huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2021-3712: openssl: Read buffer overruns processing ASN.1 strings
Component: openssl
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H)
Public date: 2021-08-24T00:00:00+00:00

It was found that openssl assumed ASN.1 strings to be NUL terminated. A malicious actor may be able to force an application into calling openssl function with a specially crafted, non-NUL terminated string to deliberately hit this bug, which may result in a crash of the application, causing a Denial of Service attack, or possibly, memory disclosure. The highest threat from this vulnerability is to data confidentiality and system availability.

Statement: The following Red Hat products do not ship the affected OpenSSL component but rely on the Red Hat Enterprise Linux to consume them:
 * Red Hat Satellite
 * Red Hat Update Infrastructure
 * Red Hat CloudForms

The Red Hat Advanced Cluster Management for Kubernetes is using the vulnerable version of the library, however the vulnerable code path is not reachable.

compat-openssl10 is deprecated and has been removed from RHEL 9 and later. No further patches would be available for this component except on a case by case basis.

Affected upstream versions: Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k), Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y)
Fixed upstream versions: OpenSSL_1_1_1l
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: 94d23fcff9b2a7a8368dfe52214d5c2569882c11
CVE-2021-3715: kernel: use-after-free in route4_change() in net/sched/cls_route.c
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-09-07T08:25:00+00:00

A flaw was found in the "Routing decision" classifier in the Linux kernel's Traffic Control networking subsystem in the way it handled changing of classification filters, leading to a use-after-free condition. This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Statement: This flaw is rated as having Moderate impact (Red Hat Enterprise Linux 7 and lower) because of the need to have CAP_NET_ADMIN privileges and that Red Hat Enterprise Linux 7 disabled unprivileged user/network namespaces by default.

This flaw is rated as having Important impact (Red Hat Enterprise Linux 8) because Red Hat Enterprise Linux 8 enabled unprivileged user/network namespaces by default which can be used to gain CAP_NET_ADMIN privileges in corresponding user namespace even for otherwise unprivileged local user and thus exercise this vulnerability.

Affected upstream versions: Linux kernel 5.10
Fixed upstream versions: v5.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: ef299cc3fa1a9e1288665a9fdc8bff55629fd359
CVE-2021-37159: kernel: use-after-free in hso_free_net_device() in drivers/net/usb/hso.c
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.4 (CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2020-10-02T00:00:00+00:00

A flaw use-after-free in the Linux kernel USB High Speed Mobile Devices functionality was found in the way user detaches USB device. A local user could use this flaw to crash the system or escalate their privileges on the system.


Affected upstream versions: n/a
Fixed upstream versions: v5.14
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: a6ecfb39ba9d7316057cea823b196b734f6b18ca
CVE-2021-3716: nbdkit: NBD_OPT_STRUCTURED_REPLY injection on STARTTLS
Component: nbdkit
Severity: Low
CWE: CWE-924 (Improper Enforcement of Message Integrity During Transmission in a Communication Channel)
CVSS v3: 3.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L)
Public date: 2021-08-16T00:00:00+00:00

A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary. A MitM attacker could use this flaw to inject a plaintext NBD_OPT_STRUCTURED_REPLY before proxying everything else a client sends to the server, potentially leading the client to terminate the NBD session. The highest threat from this vulnerability is to system availability.

Statement: Red Hat Enterprise Linux 7 is not affected by this flaw as it ships an old version of `nbdkit` (v1.8.0) that does not include support for NBD Structured Replies.

Affected upstream versions: Affects nbdkit v1.12 through v1.26.4 | Fixedin nbdkit v1.26.5
Fixed upstream versions: v1.27.6
Upstream repository: https://gitlab.com/nbdkit/nbdkit
Upstream fix commit: 09a13dafb7bb3a38ab52eb5501cba786365ba7fd
CVE-2021-3732: kernel: overlayfs: Mounting overlayfs inside an unprivileged user namespace can reveal files
Component: kernel
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Public date: 2021-08-12T00:00:00+00:00

A flaw was found in the Linux kernel’s OverlayFS subsystem in the way the user mounts the TmpFS filesystem with OverlayFS. This flaw allows a local user to gain access to hidden files that should not be accessible.


Affected upstream versions: Affects kernel before v5.13.11, Fixed in v5.14-rc6 and later.
Fixed upstream versions: v5.14
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 427215d85e8d
CVE-2021-3733: python: urllib: Regular expression DoS in AbstractBasicAuthHandler
Component: python
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2021-08-10T00:00:00+00:00

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

Statement: Applications that use AbstractBasicAuthHandler, HTTPBasicAuthHandler and ProxyBasicAuthHandler may be affected by this flaw. Other classes may use the vulnerable method http_error_auth_reqed in AbstractBasicAuthHandler as well.

This flaw is out of support scope for versions of Python shipped in Red Hat Enterprise Linux 7 base OS and Red Hat Enterprise Linux 6. For more information about support life cycles, please see https://access.redhat.com/support/policy/updates/errata/

Affected upstream versions: Fixed in python v3.6.14, python v3.7.11, python v3.8.10, python v3.9.5.
Fixed upstream versions: v3.10.0
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 7215d1ae25525c92b026166f9d5cac85fb
CVE-2021-3743: kernel: out-of-bound Read in qrtr_endpoint_post in net/qrtr/qrtr.c
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-08-20T00:00:00+00:00

An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sanity check allows a local attacker to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability.

Statement: There was no shipped kernel version that was seen affected by this problem. These files are not built in our source code.

Affected upstream versions: Affects linux kernel v5.14.0-rc6 and above.
Fixed upstream versions: v5.14
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git
Upstream fix commit: 7e78c597c3eb
CVE-2021-3744: kernel: crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd()
Component: kernel
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-08-20T00:00:00+00:00

A flaw was found in the Linux kernel. A memory leak in the ccp-ops crypto driver can allow attackers to cause a denial of service. This vulnerability is similar with the older CVE-2019-18808. The highest threat from this vulnerability is to system availability.


Affected upstream versions: Fixed in v5.15-rc4 and above.
Fixed upstream versions: v5.15
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 505d9dcb0f7ddf9d075e729523a33d38642ae680
CVE-2021-3748: QEMU: virtio-net: heap use-after-free in virtio_net_receive_rcu
Component: QEMU
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.5 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)
Public date: 2021-08-27T00:00:00+00:00

A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to num_buffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process.

Statement: This issue affects the versions of `qemu-kvm` as shipped with Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 8 Advanced Virtualization. A future update may address this flaw.

Affected upstream versions: Affects qemu v0.10.0 and above, Fixed In – v6.2.0-rc0 and above.
Fixed upstream versions: v6.2.0
Upstream repository: https://github.com/qemu/qemu
Upstream fix commit: bedd7e93d01961fcb16a97ae45d93acf357e11f6
CVE-2021-3749: nodejs-axios: Regular expression denial of service in trim function
Component: nodejs-axios
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-08-31T00:00:00+00:00

A Regular Expression Denial of Service (ReDoS) vulnerability was found in the nodejs axios. This flaw allows an attacker to provide crafted input to the trim function, which might cause high resources consumption and as a consequence lead to denial of service. The highest threat from this vulnerability is system availability.

Statement: * OpenShift Container Platform (OCP) grafana-container does package a vulnerable version of nodejs axios. However, due to the instance being read only and behind OpenShift OAuth, the impact of this vulnerability is Low.

* Red Hat Advanced Cluster Management for Kubernetes (RHACM) 2.1 and previous versions does contain a vulnerable version of nodejs axios, RHACM 2.2 on towards are not affected versions. For RHACM 2.1, due to the instance being read only and behind OAuth, the impact of this vulnerability is Low.

* Because Service Telemetry Framework 1.2 will be retiring soon and the flaw's impact is lower, no update will be provided at this time for STF's service-telemetry-operator-container and smart-gateway-operator-container.

Affected upstream versions: unspecified <= 0.21.1
Fixed upstream versions: v0.21.2
Upstream repository: https://github.com/axios/axios
Upstream fix commit: 5b457116e31db0e88fede6c428e969e87f290929
CVE-2021-3753: kernel: a race out-of-bound read in vt
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2021-09-01T11:30:00+00:00

A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel, which may cause an out of bounds read in vt as the write access to vc_mode is not protected by lock-in vt_ioctl (KDSETMDE). The highest threat from this vulnerability is to data confidentiality.


Affected upstream versions: Linux kernel 5.15-rc1
Fixed upstream versions: v5.15
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 2287a51ba822384834dafc1c798453375d1107c7
CVE-2021-3757: nodejs-immer: prototype pollution may lead to DoS or remote code execution
Component: nodejs-immer
Severity: Important
CWE: CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-08-30T00:00:00+00:00

A flaw was found in immer when manipulates object attributes such as _proto_, constructor and prototype. An attacker can manipulate these values by overwriting and polluting them. Those attributes would be inherited by JavaScript objects which could trigger exception handlers and leading into a denial of service attack.

Statement: In OpenShift Container Platform (OCP) and OpenShift Migration Toolkit for Containers (MTC), the affected components are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-immer library to authenticated users only, therefore the impact is Low.

Affected upstream versions: unspecified <= 9.0.5
Fixed upstream versions: v9.0.6
Upstream repository: https://github.com/immerjs/immer
Upstream fix commit: fa671e55ee9bd42ae08cc239102b665a23958237
CVE-2021-37576: kernel: powerpc: KVM guest OS users can cause host OS memory corruption
Component: kernel
Severity: Important
CWE: CWE-1284 (Improper Validation of Specified Quantity in Input)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-07-23T00:00:00+00:00

A flaw was found on the Linux kernel. On the PowerPC platform, the KVM guest allows the OS users to cause host OS memory corruption via rtas_args.nargs. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Affected upstream versions: n/a
Fixed upstream versions: v5.14
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: f62f3c20647ebd5fb6ecb8f0b477b9281c44c10a
CVE-2021-3762: quay/claircore: directory traversal when scanning crafted container image layer allows for arbitrary file write
Component: quay/claircore
Severity: Critical
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2021-09-28T12:00:00+00:00

A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which, when scanned by Clair, allows for arbitrary file write on the filesystem, potentially allowing for remote code execution.

Statement: Only a single version of Red Hat Quay, 3.5.6 is affected by this vulnerability. All previous released versions of Red Hat Quay are not affected by this vulnerability.

The overall vulnerability is rated as Critical for the ClairCore engine, but only rated Important for the Red Hat Quay product. In Red Hat Quay, Clair runs as the 'nobody' user in an unprivileged container, limiting the impact to modification of non-sensitives files in that container.

Red Hat Advanced Cluster Security is not affected by this vulnerability.

Quay.io is not affected by this vulnerability.

Affected upstream versions: Affects v0.4.6 and higher, v0.5.3 and higher | Fixedin claircore v0.4.8, v0.5.5.
Fixed upstream versions: toolkit/v1.0.0
Upstream repository: https://github.com/quay/claircore
Upstream fix commit: 691f2023a1720a0579e688b69a2f4bfe1f4b7821
CVE-2021-3764: kernel: DoS in ccp_run_aes_gcm_cmd() function
Component: kernel
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-08-20T09:00:00+00:00

A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a denial of service. The vulnerability is similar to the older CVE-2019-18808. The highest threat from this vulnerability is to system availability.


Affected upstream versions: Fixed in v5.15-rc4
Fixed upstream versions: v4.12
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 36cf515b9bbe
CVE-2021-3765: validator: Inefficient Regular Expression Complexity in Validator.js
Component: validator
Severity: Moderate
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-11-02T00:00:00+00:00

A vulnerability was found in the validator package. Affected versions of this package are vulnerable to Regular expression denial of service (ReDoS) attacks, affecting system availability.


Affected upstream versions: unspecified < 13.7.0
Fixed upstream versions: 13.7.0
Upstream repository: https://github.com/validatorjs/validator.js
Upstream fix commit: 496fc8b2a7f5997acaaec33cc44d0b8dba5fb5e1
CVE-2021-3772: kernel: sctp: Invalid chunks may be used to remotely remove existing associations
Component: kernel
Severity: Moderate
CWE: CWE-354 (Improper Validation of Integrity Check Value)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-09-08T06:38:00+00:00

A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses.


Affected upstream versions: Fixed in linux kernel v5.15 and above
Fixed upstream versions: v5.15
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 32f8807a48ae55be0e76880cfe8607a18b5bb0df
CVE-2021-37750: krb5: NULL pointer dereference in process_tgs_req() in kdc/do_tgs_req.c via a FAST inner body that lacks server field
Component: krb5
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-08-19T00:00:00+00:00

A flaw was found in krb5. The Key Distribution Center (KDC) in MIT Kerberos 5 has a NULL pointer dereference via a FAST inner body that lacks a server field. An authenticated attacker could use this flaw to crash the Kerberos KDC server. The highest threat from this vulnerability is to system availability.


Affected upstream versions: n/a
Fixed upstream versions: krb5-1.20-final
Upstream repository: https://github.com/krb5/krb5
Upstream fix commit: d775c95af7606a51bf79547a94fa52ddd1cb7f49
CVE-2021-3778: vim: heap-based buffer overflow in utf_ptr2char() in mbyte.c
Component: vim
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2021-09-07T00:00:00+00:00

A flaw was found in vim. A possible heap-based buffer overflow could allow an attacker to input a specially crafted file leading to a crash or code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Affected upstream versions: unspecified < 8.2.3409
Fixed upstream versions: 8.2.3409
Upstream repository: https://github.com/vim/vim
Upstream fix commit: 65b605665997fad54ef39a93199e305af2fe4d7f
CVE-2021-3796: vim: use-after-free in nv_replace() in normal.c
Component: vim
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H)
Public date: 2021-09-11T00:00:00+00:00

A use-after-free vulnerability in vim could allow an attacker to input a specially crafted file leading to memory corruption and a potentially exploitable crash or code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Affected upstream versions: unspecified <= 8.2.3428
Fixed upstream versions: v8.2.3428
Upstream repository: https://github.com/vim/vim
Upstream fix commit: 35a9a00afcb20897d462a766793ff45534810dc3
CVE-2021-3798: openCryptoki: Soft token does not check if an EC key is valid
Component: openCryptoki
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 5.1 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2021-05-18T00:00:00+00:00

A flaw was found in openCryptoki. The openCryptoki Soft token does not check if an EC key is valid when an EC key is created via C_CreateObject, nor when C_DeriveKey is used with ECDH public data. This may allow a malicious user to extract the private key by performing an invalid curve attack.


Affected upstream versions: Fixed in v3.17.0
Fixed upstream versions: v3.17.0
Upstream repository: https://github.com/opencryptoki/opencryptoki
Upstream fix commit: 4e3b43c3d8844402c04a66b55c6c940f965109f0
CVE-2021-3800: glib2: Possible privilege escalation thourgh pkexec and aliases
Component: glib2
Severity: Moderate
CWE: CWE-838 (Inappropriate Encoding for Output Context)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Public date: 2021-03-04T00:00:00+00:00

A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones under the right condition.


Affected upstream versions: Fixed in glib2 2.63.6
Fixed upstream versions: 2.63.6
Upstream repository: https://gitlab.gnome.org/GNOME/glib
Upstream fix commit: 3529bb4450a51995
CVE-2021-3801: nodejs-prismjs: ReDoS vulnerability
Component: nodejs-prismjs
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2021-09-11T00:00:00+00:00

Insufficient Regular Expression Complexity in prismjs leads to a Regular Expression Denial of Service (ReDoS) attack. An unauthenticated attacker can exploit this flaw to cause an application to consume an excess amount of CPU by providing a crafted HTML comment as input. This can result in a denial of service attack.

Statement: OpenShift Container Platform (OCP) grafana-container does package a vulnerable verison of prismjs. However due to the instance being read only and behind OpenShift OAuth, it has been given a Low impact. Additionally it has been marked as wont-fix at this time and may be fixed in a future release.

Just as OCP, OpenShift ServiceMesh (OSSM) components are behind OpenShift OAuth what reducing impact to Low.

Affected upstream versions: unspecified <= 1.24.1
Fixed upstream versions: v1.25.0
Upstream repository: https://github.com/prismjs/prism
Upstream fix commit: 0ff371bb4775a131634f47d0fe85794c547232f9
CVE-2021-3805: nodejs-object-path: prototype pollution vulnerability
Component: nodejs-object-path
Severity: Moderate
CWE: CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-09-13T00:00:00+00:00

A flaw was found in the object-path nodejs library when the del() function is called to validate object properties. An attacker can manipulate or alter the prototype of an object causing the modification of default properties on all objects. This could lead into a service disruption or a denial of service attack (DoS).


Affected upstream versions: unspecified < 0.11.8
Fixed upstream versions: 0.11.8
Upstream repository: https://github.com/mariocasciaro/object-path
Upstream fix commit: e6bb638ffdd431176701b3e9024f80050d0ef0a6