#L21
This issue has been addressed in the following products: Red Hat Mobile Application Platform 4.6 Via RHSA-2018:1264 https://access.redhat.com/errata/RHSA-2018:1264
This issue has been addressed in the following products: Red Hat Mobile Application Platform 4.6 Via RHSA-2018:1263 https://access.redhat.com/errata/RHSA-2018:1263