Bug 1868196 (CVE-2020-8116) - CVE-2020-8116 nodejs-dot-prop: prototype pollution
Summary: CVE-2020-8116 nodejs-dot-prop: prototype pollution
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-8116
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1868197 1869943 1869944 1875686 1875687 1875688 1875689 1882671 1882672 1888298 1910293 1910294 1910295 1910296 1916388 1917866
Blocks: 1868508
TreeView+ depends on / blocked
 
Reported: 2020-08-12 00:18 UTC by Jason Shepherd
Modified: 2021-04-30 00:46 UTC (History)
27 users (show)

Fixed In Version: nodejs-dot-prop-5.1.1, nodejs-dot-prop-4.2.1
Doc Type: If docs needed, set a value
Doc Text:
A prototype pollution flaw was found in nodejs-dot-prop. The function set could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype, or _proto_ paths. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Clone Of:
Environment:
Last Closed: 2020-10-19 20:21:38 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:4272 0 None None None 2020-10-19 07:47:49 UTC
Red Hat Product Errata RHSA-2020:4903 0 None None None 2020-11-04 12:32:21 UTC
Red Hat Product Errata RHSA-2020:5086 0 None None None 2020-11-11 13:35:21 UTC
Red Hat Product Errata RHSA-2021:0521 0 None None None 2021-02-15 18:26:20 UTC
Red Hat Product Errata RHSA-2021:0548 0 None None None 2021-02-16 14:31:37 UTC

Description Jason Shepherd 2020-08-12 00:18:41 UTC 
A vulnerability was found in nodejs dot-prop, where set is vulnerable to Prototype Pollution in versions lower than 5.1.0. The function set could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and _proto_ paths.

Reference:
https://hackerone.com/reports/719856

Upstream commit:
https://github.com/sindresorhus/dot-prop/commit/3039c8c07f6fdaa8b595ec869ae0895686a7a0f2
Comment 1 Jason Shepherd 2020-08-12 00:19:03 UTC 
Created nodejs-dot-prop tracking bugs for this issue:

Affects: fedora-all [bug 1868197]
Comment 4 Mark Cooper 2020-08-18 22:59:52 UTC 
Only openshift4/grafana packages a vulnerable version of nodejs-dot-prop (v4.2.0). The version in OpenShift 3.11 only includes dot-prop as a dev dependency and is not present at runtime. A vulnerable version of dot-prop (v4.2.0) is also present in openshift4/ose-prometheus in the react-ui, which whilst unused in OpenShift is still accessible via the URL path. 

Likewise, OpenShift ServiceMesh also packages a vulnerable version of nodejs-dot-prop (v4.2.0)
Comment 6 Mark Cooper 2020-08-18 23:08:00 UTC 
Also fix for v4.2.0 https://github.com/sindresorhus/dot-prop/commit/c914124f418f55edea27928e89c94d931babe587 

Although cannot update the fixed in version to 4.2.1 as it hasn't been tagged yet.
Comment 7 Mark Cooper 2020-08-19 03:05:34 UTC 
External References:

https://hackerone.com/reports/719856
Comment 9 Hardik Vyas 2020-08-19 11:42:07 UTC 
Statement:

In both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the grafana and prometheus containers are behind OpenShift OAuth restricting access to the vulnerable dot-prop library to authenticated users only, therefore the impact is Low.

Red Hat Openshift Container Storage 4 is not affected by this vulnerability, as it already includes patched version of dot-prop(v5.2.0) in noobaa-core container.
Comment 32 errata-xmlrpc 2020-10-19 07:47:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:4272 https://access.redhat.com/errata/RHSA-2020:4272
Comment 33 Product Security DevOps Team 2020-10-19 20:21:38 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-8116
Comment 35 errata-xmlrpc 2020-11-04 12:32:34 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2020:4903 https://access.redhat.com/errata/RHSA-2020:4903
Comment 38 errata-xmlrpc 2020-11-11 13:35:19 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2020:5086 https://access.redhat.com/errata/RHSA-2020:5086
Comment 40 errata-xmlrpc 2021-02-15 18:26:17 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2021:0521 https://access.redhat.com/errata/RHSA-2021:0521
Comment 41 errata-xmlrpc 2021-02-16 14:31:35 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:0548 https://access.redhat.com/errata/RHSA-2021:0548
Note You need to log in before you can comment on or make changes to this bug.