Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix CVE–2022–37601 #29

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from

Conversation

debricked-staging[bot]
Copy link

@debricked-staging debricked-staging bot commented Nov 10, 2022

CVE–2022–37601

Vulnerability details

Description

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

NVD

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.

GitHub

Prototype pollution in webpack loader-utils

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils prior to version 2.0.3 via the name variable in parseQuery.js.

CVSS details - 9.8

 

CVSS3 metrics
Attack Vector Network
Attack Complexity Low
Privileges Required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
References

    [CVE-2022-37601]/Prototype pollution found in parseQuery.js · Issue #212 · webpack/loader-utils · GitHub
    loader-utils/parseQuery.js at d9f4e23cf411d8556f8bac2d3bf05a6e0103b568 · webpack/loader-utils · GitHub
    loader-utils/parseQuery.js at d9f4e23cf411d8556f8bac2d3bf05a6e0103b568 · webpack/loader-utils · GitHub
    Prototype pollution in webpack loader-utils · CVE-2022-37601 · GitHub Advisory Database · GitHub
    NVD - CVE-2022-37601
    Release v2.0.3 · webpack/loader-utils · GitHub
    fix: Resolve potential prototype polution exploit by JSMike · Pull Request #217 · webpack/loader-utils · GitHub
    fix: security problem by alexander-akait · Pull Request #220 · webpack/loader-utils · GitHub
    Release v1.4.1 · webpack/loader-utils · GitHub

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE

 

@debricked debricked bot force-pushed the debricked-fix-CVE_2022_37601-4b491af48762fd5a branch from add86f0 to a2242a1 Compare November 30, 2022 10:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants