node-set-value: CVE-2019-10747

Debian Bug report logs - #941189
node-set-value: CVE-2019-10747

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: node-set-value: CVE-2019-10747

Date: Thu, 26 Sep 2019 07:12:39 +0200

Source: node-set-value
Version: 0.4.0-1
Severity: important
Tags: security upstream
Control: found -1 3.0.0-1

Hi,

The following vulnerability was published for node-set-value.

CVE-2019-10747[0]:
| set-value is vulnerable to Prototype Pollution in versions lower than
| 3.0.1. The function mixin-deep could be tricked into adding or
| modifying properties of Object.prototype using any of the constructor,
| prototype and _proto_ payloads.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-10747
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10747
[1] https://snyk.io/vuln/SNYK-JS-SETVALUE-450213

Regards,
Salvatore

Message #10 received at 941189-submitter@bugs.debian.org (full text, mbox, reply):

From: Xavier Guimard <noreply@salsa.debian.org>

To: 941189-submitter@bugs.debian.org

Subject: Bug#941189 marked as pending in node-set-value

Date: Thu, 26 Sep 2019 05:30:02 +0000

Control: tag -1 pending

Hello,

Bug #941189 in node-set-value reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/node-set-value/commit/369b526cce423c58b18c7137d1451033fee8247d

------------------------------------------------------------------------
Fix prototype pollution (Closes: #941189, CVE-2019-10747)
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/941189

Message #17 received at 941189@bugs.debian.org (full text, mbox, reply):

From: Xavier <yadd@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 941189@bugs.debian.org

Subject: Re: [Pkg-javascript-devel] Bug#941189: node-set-value: CVE-2019-10747

Date: Thu, 26 Sep 2019 07:31:21 +0200

[Message part 1 (text/plain, inline)]

Le 26/09/2019 à 07:12, Salvatore Bonaccorso a écrit :
> Source: node-set-value
> Version: 0.4.0-1
> Severity: important
> Tags: security upstream
> Control: found -1 3.0.0-1
> 
> Hi,
> 
> The following vulnerability was published for node-set-value.
> 
> CVE-2019-10747[0]:
> | set-value is vulnerable to Prototype Pollution in versions lower than
> | 3.0.1. The function mixin-deep could be tricked into adding or
> | modifying properties of Object.prototype using any of the constructor,
> | prototype and _proto_ payloads.
> 
> 
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> 
> For further information see:
> 
> [0] https://security-tracker.debian.org/tracker/CVE-2019-10747
>     https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10747
> [1] https://snyk.io/vuln/SNYK-JS-SETVALUE-450213

Hi,

here is a patch for Buster

Cheers,
Xavier

[node-set-value_0.4.0-1+deb10u1.debdiff (text/plain, attachment)]

Message #22 received at 941189@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Xavier <yadd@debian.org>

Cc: 941189@bugs.debian.org, Debian Security Team <team@security.debian.org>

Subject: Re: [Pkg-javascript-devel] Bug#941189: node-set-value: CVE-2019-10747

Date: Thu, 26 Sep 2019 08:04:35 +0200

Hi Xavier,

On Thu, Sep 26, 2019 at 07:31:21AM +0200, Xavier wrote:
> Le 26/09/2019 à 07:12, Salvatore Bonaccorso a écrit :
> > Source: node-set-value
> > Version: 0.4.0-1
> > Severity: important
> > Tags: security upstream
> > Control: found -1 3.0.0-1
> > 
> > Hi,
> > 
> > The following vulnerability was published for node-set-value.
> > 
> > CVE-2019-10747[0]:
> > | set-value is vulnerable to Prototype Pollution in versions lower than
> > | 3.0.1. The function mixin-deep could be tricked into adding or
> > | modifying properties of Object.prototype using any of the constructor,
> > | prototype and _proto_ payloads.
> > 
> > 
> > If you fix the vulnerability please also make sure to include the
> > CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> > 
> > For further information see:
> > 
> > [0] https://security-tracker.debian.org/tracker/CVE-2019-10747
> >     https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10747
> > [1] https://snyk.io/vuln/SNYK-JS-SETVALUE-450213
> 
> Hi,
> 
> here is a patch for Buster

Thanks, you are fast :). I think like other similar cases for node-*
modules we can go the buster-pu route here as well.

Unless you object, I will mark it as no-dsa (Can be fixed via point
release).

Regards,
Salvatore

Message #27 received at 941189@bugs.debian.org (full text, mbox, reply):

From: Xavier <yadd@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>

Cc: 941189@bugs.debian.org,Debian Security Team <team@security.debian.org>

Subject: Re: [Pkg-javascript-devel] Bug#941189: node-set-value: CVE-2019-10747

Date: Thu, 26 Sep 2019 09:14:21 +0200

[Message part 1 (text/plain, inline)]

Hi,

Of course a point release is enough here


Cheers,
Xavier

Le 26 septembre 2019 08:04:35 GMT+02:00, Salvatore Bonaccorso <carnil@debian.org> a écrit :
>Hi Xavier,
>
>On Thu, Sep 26, 2019 at 07:31:21AM +0200, Xavier wrote:
>> Le 26/09/2019 à 07:12, Salvatore Bonaccorso a écrit :
>> > Source: node-set-value
>> > Version: 0.4.0-1
>> > Severity: important
>> > Tags: security upstream
>> > Control: found -1 3.0.0-1
>> > 
>> > Hi,
>> > 
>> > The following vulnerability was published for node-set-value.
>> > 
>> > CVE-2019-10747[0]:
>> > | set-value is vulnerable to Prototype Pollution in versions lower
>than
>> > | 3.0.1. The function mixin-deep could be tricked into adding or
>> > | modifying properties of Object.prototype using any of the
>constructor,
>> > | prototype and _proto_ payloads.
>> > 
>> > 
>> > If you fix the vulnerability please also make sure to include the
>> > CVE (Common Vulnerabilities & Exposures) id in your changelog
>entry.
>> > 
>> > For further information see:
>> > 
>> > [0] https://security-tracker.debian.org/tracker/CVE-2019-10747
>> >     https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10747
>> > [1] https://snyk.io/vuln/SNYK-JS-SETVALUE-450213
>> 
>> Hi,
>> 
>> here is a patch for Buster
>
>Thanks, you are fast :). I think like other similar cases for node-*
>modules we can go the buster-pu route here as well.
>
>Unless you object, I will mark it as no-dsa (Can be fixed via point
>release).
>
>Regards,
>Salvatore

-- 
Envoyé de mon appareil Android avec Courriel K-9 Mail. Veuillez excuser ma brièveté.

[Message part 2 (text/html, inline)]

Send a report that this bug log contains spam.