Stay Secure with the Latest Linux Advisories

security advisoryupdatemoderate severity

Mageia 7 MGASA-2020-0232 Moderate: Dojo Prototype Pollution Fixes

Advisory text to describe the update. Wrap lines at ~75 chars. Updated dojo package fixes security vulnerabilities: In affected versions of dojo, the deepCopy method is vulnerable to . MGASA-2020-0232 - Updated dojo packages fix security vulnerability Publication date: 27 May 2020 URL: https://advisories.mageia.org/MGASA-2020-0232.html Type: security Affected Mageia releases: 7 CVE: CVE-2020-5258, CVE-2020-5259 Advisory text to describe the update. Wrap lines at ~75 chars. Updated dojo package fixes security vulnerabilities: In affected versions of dojo, the deepCopy method is vulnerable to prototype Pollution. An attacker could manipulate these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values (CVE-2020-5258). The Dojox jQuery wrapper jqMix mixin method is vulnerable to Prototype Pollution. An attacker could manipulate these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values (CVE-2020-5259). References: - https://bugs.mageia.org/show_bug.cgi?id=26335 - https://lists.debian.org/debian-lts-announce/2020/03/msg00012.html - https://www.cve.org/CVERecord?id=CVE-2020-5258 - https://www.cve.org/CVERecord?id=CVE-2020-5259 SRPMS: - 7/core/dojo-1.14.6-1.mga7 . New dojo libraries update resolves potential prototype pollution security issues in Mageia; see advisory MGASA-2020-0232.. Mageia Security Advisory, Dojo Package Updates, Prototype Pollution Fixes. . Severity: Important. LinuxSecurity.com Team

May 27, 2020 •Important Mageia