Debian Bug report logs -
#969669
node-node-forge: CVE-2020-7720
Reported by: Salvatore Bonaccorso <carnil@debian.org>
Date: Sun, 6 Sep 2020 20:09:01 UTC
Severity: grave
Tags: security, upstream
Found in versions node-node-forge/0.9.1~dfsg-1, node-node-forge/0.8.1~dfsg-1
Reply or subscribe to this bug.
Toggle useless messages
Report forwarded
to debian-bugs-dist@lists.debian.org, carnil@debian.org, team@security.debian.org, Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>:
Bug#969669; Package src:node-node-forge.
(Sun, 06 Sep 2020 20:09:03 GMT) (full text, mbox, link).
Acknowledgement sent
to Salvatore Bonaccorso <carnil@debian.org>:
New Bug report received and forwarded. Copy sent to carnil@debian.org, team@security.debian.org, Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>.
(Sun, 06 Sep 2020 20:09:03 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
Source: node-node-forge
Version: 0.9.1~dfsg-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: found -1 0.8.1~dfsg-1
Hi,
The following vulnerability was published for node-node-forge.
CVE-2020-7720[0]:
| The package node-forge before 0.10.0 is vulnerable to Prototype
| Pollution via the util.setPath function. Note: Version 0.10.0 is a
| breaking change removing the vulnerable functions.
As noted the fix consists removing the function as whole, so might
break users of the module accordingly.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2020-7720
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7720
[1] https://snyk.io/vuln/SNYK-JS-NODEFORGE-598677
[2] https://github.com/digitalbazaar/forge/commit/6a1e3ef74f6eb345bcff1b82184201d1e28b6756
Regards,
Salvatore
Marked as found in versions node-node-forge/0.8.1~dfsg-1.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to submit@bugs.debian.org.
(Sun, 06 Sep 2020 20:09:03 GMT) (full text, mbox, link).
Severity set to 'grave' from 'important'
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org.
(Sun, 06 Sep 2020 20:12:03 GMT) (full text, mbox, link).
Send a report that this bug log contains spam.
Debian bug tracking system administrator <owner@bugs.debian.org>.
Last modified:
Mon Sep 7 05:34:25 2020;
Machine Name:
bembo
Debian Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.
Vulmon