CVE-2022-25878
CVE-2022-25878 · Prototype Pollution
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This vulnerability can occur in multiple ways: 1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions 2. by parsing/loading .proto files
CVSS 8.2 · Alta · EPSS 2,3% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
protobufjs
- Versiones
- ≥ unspecified, < 6.11.3: Afectada (custom)
Actualiza a 6.11.3
protobufjs npm
- Intervalos de versiones afectados
- SEMVER: ≥ 6.11.0, < 6.11.3
Actualiza a 6.11.3
protobufjs npm
- Intervalos de versiones afectados
- SEMVER: ≥ 6.10.0, < 6.10.3
Actualiza a 6.10.3
Fuentes originales
- https://snyk.io/vuln/SNYK-JS-PROTOBUFJS-2441248
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2841507
- https://github.com/protobufjs/protobuf.js/blob/d13d5d5688052e366aa2e9169f50dfca376b32cf/src/util.js%23L176-L197
- https://github.com/protobufjs/protobuf.js/commit/b5f1391dff5515894830a6570e6d73f5511b2e8f
- https://github.com/protobufjs/protobuf.js/pull/1731
- https://nvd.nist.gov/vuln/detail/CVE-2022-25878