Описание
Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js
Versions of uglify-js prior to 2.4.24 are affected by a vulnerability which may cause crafted JavaScript to have altered functionality after minification.
Recommendation
Upgrade UglifyJS to version >= 2.4.24.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2015-8857
- https://github.com/mishoo/UglifyJS2/issues/751
- https://github.com/lautis/uglifier/commit/4677bfe38142937ff952f95605bcec4618892c3e
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uglifier/CVE-2015-8857.yml
- https://web.archive.org/web/20200227190830/http://www.securityfocus.com/bid/96410
- https://zyan.scripts.mit.edu/blog/backdooring-js
- http://www.openwall.com/lists/oss-security/2016/04/20/11
Пакеты
uglify-js
< 2.4.24
2.4.24
uglifier
< 2.7.2
2.7.2
Связанные уязвимости
The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.
The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.
The uglify-js package before 2.4.24 for Node.js does not properly acco ...
Уязвимость библиотеки uglify-js прикладного программного обеспечения Аврора Центр, связанная с ошибками проверки синтаксиса входных данных, позволяющая нарушителю выполнить произвольный код