Описание
jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| requirejs | fixed | 2.3.7+ds+~2.1.37-1 | package | |
| requirejs | no-dsa | bookworm | package | |
| requirejs | no-dsa | bullseye | package |
Примечания
https://gist.github.com/mestrtee/9acae342285bd2998fa09ebcb1e6d30a
https://github.com/requirejs/requirejs/issues/1854
https://github.com/requirejs/requirejs/pull/1856
https://github.com/requirejs/requirejs/commit/6e8a234303deaf80ef619e66a2f5c6616bb7e6d9 (2.3.7)
EPSS
Связанные уязвимости
jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
jrburke requirejs vulnerable to prototype pollution
Уязвимость функции s.contexts._.configure библиотеки для загрузки модулей JavaScript RequireJS, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
EPSS