Bug 1907444 (CVE-2020-7788) - CVE-2020-7788 nodejs-ini: Prototype pollution via malicious INI file
Summary: CVE-2020-7788 nodejs-ini: Prototype pollution via malicious INI file
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-7788
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1907446 1907445 1907526 1912634 1912635 1912636 1912637 1912638 1912639 1914783 1914784 1914785 1914913 1914914 1914915 1924699 1924700 1991321 1991322 1991323 1991324 1993962 1993965 2005419 2027630 2027631 2027632 2073156 2124230
Blocks: 1907447
TreeView+ depends on / blocked
 
Reported: 2020-12-14 14:28 UTC by Guilherme de Almeida Suckevicz
Modified: 2023-01-31 04:47 UTC (History)
13 users (show)

See Also:
Fixed In Version: nodejs-ini 1.3.6
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in nodejs-ini. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
Clone Of:
Environment:
Last Closed: 2021-02-04 20:42:19 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2021:3400 0 None None None 2021-08-31 20:51:15 UTC
Red Hat Product Errata RHBA-2021:3478 0 None None None 2021-09-09 12:32:55 UTC
Red Hat Product Errata RHSA-2021:0421 0 None None None 2021-02-04 17:18:13 UTC
Red Hat Product Errata RHSA-2021:0485 0 None None None 2021-02-11 13:35:21 UTC
Red Hat Product Errata RHSA-2021:0521 0 None None None 2021-02-15 18:26:12 UTC
Red Hat Product Errata RHSA-2021:0548 0 None None None 2021-02-16 14:31:51 UTC
Red Hat Product Errata RHSA-2021:0549 0 None None None 2021-02-16 14:32:44 UTC
Red Hat Product Errata RHSA-2021:0551 0 None None None 2021-02-16 14:33:48 UTC
Red Hat Product Errata RHSA-2021:3280 0 None None None 2021-08-26 10:18:46 UTC
Red Hat Product Errata RHSA-2021:3281 0 None None None 2021-08-26 10:15:17 UTC
Red Hat Product Errata RHSA-2021:5171 0 None None None 2021-12-15 19:27:54 UTC
Red Hat Product Errata RHSA-2022:0246 0 None None None 2022-01-25 09:23:23 UTC
Red Hat Product Errata RHSA-2022:0350 0 None None None 2022-02-01 21:14:15 UTC
Red Hat Product Errata RHSA-2022:6595 0 None None None 2022-09-20 12:23:57 UTC

Description Guilherme de Almeida Suckevicz 2020-12-14 14:28:32 UTC 
This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

Reference:
https://snyk.io/vuln/SNYK-JS-INI-1048974

Upstream patch:
https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1
Comment 1 Guilherme de Almeida Suckevicz 2020-12-14 14:28:55 UTC 
Created nodejs-ini tracking bugs for this issue:

Affects: epel-7 [bug 1907446]
Affects: fedora-32 [bug 1907445]
Comment 6 Doran Moppert 2021-01-05 02:51:12 UTC 
Statement:

Node.JS packages in Red Hat Enterprise Linux and Red Hat Software Collections included the vulnerable dependency packaged in "nodejs-npm" component. Processing malicious files using npm could potentially trigger this vulnerability. The "ini" package bundled with npm was not in the library path where it could be included directly in other programs.

The ini package is included in Red Hat Quay by protractor and webpack-cli, both of which are dev dependencies.
Comment 9 errata-xmlrpc 2021-02-04 17:18:11 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2021:0421 https://access.redhat.com/errata/RHSA-2021:0421
Comment 10 Product Security DevOps Team 2021-02-04 20:42:19 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-7788
Comment 11 errata-xmlrpc 2021-02-11 13:35:20 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2021:0485 https://access.redhat.com/errata/RHSA-2021:0485
Comment 12 errata-xmlrpc 2021-02-15 18:26:10 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2021:0521 https://access.redhat.com/errata/RHSA-2021:0521
Comment 13 errata-xmlrpc 2021-02-16 14:31:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:0548 https://access.redhat.com/errata/RHSA-2021:0548
Comment 14 errata-xmlrpc 2021-02-16 14:32:42 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:0549 https://access.redhat.com/errata/RHSA-2021:0549
Comment 15 errata-xmlrpc 2021-02-16 14:33:47 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:0551 https://access.redhat.com/errata/RHSA-2021:0551
Comment 18 errata-xmlrpc 2021-08-26 10:15:15 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2021:3281 https://access.redhat.com/errata/RHSA-2021:3281
Comment 19 errata-xmlrpc 2021-08-26 10:18:43 UTC 
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS

Via RHSA-2021:3280 https://access.redhat.com/errata/RHSA-2021:3280
Comment 21 errata-xmlrpc 2021-12-15 19:27:52 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:5171 https://access.redhat.com/errata/RHSA-2021:5171
Comment 22 errata-xmlrpc 2022-01-25 09:23:20 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2022:0246 https://access.redhat.com/errata/RHSA-2022:0246
Comment 23 errata-xmlrpc 2022-02-01 21:14:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:0350 https://access.redhat.com/errata/RHSA-2022:0350
Comment 24 errata-xmlrpc 2022-09-20 12:23:54 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:6595 https://access.redhat.com/errata/RHSA-2022:6595
Note You need to log in before you can comment on or make changes to this bug.