Описание
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.
A flaw was found in protobufjs, a JavaScript (JS) library used for compiling protobuf definitions. A remote attacker with low privileges can exploit this vulnerability by injecting arbitrary code into the "type" fields of protobuf definitions. This malicious code will then execute during the object decoding process, leading to arbitrary code execution and potentially full system compromise.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Cryostat 4 | grafana-infinity-datasource-npm | Under investigation | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-console-plugin-rhel8 | Affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-console-plugin-rhel9 | Affected | ||
| OpenShift Service Mesh 3 | openshift-service-mesh/kiali-ossmc-rhel9 | Under investigation | ||
| OpenShift Service Mesh 3 | openshift-service-mesh/kiali-rhel9 | Under investigation | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/gateway-rhel9 | Under investigation | ||
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | Under investigation | ||
| Red Hat build of Apicurio Registry 3 | apicurio/apicurio-studio-ui-rhel8 | Will not fix | ||
| Red Hat Build of Podman Desktop | podman-desktop-macos-1-0 | Affected | ||
| Red Hat Build of Podman Desktop | podman-desktop-windows-1-0 | Affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
8.8 High
CVSS3
Связанные уязвимости
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.
protobufjs compiles protobuf definitions into JavaScript (JS) function ...
Уязвимость библиотеки для работы с протоколом Protocol Buffers (Protobuf) protobufjs, связанная с неверным управлением генерацией кода, позволяющая нарушителю выполнить произвольный код
EPSS
8.8 High
CVSS3