Описание
protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key proto to change the prototype of the returned map object instead of creating an own map entry in protobufjs/ext/textformat. This issue is fixed in version 8.6.5.
A flaw was found in protobufjs. The Text Format extension, responsible for compiling protobuf definitions into JavaScript functions, improperly parsed string-keyed map entries. This allowed a specially crafted map entry with the key __proto__ to modify the prototype of the returned map object. An attacker could exploit this to alter object behavior, potentially leading to information disclosure or other impacts.
Отчет
This Moderate-impact flaw in protobufjs allows an attacker to perform prototype pollution by providing specially crafted input to the Text Format extension. This could lead to information disclosure or other impacts by altering the behavior of JavaScript objects within applications utilizing protobufjs to process protobuf definitions.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Cryostat 4 | grafana-infinity-datasource-npm | Under investigation | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-console-plugin-pf5-rhel9 | Not affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-console-plugin-rhel8 | Not affected | ||
| OpenShift Pipelines | openshift-pipelines/pipelines-console-plugin-rhel9 | Not affected | ||
| OpenShift Service Mesh 3 | openshift-service-mesh/kiali-ossmc-rhel9 | Under investigation | ||
| OpenShift Service Mesh 3 | openshift-service-mesh/kiali-rhel9 | Under investigation | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/gateway-rhel9 | Under investigation | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-27/gateway-rhel9 | Under investigation | ||
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | Under investigation | ||
| Red Hat Build of Podman Desktop | rh-podman-desktop.git | Under investigation |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
4.8 Medium
CVSS3
Связанные уязвимости
protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key __proto__ to change the prototype of the returned map object instead of creating an own map entry in protobufjs/ext/textformat. This issue is fixed in version 8.6.5.
protobufjs compiles protobuf definitions into JavaScript (JS) function ...
protobufjs: Text Format string map parsing can mutate returned map object prototype
EPSS
4.8 Medium
CVSS3