Alerts This Week
Warning Icon 1 562
Alerts This Week
Warning Icon 1 562

Mageia: 2020-0230 Critical: Nodejs-Set-Value Prototype Pollution Advisory

mageia
Calendar Grey May 26, 2020
Dist Mageia Esm H88
Mageia 8 security notice MGASA-2021-0455 successfully resolves a critical vulnerability in the nodejs-merge package.
Updated nodejs-set-value package fixes security vulnerability: A vulnerability was found in NOdejs set-value, where set-value is vulnerable to prototype Pollution in versions lowe...

Summary

Updated nodejs-set-value package fixes security vulnerability:
A vulnerability was found in NOdejs set-value, where set-value is vulnerable to prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and _proto_ payloads (CVE-2019-10747).

References

- https://bugs.mageia.org/show_bug.cgi?id=26227

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/3EJ36KV6MXQPUYTFCCTDY54E5Y7QP3AV/

- https://www.cve.org/CVERecord?id=CVE-2019-10747

Topics%20covered

Topics Covered

security advisory security issue critical package update nodejs Mageia prototype pollution

Resolution

SRPMS

- 7/core/nodejs-set-value-3.0.2-1.mga7

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 27 May 2020
URL: https://advisories.mageia.org/MGASA-2020-0230.html
Type: security
CVE: CVE-2019-10747

Topics%20covered

Topics Covered

security advisory security issue critical package update nodejs Mageia prototype pollution

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here