Bug 2193459 (CVE-2023-0842) - CVE-2023-0842 node-xml2js: xml2js is vulnerable to prototype pollution
Summary: CVE-2023-0842 node-xml2js: xml2js is vulnerable to prototype pollution
Keywords:
Status: NEW
Alias: CVE-2023-0842
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2193464 2193465 2203734 2193460 2193461 2193462 2193463 2193466 2203735
Blocks: 2184896
TreeView+ depends on / blocked
 
Reported: 2023-05-05 17:14 UTC by Patrick Del Bello
Modified: 2023-08-31 05:05 UTC (History)
28 users (show)

Fixed In Version: xml2js 0.5.0
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in node-xml2js. This flaw allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, making it possible to edit the __proto__ property.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Patrick Del Bello 2023-05-05 17:14:10 UTC 
xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited.

https://fluidattacks.com/advisories/myers/
https://github.com/Leonidas-from-XIV/node-xml2js/
Comment 2 Patrick Del Bello 2023-05-05 17:16:57 UTC 
Created llhttp tracking bugs for this issue:

Affects: fedora-all [bug 2193461]


Created mozjs68 tracking bugs for this issue:

Affects: fedora-all [bug 2193462]


Created mozjs78 tracking bugs for this issue:

Affects: fedora-all [bug 2193463]


Created php-laminas-xml2json tracking bugs for this issue:

Affects: fedora-all [bug 2193464]


Created phpdoc tracking bugs for this issue:

Affects: fedora-all [bug 2193465]


Created seamonkey tracking bugs for this issue:

Affects: epel-all [bug 2193460]
Affects: fedora-all [bug 2193466]
Note You need to log in before you can comment on or make changes to this bug.