Alerts This Week
Warning Icon 1 764
Alerts This Week
Warning Icon 1 764

Debian 10: DLA-3221-1 Moderate: Node-Cached-Path-Relative DoS Risk

debian lts
Calendar Grey December 5, 2022
Dist Debian Esm H88
The Debian LTS Advisory has alerted users about a serious security issue involving prototype pollution in the node-cached-path-relative package, urging upgrades
Cristian-Alexandru Staicu discovered a prototype pollution vulnerability in inode-cached-path-relative, a Node.js module used to cache (memoize) the result of path.relative
Topics%20covered

Topics Covered

security advisory Debian package update Denial of Service Node.js prototype pollution

Summary

CVE-2018-16472

An attacker controlling both the path and the cached value, can
mount a prototype pollution attack and thus overwrite arbitrary
properties on Object.prototype, which may result in denial of
service.

CVE-2021-23518

The fix for CVE-2018-16472 was incomplete and other prototype
pollution vulnerabilities were found in the meantime, resulting in a
new CVE.

For Debian 10 buster, these problems have been fixed in version
1.0.1-2+deb10u1.

We recommend that you upgrade your node-cached-path-relative packages.

For the detailed security status of node-cached-path-relative please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/node-cached-path-relative

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Package: node-cached-path-relative
Version: 1.0.1-2+deb10u1
CVE ID: CVE-2018-16472 CVE-2021-23518
Debian Bug: #1004338

Topics%20covered

Topics Covered

security advisory Debian package update Denial of Service Node.js prototype pollution

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here