This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2020-7677 →
DEBIAN-CVE-2020-7677
This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this...
Original description
The description as published by the source.
This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
node-thenify
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-1"}]}]
Debian:13
node-thenify
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-1"}]}]
Debian:14
node-thenify
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-1"}]}]
References
- advisory security-tracker.debian.org