CVE-2019-19919
Prototype Pollution in handlebars
Résumé
Prototype Pollution in handlebars
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Versions of handlebars prior to 3.0.8 or 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Objects' __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads.
Recommendation
Upgrade to version 3.0.8, 4.3.0 or later.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
npm
handlebars
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.8"}]}]
RubyGems
bootstrap-wysihtml5-rails
[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.3.5"},{"last_affected":"0.3.3.8"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2019-19919 node-handlebars Corrigé dans: 3:4.5.3-1
Références
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web cve.mitre.org
- web github.com
- web github.com
- web github.com
- web tenable.com