GHSA-79JW-6WG7-R9G4高危已审查

Use of Potentially Dangerous Function in mixme

OSV 1.4.0 · github-reviewed · 修改于 2021-05-08 05:13

发布时间

2021-05-06 23:45

GitHub 审查时间

2021-05-06 02:39

NVD 发布时间

2021-05-06 21:15

源文件

advisories/github-reviewed/2021/05/GHSA-79jw-6wg7-r9g4/GHSA-79jw-6wg7-r9g4.json

公告说明

Impact

In Node.js mixme v0.5.0, an attacker can add or alter properties of an object via 'proto' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).

Patches

The problem is corrected starting with version 0.5.1.

References

Issue: https://github.com/adaltas/node-mixme/issues/1 Commit: https://github.com/adaltas/node-mixme/commit/cfd5fbfc32368bcf7e06d1c5985ea60e34cd4028

受影响的软件包

npm

mixme

ECOSYSTEM

标识信息

别名 / CVE

CVE-2021-29491

CWE

CWE-913

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

原始 OSV JSON

{
  "id": "GHSA-79jw-6wg7-r9g4",
  "aliases": [
    "CVE-2021-29491"
  ],
  "details": "### Impact\n\nIn Node.js mixme v0.5.0, an attacker can add or alter properties of an object via 'proto' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).\n\n### Patches\nThe problem is corrected starting with version 0.5.1.\n\n### References\nIssue: https://github.com/adaltas/node-mixme/issues/1\nCommit: https://github.com/adaltas/node-mixme/commit/cfd5fbfc32368bcf7e06d1c5985ea60e34cd4028\n\n",
  "summary": "Use of Potentially Dangerous Function in mixme",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.1"
            }
          ]
        }
      ],
      "package": {
        "name": "mixme",
        "ecosystem": "npm"
      }
    }
  ],
  "modified": "2021-05-07T21:13:59Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"
    }
  ],
  "published": "2021-05-06T15:45:39Z",
  "references": [
    {
      "url": "https://github.com/adaltas/node-mixme/security/advisories/GHSA-79jw-6wg7-r9g4",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29491",
      "type": "ADVISORY"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20210622-0002",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-913"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": "2021-05-06T13:15:00Z",
    "github_reviewed_at": "2021-05-05T18:39:38Z"
  }
}