Bug 2080845 (CVE-2022-22143) - CVE-2022-22143 convict: Prototype Pollution in convict
Summary: CVE-2022-22143 convict: Prototype Pollution in convict
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2022-22143
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2080846
TreeView+ depends on / blocked
 
Reported: 2022-05-02 07:04 UTC by Avinash Hanwate
Modified: 2022-12-08 23:33 UTC (History)
0 users

Fixed In Version: convict 6.2.2
Clone Of:
Environment:
Last Closed: 2022-12-08 23:33:00 UTC
Embargoed:

Attachments (Terms of Use)

Description Avinash Hanwate 2022-05-02 07:04:40 UTC 
The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. **Note:** This vulnerability derives from an incomplete fix of another [vulnerability](https://security.snyk.io/vuln/SNYK-JS-CONVICT-1062508)

https://snyk.io/vuln/SNYK-JS-CONVICT-2340604
https://github.com/mozilla/node-convict/blob/5eb1314f85346760a3c31cb14510f2f0af11d0d3/packages/convict/src/main.js%23L569
https://github.com/mozilla/node-convict/commit/3b86be087d8f14681a9c889d45da7fe3ad9cd880
Comment 2 Product Security DevOps Team 2022-12-08 23:32:58 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-22143
Note You need to log in before you can comment on or make changes to this bug.