Prototype Pollution in set-value
Résumé
Prototype Pollution in set-value
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Versions of set-value prior to 3.0.1 or 2.0.1 are vulnerable to Prototype Pollution. The set function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.
Recommendation
If you are using set-value 3.x, upgrade to version 3.0.1 or later.
If you are using set-value 2.x, upgrade to version 2.0.1 or later.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2019-10747 node-set-value Corrigé dans: 0.4.0-2
Références
- advisory nvd.nist.gov
- web github.com
- web github.com
- web lists.apache.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web snyk.io
- web npmjs.com